Article

Networks increase oversight of sponsor banks

Picture the ATM business as a high school prom. ISOs are the teenagers that make much of the activity happen. EFT networks are the high school principals who establish the rules. Sponsor banks are the chaperones responsible for enforcing the rules...

March 27, 2003

In an effort to keep a few unruly teens from ruining the party, the networks are asking their members who sponsor ISOs to keep a closer eye on the dance floor.

New network rules

In January, NYCEissued rule changes that Will Peirce, NYCE's director of network services, said helped clarify sponsor obligations.

At a minimum, Peirce said, NYCE expects its members to perform financial reviews of the ISOs they sponsor, as well as the principals of the ISO. Other requirements include visiting the ISO's principal place of business, ensuring that the ISO is registered with the appropriate governmental authorities, checking the ISO's status with other shared networks and confirming that the ISO has comprehensive terminal inventory procedures.

The inventory item, a new requirement, was a result of the aftermath of a multimillion dollar fraud case in which an Eastern European crime ring used ATMs purchased from an ISO to obtain cardholders' PINS in late 2001 and early 2002. The FBI had difficulty locating some of the machines where PINs were compromised because of the poor record keeping of one of two ISOs that sold the ATMs. (See related story Skim skam man)

"Obviously terminals are sometimes moved because of poor transaction volumes, but if a terminal is being moved every week, it could be a sign of something else," Peirce said

NYCE will begin performing audits in April to ensure that its members that sponsor ISOs are complying with its requirements. While NYCE has always had the right to audit sponsors, Peirce said it's an option that has rarely been exercised in the past.

On the same page

Other networks will follow suit. Star is currently reviewing rule changes with its operations advisory group and expects to introduce policies similar to those of NYCE, said Beth Lynn, Star's senior vice president of network administration.

"We realize that most people participate in multiple networks, so the more consistent we can make the requirements, the easier it will be for everyone to comply," Lynn said.

The networks also don't want sponsors and ISOs to be able to take a "path of least resistance" by moving their business to a network with standards more lenient than others, Peirce said.

Lynn said that Star has been working directly with NYCE and several other networks since shortly after the aforementioned fraud case in which skimming devices were placed inside of ATMs.

The case was a "wake-up call" for the industry, Lynn said. "It was the biggest case where fraud occurred due to the behavior of an acquirer's agent. The criminals first identified weaknesses in the devices, and then determined that in some cases there was not going to be strenuous verification of who they were."

Many sponsor banks began obtaining detailed financials, among other information, from their ISOs since Visa U.S.A. stepped up enforcement of what it calls enhanced ISO risk standards in January of 2001. (See related stories Visa: New ISO risk standards will help prevent fraud and New requirements cause information overload for some ISOs)

"Agent banks that underwrite, monitor and control agent relationships must determine an agent is financially responsible," said Martin Elliott, Visa U.S.A.'s director of corporate risk management, during a February 2002 presentation at an ATM Industry Association (ATMIA) conference.

Visa requires a written guarantee from its sponsor (or agent) banks to ensure that reviews have been performed. Visa also asks them to review ISOs' records on an annual basis and provide summaries of those reports. And Visa wants a senior member of bank management to be included in the review process.

Visa can respond to noncompliance in several ways, Elliott said, from issuing warnings to limiting the number of ISOs a bank can sponsor.

Noting that all networks have to balance the potential risks with costs to their members, Lynn said, "It's all good as long as it makes a positive impact on reducing risk. We don't ever want to put rules in place just to be adding rules."

In some cases, Lynn said, sponsors have been unclear as to their liability on the acquiring side. "If a bank employee steals cards out of an ATM, it's pretty clear who is liable. I don't think it's quite that easy to understand with an agent relationship."

Leaning on the little guys?

Indeed, Marilyn Kilcrease, president of Temecula, Calif.-based consulting firm Creative Card Solutions, said that few banks are experts in the retail ATM business. "It can be a difficult concept to understand. Not all traditional banks have the time and energy."

For that reason, sponsorship has been dominated by smaller financial institutions such as California's Palm Desert National Bank, Colorado's Pueblo Bank and Trust and Texas' Herring National Bank. There are a few exceptions, such as Minneapolis-based U.S. Bank, which offers sponsorship through its Elan Financial Services processing division.

