Assess whether a SAR narrative is supportable today from ACH return-reason

Situation

After a new device from a different metro on a 2am login, ACH return-reason code R10 spike is what payments-risk officer can touch in a mortgage correspondent channel. Fraud Detection will live with Remove access or reverse the item versus Temporary compensating control on this Credit and Identity Fraud file.

Decision

Payments-risk officer in a mortgage correspondent channel must choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold using ACH return-reason code R10 spike after a new device from a different metro on a 2am login.

Hypotheses to test

• ACH return-reason code R10 spike reads as Remove access or reverse the item once a new device from a different metro on a 2am login is lined up to the same Fraud Detection population.
• ACH return-reason code R10 spike is closer to Temporary compensating control after a new device from a different metro on a 2am login; Remove access or reverse the item would over-claim this Credit and Identity Fraud extract.
• Approve a documented exception is still live in ACH return-reason code R10 spike for payments-risk officer in a mortgage correspondent channel.
• ACH return-reason code R10 spike is missing the fact payments-risk officer needs after a new device from a different metro on a 2am login; stop this Fraud Detection close.

Analysis required

• Map typology and hold authority payments-risk officer actually has in a mortgage correspondent channel.
• Trace funds, counterparties, and reversals in ACH return-reason code R10 spike through the window opened by a new device from a different metro on a 2am login.
• Quantify loss if the hold is released before ACH return-reason code R10 spike is complete.
• For this Fraud Detection Credit and Identity Fraud file, read ACH return-reason code R10 spike against a new device from a different metro on a 2am login and write the one fact that would move a SAR narrative is for payments-risk officer.

Recommendation

Choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold on this Fraud Detection / Credit and Identity Fraud packet (ACH return-reason code R10 spike after a new device from a different metro on a 2am login). The follow-on Credit and Identity Fraud action is what payments-risk officer does next: implement the option, assign an owner, and log the missing fact.