Building Compliance Programs for Emerging PaymentsJuly 30, 2015

Presentation Overview

2

CONTENTS

Background –

WePay’sBusiness Opportunity

Demo –

A Typical WePay Implementation

Controls -

Innovative Risk Management

Conclusion –

Emerging Payments and Compliance

3

01____

Background

The WePay Payment Service

4

BACKGROUND

The WePay API enables platforms to provide payment services to their customers.

Presents Risk

“API” means application programming interface.

“Platform” means a website for crowdfunding, business tools, or marketplace, such as GoFundMe, FreshBooks, or CustomMade.

“Payment Services” are credit and debit card acceptance as well as bank transfer (ACH).

”Customers” are the platform’s users. The platform makes the purchase decision to integrate WePay, but WePay provides payment services to the platform’s end user customers.

BACKGROUND

What is a Platform Customer?

6

BACKGROUND

Platforms Provide Benefits to End User Customers

Web-hosting, website editing tools.

Business services in the cloud – recordkeeping, pay as you go.

Marketing – drive traffic.

Tools for connecting to social media, tips on conversion.

7

BACKGROUND

WePay connects to the platform’s end users.

WePay’s Compliance Structure

8

BACKGROUND

WePay Provides Benefits to Platforms

No merchant aggregation under the Card Network Rules.

Anti-money laundering, PCI-DSS, and other compliance.

When there are refunds or chargebacks, WePay must recover from the submerchant or take a loss.

No money transmitter licensing risk.

9

____

Demo02

DEMO

DEMO

DEMO

DEMO

DEMO

DEMO

DEMO

DEMO

DEMO

DEMO

WePay’s Key Differentiators Are Invisible

20

DEMO

Platform Branding

“White label” branding.

Integrated navigation.

Risk Management

Minimized end user data requirements.

Optimized for the online environment.

Leveraging data collected by platform.

21

03____

Controls

22

CONTROLS

Challenges

Risk Controls Apply Primarily to TransactionsSupplement data collected upon account creation:

Payment Transactions Disbursement Transactions

Data actively provided to WePay by users

Data input by payers (name, email, card number, CVV, zip code, transaction amount).

Transaction amount.

Data provided to WePay by the platform

Description of fundraising campaign or business.

Social media accounts (Facebook), comments, sharing.

Data passively provided to WePay by users

IP address.

Threatmetrix device id.

Data independently collected by WePay

Card network authorization.

Account linking based on email domain, CC number, etc.

Additional data actively provided to WePay by users

CIP: Legal name, physical address, TIN, date of birth, telephone number.

Bank account number; bank routing number.

Additional data provided to WePay by the platform

More comments, sharing.

Additional data passively provided to WePay by users

More IP addresses from additional logins.

CC failures, Card Network lists.

Additional data independently collected by WePay

Experian check on CIP data.

OFAC check on CIP data.

Account linking based on bank account and BIN.

Traditional AML Is Included

23

CONTROLS

But traditional controls are of limited utility.Presents Risk

OFAC name check.

Much traditional identity information is compromised (name, TIN, credit card number).

CIP validation.

Solution: active risk management to leverage the wealth of online data.

24

C O N T R O L S

1.

Machine learning algorithm scores transactions for risk.

3.

Risk analysts approve or deny transactions.

2.

Rules engine flags transactions by risk and compliance category.

WePay’s Risk Management Process

4.

Loss results are used to identify new signals and rules and to train the model.

WePay Risk Control Innovations

25

CONTROLS

WePay supports GoFundMe, a crowdfunding platform that is bigger than Kickstarter and Indiegogo.

Presents Risk

Use social media, such as Facebook, for identify verification (US Patent No. 8918904 issued December 23, 2014).

Use Risk API to pass risk data from platform to WePay (patent pending). For example, FreshBooks passes invoice information.

Generate reason codes from machine learning algorithms so that human risk analysts can better analyze flagged accounts (patent pending).

Use risk data modeling to assign a risk score based on hundreds of fraud signals, including strength of social media footprint, MCC, device characteristics, etc.

WePay’s Machine Learning Model

26

CONTROLS

Train the model, analyze results, re-train, and re-deploy < 1 day per cycle. Signals used include:

Presents Risk

Multiple accounts logged onto one device, multiple withdrawals to one bank account.

Practices the people use to hide their digital footprints, like VPN tunneling or the use of virtual machines and TOR.

Velocity variables, such as transaction volume by user, device, IP, credit cards, and bank accounts.

Transaction size, rapid withdrawal, email domain, user country, hours of the day.

WePay’s Risk Analyst Review Process

27

CONTROLS

Flagged transactions are queued for manual review.Presents Risk

Review of accounts flagged for one reason (for example, OFAC) can uncover other risk factors (location discrepancy).

Human judgment and intuition are irreplaceable ingredients for continuous improvement.

Research additional online resources such as LexisNexis to validate date of birth, address, SSN.

Search Facebook, Twitter, Pinterest, Google for a consistent story. “Known good” can be easier to establish than “known bad” – and equally predictive.

28

____

Conclusion04

29

C O N C L U S I O N

Emerging Payments Require Innovative Controls

Identity is at the core. Supports account linking to combat fraud. Also essential to anti-money laundering compliance.

It’s an online arms race. Rapid iteration is essential as data is compromised and techniques evolve.

The human element is essential because fraudsters are human, too.

WePay Is Hiring!

30

CONCLUSION

Chief Compliance Officer - Worldwide

Manage WePay’s AML program.Document processes; provide training.

Support expansion to Europe, Australia, and beyond.

Lead compliance initiatives in the areas of Privacy and Card Network Rules.

Respond to audits and requests from law enforcement.

Minimum 5 years experience; ACAMS credential.

Apply at www.wepay.com/careers

31

Questions?