Kilcrease, who advises four sponsors that maintain relationships with some 80 ISOs between them, said that most enforcement efforts to date have occurred at smaller banks. She would like to see the rules applied more consistently.

"I don't think that U.S. Bank has gone through the review process that the smaller members have," she said. "This doesn't mean those sponsored ATMs are in compliance, just that U.S Bank can sustain a large loss. This does nothing to protect the system, a cardholder's PIN or prevent cardholders' loss of confidence in the system."

Bill Mayton, senior vice president and chief financial officer for First National Bank of Alamogordo, N.M., said he felt Visa applied "unreasonable" pressure, leading him to drop sponsorship at his $150 million financial institution last July after about four years of providing the service to some 60 ISOs.

"From my standpoint, it was clear they were going to force us out," Mayton said. "No matter what we said or did, we were out."

Previously, Mayton said, Visa had worked with his bank to improve its due diligence program, leading them to hire a private investigator to conduct background checks and site visits on ISOs it sponsored. First National Bank of Alamogordo dropped some ISOs that didn't pass that round of scrutiny, he said.

The bank earned more than $100,000 a year at the height of its sponsorship activities, Mayton said, by collecting annual fees and small per-transaction fees from its ISOs. "It didn't make or break the bank, but when were looking at generating new sources of income, it became significant," he said.

Visa's enforcement efforts exceeded the level of possible risk, Mayton said. "We kept asking them to tell us what the risk was, and they couldn't. From our perspective, we'd never experienced any risk or seen any."

The middle man

First Bank of Alamogordo entered the sponsorship arena through a relationship with its transaction processor, Genpass Technologies. There is often a close connection between the processor and the sponsor. Most processors will help line up a sponsor bank for ISOs that do not already have one. Some sponsors, such as EFS National Bank, work exclusively with one processor -- in this case, parent company Concord EFS -- while others work with multiple companies.

While the sponsor officially bears the liability for any risk, industry sources say it is common for processors and sponsors to have agreements in which the processor would compensate the sponsor for any financial losses resulting from an ISO relationship.

Kilcrease said that Visa and networks like NYCE and Star want sponsors to take a more active role with ISOs rather than entrusting the responsibility to processors, as has often been the case in the past.

"The processor has become the controlling player rather than the sponsor, with the networks assuming the role of enforcer," she said.

Barbara Eike, director of network relationships for Atlanta-based processor Lynk Systems, said that Lynk is "doing the same things we've always done" but with more of an emphasis on documentation.

She welcomes the networks' efforts to provide better guidelines to sponsors and processors. "There are so many rules, and they are changing so much," she said.

Playing by the rules

Some ISOs feel the same way. Compliance is "not as big of a deal as some people make it out to be," said Doug Falcone, chief executive of Whippany, N.J.-based ISO Access to Money, which has about 1,600 ATMs under contract.

Because "at first it was very unclear what Visa wanted us to do," Falcone said, he welcomes the networks' efforts to clarify their rules. "Now that we've been given their rules, we'll play by them."

Falcone said his sponsor, Citizen's Bank, has required him to provide detailed financials on not only his company, but on all of the agents selling ATMs for him, since last spring. Access to Money closely with its processor, Lynk, as well as its leasing company to verify information provided by its agents, he said.

Recently, Access to Money employees began phoning new merchant locations every time an agent submits a credit application to ensure that the agent has accurately represented the terms of the deal.

"We want to keep better track of what's going on and eliminate any ISOs who may not be saying or doing the right thing," Falcone said.

Most of Access to Money's agents have not objected to the added oversight, Falcone said. "The bad guys don't want to give it, but the good guys have no trouble with it."

His company has dropped half a dozen agents who could not or would not provide the necessary information, Falcone said.

Based on early feedback, NYCE's Peirce believes that the six banks that sponsor ISOs into NYCE, as well as the ISOs themselves, are supportive of his network's efforts to reduce the risk of fraud. In a way, he said, it's a validation of their business.

"I think it's a signal to the marketplace that the networks understand the value of an ATM ISO's business. We're taking it more seriously, and we want them to take it more seriously," he said.