Pub. 5 2024 Issue 5

ISSUE 5 2024 Official Publication of the Community Bankers Association of Kansas

CONTENTS Issue 5 www.cbak.com ©2024 Community Bankers Association of Kansas | The newsLINK Group LLC. All rights reserved. In Touch is published six times each year by The newsLINK Group LLC for the Community Bankers Association of Kansas and is the official publication for this association. The information contained in this publication is intended to provide general information for review, consideration and education. The contents do not constitute legal advice and should not be relied on as such. If you need legal advice or assistance, it is strongly recommended that you contact an attorney as to your circumstances. The statements and opinions expressed in this publication are those of the individual authors and do not necessarily represent the views of the Community Bankers Association of Kansas, its board of directors or the publisher. Likewise, the appearance of advertisements within this publication does not constitute an endorsement or recommendation of any product or service advertised. The Community Bankers Association of Kansas is a collective work, and as such, some articles are submitted by authors who are independent of the Community Bankers Association of Kansas. While In Touch encourages a first‑print policy, in cases where this is not possible, every effort has been made to comply with any known reprint guidelines or restrictions. Content may not be reproduced or reprinted without prior written permission. For further information, please contact the publisher at (855) 747‑4003. 4 FLOURISH LEVELING THE PLAYING FIELD By Rebeca Romero Rainey, President and CEO, ICBA 6 EASING INTO THE FALL At Long Last, Some Rate Relief By Jim Reber, President and CEO, ICBA Securities 8 2024 CONVENTION & TRADE SHOW 10 CBA MEMBERSHIP APPRECIATION TAILGATE 12 INTRODUCING CBAK’S NEW ENDORSED PARTNER, WOLTERS KLUWER BIZFILINGS CBAK Member Banks Can Help Small Business Customers Avoid BOI Non‑Compliance Penalties 13 NEW ASSOCIATE MEMBERS KLARIVIS THE BANKERS BANK 15 MANAGING CUSTOMER COMPLAINTS IS IMPORTANT TO AN EFFECTIVE CMS By William J. Showalter, CRCM, Senior Consultant, Young & Associates Inc. 18 HOW CFPB’S RULE 1033 COULD AFFECT DATA RIGHTS AND OPEN BANKING By Bradley Wallace, Director of Compliance, CSI 20 WHAT SHOULD BE INCLUDED IN A TPS’S OFAC POLICY? By Matthew Wade, EPCOR 22 ANNIVERSARIES 23 OFFICERS AND DIRECTORS 23 PRODUCTS AND SERVICES REFERENCE LIST 26 BANK TRAINING WEBINARS 82024 CONVENTION & TRADE SHOW 10CBA MEMBERSHIP APPRECIATION TAILGATE 15 MANAGING CUSTOMER COMPLAINTS IS IMPORTANT TO AN EFFECTIVE CMS 3 In Touch

At the end of the day, it’s the customer who will pay the ultimate price if unbalanced regulations are allowed to continue. They say imitation is the greatest form of flattery, but when it comes to financial services, it doesn’t make for a fair banking environment. Just look at credit unions, trying to position themselves as “community” organizations without having to demonstrate that they meet Community Reinvestment Act requirements. Or Industrial Loan Companies, with holding companies not subject to bank compliance reviews. Or the Farm Credit System, which wants to compete with community banks but doesn’t want to be regulated like them. Or mega banks that are too big to fail, ensuring we pay the price with outsized regulation. The list goes on. We need a level playing field. As outlined in our recent report, “Finding Balance: How Well‑Intended Policies Hamper Small Business Lending and Undermine Relationship Banking,” the disproportionate regulatory burden created for individual community banks makes it nearly impossible to compete with those who can position their products and services free of regulatory constraints. They can avoid the heavy cost of compliance while ignoring the impact these imbalances have on our industry. Flourish LEVELING THE PLAYING FIELD BY REBECA ROMERO RAINEY, PRESIDENT AND CEO, ICBA 4 In Touch

