Giving local government and school districts such protections means that their liability could be capped at $50 for losses -- losses that could exceed hundreds of thousands of dollars, Johnson says.
The passing of Schumer's amendment could create even more problems for municipalities and school districts, because banks may not take on those entities on as clients because; the heightened risk associated with them would make them unattractive, Johnson says. Banks also may raise the price for services they charge, to cushion themselves if and when a breach does occur.
"If Regulation E protections apply to such accounts, banks would have to either significantly re-price those accounts, re-price their ACH and wire services, or just stop providing the online services," Johnson says. The APA is opening a dialogue with Schumer in an effort to ensure the needs of banks and their customers and clients are taken into consideration.
During this interview [transcript below], Johnson discusses:
- Why the ABA is opposes changes to Reg. E;
- How the ABA expects to educated Congress about the need for more commercial education about ACH fraud;
- Why education is needed to maximize security.
Johnson is the American Bankers Association's vice president and senior advisor risk management policy, where he is involved in a variety of public policy and compliance issues. He currently leads the association's enterprise risk, physical and cyber security, business continuity and resiliency policy and fraud deterrence efforts. He has assisted in the ABA's release of a series of resources to deter bank robberies, assess information technology risk, deter phishing, safeguard customer information and buttress emergency preparedness.
Johnson represents the ABA on the Financial Services Sector Coordinating Council, which advises the federal bank regulatory agencies on homeland security and critical infrastructure protection issues, and serves on the BITS/Financial Services Roundtable Security Steering Committee. He is also a board member of the Financial Services Information Sharing and Analysis Center, a private corporation that works with government to provide the financial sector with cyber and physical threat and vulnerability information, as part of the nation's homeland security initiative.
Schumer's Amendment and the Banking IndustryTRACY KITTEN: This amendment to Regulation E, which is now before the Senate, if passed would give local governments and school districts the same level of protection under Regulation E as consumers. From a high-level perspective, what does this proposed amendment mean for the banking industry?
DOUG JOHNSON: Absolutely no banker wants to see a municipality or a school district suffer fraud losses. That is first and foremost why we are in the business of trying to protect those customers and helping those customers protect themselves. However, giving such customers Regulation E protections means that their liability could be capped at $50 dollars for losses that could be in the hundreds of thousands of dollars.
We certainly welcome the opportunity to discuss with the senator ways to protect these kinds of customers without shifting the liability for losses so dramatically. And that is particularly true when the municipality or school district did not adequately secure their computers or might not have appropriate internal controls in place.
I think that the bottom line for the industry is in partnership with those customers. We can go a long way toward solving these problems and we look forward to working with the senator to make sure that his concerns are addressed as well.
KITTEN: It has been suggested that if this amendment were to pass it could create more problems for local governments and school districts as banks might not want to take on these entities as clients because of the risk associated with them. Or the banks might raise the price for services they charge these entities to cushion themselves if and when a breach does occur. What is your perspective on this argument?
JOHNSON: Our perspective is that if Regulation E protections apply to such accounts, banks would have to either significantly re-price those accounts, re-price their ACH and their wire services, or just stop providing the online services, and I'm sure that's not the Senator's intent. We are also beneficial for customers that have become accustomed to these services and the convenience that these services provide.
I think that the most productive way to accomplish our joint goals is to work together to ensure that we further protect the environment but still allow the services to continue, because it's important to remember the millions of ACH and wire transactions that are accomplished safely daily.
KITTEN: What is your feeling about this amendment? Do you think it will even pass?
JOHNSON: I believe that by discussing the issue with Senator Schumer we can find a way to address concerns without severely compromising the ability of municipalities and school districts to use online ACH services. We share the senator's concerns and are actively working on ways to prevent theft and respond to such account takeovers. A good example of that is the recent arrest of various mules. One hundred or so mules were arrested around the world and I think that's an indication of the seriousness with which law enforcement views this issue and the seriousness with which we view it.
The real desire is to work with law enforcement, our regulatory agencies and Congress to ensure that we are able to provide these services in a cost effective and efficient fashion.
Shifting Thoughts on Financial LiabilitiesKITTEN: The ongoing battle between businesses and banks over liability when an account takeover resulting from ACH or wire fraud occurs has been a hot topic for the last year. What does Schumer's proposal tell us about how government and regulators perhaps could be shifting the way they think about financial liabilities?
JOHNSON: It certainly demonstrates that they are taking the threat seriously just like we're taking it seriously. I would also prefer to characterize the current situation as a partnership between banks, regulatory agencies, law enforcement, and small business, municipal and school district customers.
It's up to us as our industry's largest trade association at the ABA to ensure that Congress, the regulatory agencies and our effective customers understand the unintended consequences of such a dramatic liability shift. And again, that's our job to ensure that all parties understand the implications of these kinds of actions so that we can reach a solution that is satisfactory for all.
KITTEN: If this amendment were to pass do you see it setting a precedent that could adversely affect financial institutions?
JOHNSON: Yes, and we hope to avoid both passage in its current form and it being used as an unfortunate precedent, which could potentially destroy the business case for such internet services.
KITTEN: And that would end up adversely affecting businesses as well?
JOHNSON: Absolutely, and that's in consequence with which we keep going back. Again, we need to recognize that while no school district and bank wants to have such serious losses, millions of these transactions are accomplished on a daily basis safely.
KITTEN: The ABA has been behind efforts to better educate consumers, businesses and merchants about fraud risks associated with ACH and wire breaches, adding that businesses need to take some responsibility. Where does the ABA fall then in regard to this amendment? Do you see small government bodies and school districts as being exceptions? From what I am gathering from what you've said thus far the answer is probably no.
JOHNSON: The answer would be no because of the reason that you alluded to. We view that this would be an unfortunate precedent which would impact the ability of businesses, school districts or municipalities to be able to conduct online ACH services. It's clear to us that the future branches are on the net to the extent that we take away the convenience that those kinds of customers would have in using those services. That is a great disadvantage to them. I would view it as an inappropriate precedent and I also would view it as something that would really take a stride in the wrong direction.
Options Beyond SchumerKITTEN: In closing, if this proposal is not the answer, what is? And, how can banks and their business customers address the ACH fraud or corporate account takeover issue in a way that satisfies both parties?
JOHNSON: That's a very good closing question because at the end of the day we all want the same thing. We all want to protect the environment and ensure that the environment can grow and prosper. We have a motivation to work jointly to accomplish that goal.
Working in concert with Congress, the regulatory agencies, law enforcement and the small business community is precisely what we're doing to try and make sure that everybody has the tools to protect the environment. Also we want to ensure that the bad guys are getting put away, that the mule networks are being taken down and that the small business customer recognizes that they have to take some responsibility. If they don't take some responsibility, the municipalities and the school districts don't take responsibility. The service could go away and that's not good for anybody.
That is the environment we want to try to foster, one of cooperation as opposed to one where we are at odds with each other. I'm optimistic that we can find some middle ground here. And I'm optimistic because I've seen the great work that we've been doing through the Financial Services Information Sharing and Analysis Center, with all those various, quality studies aside, really trying to draw the proper conclusions about how to protect this environment.