Page 75 - Pay Magazine s2014

volume 7 • fall 2014
to ensure all parties follow the letter of the law and regulation, protect consumers and avoid having prepaid funds used for nefarious purposes.
Paul Reymann is a partner with McGovern Smith Advisors. He has
more than 28 years in compliance and risk management, including 13 with the U.S. Department of Treasury, where he co-authored the Gramm-Leach-Bliley
Act security regulation. Reach him at preymann@mcgovernsmithadvisors.com.
endnotes
1 example references include: oCC Bulletin 2013-29 - third-Party Relationships: Risk Management Guidance; FdIC FIL-3-2012 – Payment Processor Relationships; and FRB sR 13-19 – Guidance on Managing outsourcing Risk.
2 Criticalactivitiesaresignificantbankfunctions(e.g., payments, clearing, settlements, custody) or significant shared services (e.g., information technology), or other activities(e.g.,identityverificationofcustomers)that: could cause a bank to face significant risk if the third party fails to meet expectations; could have significant customer impacts; require significant investment in resources to implement the third-party relationship and manage the risk; or could have a major impact on bank operations if the bank has to find an alternate third party or if the activity has to be brought in-house. Program managers perform many activities that are critical to their issuing bank clients (e.g., access to cardholder data, marketing, selling, customer servicing and performing customer identification procedures).
3 It’s not just program managers that need to step up. other third parties with a role in the prepaid value chain are in the same situation. the other third parties might include: merchant acquirers, acquiring banks, issuer and merchantprocessors,paymentnetworks,callcenters, distributors or sellers. For the purpose of this article, we’re focusing on program managers.
4 seeCFPBBulletin2013-6,“ResponsibleBusiness Conduct: self-Policing, self-Reporting, Remediation, and Cooperation” (June 25, 2013).
paybefore.com 73