At the end of the day, it’s the customer who will pay the ultimate price if unbalanced regulations are allowed to continue. They will face challenges when they can’t get an emergency loan during a pandemic, like we saw with the Paycheck Protection Program. They will struggle when their small business loan needs don’t meet standardized checkbox requirements. They will lose out when they don’t qualify for a mortgage because those same checkbox requirements apply in consumer environments. Right now, community banks step up in those situations, providing support based on the deep relationships they have in their communities. However, as more and more regulations come down on us, this ability to respond may be hindered, leaving our customers and communities without fair options. That’s why community banker engagement and grassroots actions are so incredibly important. We have to speak up and demonstrate how the lack of consistent regulation creates issues. We have to deliver stories that demonstrate the egregious acts committed by non‑banks acting like banks. Congress needs to hear not just that community banks think it’s an unfair playing field, but to understand the harm this imbalance places on our communities. We encourage you to raise your voice and visit ICBA’s Action Center at icba.quorum.us for resources to help. In the meantime, we have a message for our imitators: If you want to be like us, you need to up your game to play by the same rules. Mortgage Investment Services Corporation 22316 Midland Drive • Shawnee, KS • 66226 • 913-390-1010 NMLS# 194708 • A Kansas licensed mortgage company #MC 0001182 Missouri Residential Mortgage Loan Broker License #10-1912 Oklahoma Mortgage Broker #MB001953 Colorado License #100044344 Nebraska Licensed Mortgage Company NMLS#194708 Arkansas License #124530 YEARS 24 Let’s Talk Fair Lending! Partnering with Mortgage Investment Services Corporation (MISC) means equal access to credit for housing to all within your community. Here’s why collaborating with us sets you apart: • Fair Lending Protocols, Regulatory Compliance • Tailored Solutions for Diverse Clientele • Government financing options: FHA, VA, & USDA-RD • Rebuilding your community with renovation lending • Expand your customer reach Join forces with MISC to provide every member of your community with the opportunity for homeownership. We get it right the first time! Andrew Holtgraves, Senior Vice President • Cell: 913-558-2555 Email: Andrew@MISCHomeLoans.com • NMLS: #276932 Where I’ll Be This Month I’ll be attending the Maine Bankers Convention and revving up to continue advocating for community banks this fall. 5 In Touch

EASING INTO THE FALL At Long Last, Some Rate Relief BY JIM REBER, PRESIDENT AND CEO, ICBA SECURITIES I don’t know about you, but I’ve always looked forward to the early days of autumn. I’m of a certain vintage who remembers when September and October ushered in a break from summer heat (which seems to be later in the calendar these days), and there was a certain excitement around the back‑to‑school activities. Football fans eagerly await gridiron season, which is now in full swing, and baseball playoffs make their return. And this for 2024: rate cuts by the Fed! It’s been a while, but the tightening cycle that started in early 2022 has finally run its course. It appears the price stability mandate has been met sufficiently for the focus to turn to maximum employment. The rate cut in September marks the first time in 4.5 years that the target rate of fed funds has dropped. This adds still more anticipation for an exciting fall. Is Your Bank Ready? But maybe we’re getting ahead of ourselves. Let’s first take stock of where most depositories stand as the fourth quarter of 2024 begins. Earnings will not be a record for the community banking industry this year, as margin pressure has taken the froth off bottom lines. Some positives are that credit quality remains outstanding despite some headline warnings. A lot of the consumer/auto/credit card delinquencies, which are on the rise, seem more to be problems for non‑banks. The fear of commercial real estate’s market breakdown hasn’t happened yet either. Another piece of the earnings puzzle is interest rate risk. Community bankers have told me on many occasions since 2022 that they’ve had to get current, and informed, and creative, about managing their liabilities, which they admit had been on autopilot for years. Suddenly at the same time, the Fed was hiking at its fastest pace in over 40 years, and depositors were demanding higher rates or, even worse, moving to non‑bank alternatives. Collectively, the industry shifted from being very asset‑sensitive to about neutral between 2020 and today. What’s Next? So earnings are, well, meh, but delinquencies are still very low, and we think rate risk is under control. What to do about all this? If the bond market and the Fed are to be believed, and I’m not saying they are, we will finally see the interest rate curve assume a positive slope. And that’s when the fun should really kick in. But (there’s always a “but” in these columns) be warned: Multiple rate cuts, and a normal yield curve, will probably have less upside this time around for community banks, at least initially. In a “bull steepener,” which is what we’re likely to experience, short rates fall, and longer rates fall less or longer rates rise. Either way, since most community banks’ portfolio’s effective durations are longer than normal, the price appreciation of your current bonds may not be what you’re hoping for. (To put some numbers on it, a typical bank’s duration is now about 4.3 years versus about 2.5 years back in 2020, according to Stifel.) 6 In Touch

Things Looking Up In spite of the buzzkill of the previous section, a community bank’s universe just performs better when short rates are below long ones. Regardless of which part of the balance sheet you’re responsible for, it’s easier to price in relative risk/reward. For well over a year, the highest‑yielding bank‑suitable bonds have been CMO (collateralized mortgage obligation) monthly floaters. That’s fun for a while, but that’s not how financial instruments are supposed to work longer‑term. Lower risk (i.e. lower duration) is supposed to produce lower yields. I also suspect that “betas” for community bank deposits will be friendly into 2025. Interest rate models weren’t built for 2022‑23, in which overnight rates spiked 525 basis points (5.25%) in just 16 months. The initial bulge in net interest margins (NIMs) started to shrink early in 2023 and are now about where they were before the tightening cycle began. From conversations I’ve had with community bankers, anecdotally and otherwise, cost of funds should begin to retreat. Deposit managers have demonstrated their ability to manage NIMs through plenty of rate cycles and rate shocks, and I see no reason to doubt their capabilities now. The big picture is the industry has held up remarkably well through a generation‑high interest rate environment that resulted from Fed tightening activity, and inflation, that most of today’s Jim Reber (jreber@icbasecurities.com) is president and CEO of ICBA Securities, ICBA’s institutional, fixed‑income broker‑dealer for community banks. Balance Sheet Webcast in November ICBA Securities and its exclusive broker, Stifel, will host their Quarterly Bank Strategy webinar on Nov. 7 at 1 p.m. EST. Several strategists and economists will make presentations, and up to 1.5 hours of CPE are offered. For more information and to register, contact Jim Reber or your Stifel rep. community bankers have never managed through. I’m looking forward to the return of a number of fourth‑quarter traditions in 2024: sweatshirts, football, leaves, crisp air and an interest rate environment that supports the community banking model. FMSI www.fmsiconsulting.com 913.955.3355 FMSI is a small business founded and located in Kansas, specializing in assisting community banks to succeed, a mission consistent with core CBA values. We have partnered with community banks for nearly 25-years providing core advisory services including asset/ liability, investment, and liquidity management. FMSI advisors actively assess market conditions and bank balance sheets of different size, mix, and capital levels. Market conditions are constantly changing presenting opportunities and challenges for CBA member banks. Interest rates are increasing for the first time in nearly a decade and now is a perfect time to partner with a trusted, industry leader. Establishing an FMSI relationship provides confidence your bank is optimizing the balance sheet, deploying necessary strategies, maximizing profitability, and managing balance sheet risks. FMSI is a Kansas CBA Endorsed Provider 7 In Touch

The Community Bankers of Kansas had a great time at our annual Convention & Trade Show held July 18‑20. It was an exciting three‑day event in Margaritaville Lake Resort Lake of the Ozarks in Osage Beach, Missouri. Thank you to our keynote speaker, Steve Gilliland, and all the attendees! 2024 Convention Trade Show 8 In Touch

9 In Touch

Thank You to Our 2024 Tailgate Sponsors! FHLBank Topeka First National Bank of Hutchinson QwickRate RESULTS Technology Security 1st Title SHAZAM Inc. Varney & Associates, CPAs LLC MEMBERSHIP APPRECIATION TAILGATE 10 In Touch

To learn more, scan this QR code to visit Wolters Kluwer BizFilings’ website. https://www.wolterskluwer.com/en/know/ boi-for-banks?utm_medium=email&utm_ source=sales_msg_notice&utm_campaign=bfi_sb_ boi-outreach-cs-bank-customers-sheetal-kamani_07-2024 Wanting to discuss the BOI Partnership Program? Scan this QR code to schedule a 20‑minute exploration call to discover how the program can benefit your small business banking customers. https://calendly.com/d/ckcm‑zmw‑2yh/standard‑boi‑partner?utm_ medium=email&utm_source=sales_msg_notice&utm_ campaign=bfi_sb_boi‑outreach‑cs‑bank‑customers‑sheetal‑kamani_​ 07‑2024&month=2024‑09 Over 32 million small businesses are estimated to need to comply with the Corporate Transparency Act and file an initial BOI report with FinCEN by Jan. 1, 2025, with newly formed businesses having just 90 days to do so. Failure to comply can result in fines exceeding $500 per day and potential jail time. To help your customers stay compliant and avoid penalties, CBAK has endorsed the Wolters Kluwer BizFilings BOI Reporting solution and is encouraging all member banks to join their BOI Partnership Program. This program offers an easy‑to‑join, low‑lift referral model that provides banks with the tools and information necessary to educate small business customers about the BOI requirement and recommend an efficient compliance solution. “We were surprised at the number of customers who found themselves unaware that this was a requirement and they’re happy we’ve given them a streamlined way to comply with the law with the Wolters Kluwer website. We had one instance with an insurance agent customer who had never heard of BOI and they went back to one of the major markets to learn they also had yet to hear about it. After that, we had insurance agents who weren’t even our customers calling about using the BOI filing service.” — Andrew E. Tinberg President & CEO CNB Bank & Trust, NA INTRODUCING CBAK’S NEW ENDORSED PARTNER, WOLTERS KLUWER BIZFILINGS CBAK Member Banks Can Help Small Business Customers Avoid BOI Non‑Compliance Penalties 12 In Touch

New Associate Members KlariVis® is the only cloud‑based, core‑agnostic enterprise dashboard and analytics solution built for bankers, by bankers. The KlariVis platform compiles and aggregates high‑value, actionable data into an intuitive, interactive dashboard that provides financial institutions of all sizes with timely insights that empower teams, drive profitability and improve productivity at every level of the organization. For more information, email Nomeka Sours at nomekasours@klarivis.com or call her at (540) 357‑0011. At The Bankers Bank, we can help streamline your operations, lower your costs, enhance your technological capabilities and automate operations where possible. Our consultative problem‑solving approach, electronic communications network, credit card services, participation loans and other offerings enable us to provide comprehensive products and services that rival those of much larger banks. Importantly, we will never compete with you for the customers you serve! For more information, email Laura Coale at lcoale@tbb.bank or call her at (405) 848‑8877. BUILD YOUR BRAND, CONTACT US TODAY! (855) 747-4003 | sales@thenewslinkgroup.com 13 In Touch

Financial institution supervisory agencies view a formal process for managing complaints from bank customers as an important element in an effective compliance management system (CMS). In fact, the latest issue of the “Consumer Compliance Outlook” publication from the Federal Reserve Board (FRB) includes three articles on this subject. The FRB is quoted in one of these articles in an unequivocal statement on this issue: “Consumer complaints are a critical component of the risk‑focused supervisory program. The Federal Reserve uses data on consumer complaint activity in its supervisory processes when monitoring financial institutions, scoping and conducting examinations, and analyzing applications.” The other federal agencies agree with this viewpoint. So, banks and thrifts have found that if they do not handle customer complaints in a formal, consistent manner, their CMS will be viewed with a more critical eye. Benefits of Managing Complaints One positive aspect of proactively managing the customer complaint process is there is no real downside. The only “downside” is that such a process shines a light on the extent of complaints and their underlying causes. But this disadvantage is actually an advantage. What you don’t know really can hurt you. The positive results from complaint management can include: • Uncovering and dealing with shortcomings in product features, bank processes, customer service and other issues at an early stage before they grow to a point that they present real threats to the institution. • Improving customer satisfaction with the bank and enhancing the bank’s efforts to serve the banking needs of its community. • Resolving fair treatment issues at an early stage. • Realigning bank products, processes and services with regulatory requirements and expectations. • Heading off potential UDAAP (unfair, deceptive or abusive acts and practices) issues. • Reducing the institution’s reputation risk. Managing Complaints The bank already has formal processes, with assigned responsibilities, for handling errors/disputes asserted by customers related to electronic banking (Regulation E, EFTA), open‑end credit (Regulation Z, TILA), and mortgage loan servicing (HUD Regulation X, RESPA). Appropriate treatment of complaints in these areas is mandated by the respective regulations. However, a formal process to address customer complaints in other areas — both those received directly from customers and those referred by the regulators — is considered an industry best practice, as well as a necessary component of an effective CMS by regulators. The structure of this program will vary depending on the culture of the bank and other internal factors. But, there are some common elements that form the basis of any sound customer complaint program, including to: • Define what is considered as a “complaint.” This is considered crucial to success in this area, so defining “complaint” broadly is usually seen as a sound practice. • Make sure everyone knows how important it is to respond promptly and accurately to any customer complaints. This is a basis for giving good customer service. • Appoint a central point (an individual or an office) to be in charge of your complaint response program, especially those referred by the regulators — and make sure that all bank staff is aware of how to handle complaints, including where to refer them. Branch managers can be charged with handling customer service issues occurring at their branches that do not involve regulatory issues (fair lending, EFTA, etc.). However, they should report on these complaints and resolutions to the central complaint point for tracking of any trends that may arise. MANAGING CUSTOMER COMPLAINTS IS IMPORTANT TO AN EFFECTIVE CMS BY WILLIAM J. SHOWALTER, CRCM, SENIOR CONSULTANT, YOUNG & ASSOCIATES INC. 15 In Touch

• Establish uniform standards and timeframes for investigating customer complaints. The time limits you set should be reasonable and probably not significantly longer than those set by regulations for some error resolutions (EFTA, TILA). • Ensure that the process includes determining the root cause of complaints being investigated. • Document your investigation (e.g., copies of relevant documents and reports) of each customer complaint and the bank’s response. • Ensure that regulators are informed promptly of the results of investigations of any complaints referred by regulatory agencies. • Maintain a database of your customer complaints, either manually or using some spreadsheet or database software. This step allows you to mine the data related to this process for information about problems with your products, customer service, potential fair treatment/lending issues and so forth. Results The database discussed in the final bullet above can provide a wealth of information about how customers view your bank, your product mix, your service levels and many other facets of your business. It also provides you with an opportunity to discern trends in their infancy, allowing you to deal with negative issues early or enhance the benefits of positive developments. A proactive approach to customer complaint management derives many benefits for the bank, not the least of which is reducing conflicts with customers, enhancing the bank’s public image, improving bank relations with regulators and creating a competitive advantage for the bank. The Newest Supervisor For the past decade or so, there has been a more active and visible regulatory presence in this area — the Consumer Financial Protection Bureau (CFPB). The CFPB established a complaint database to which consumers can submit complaints about financial service providers, have their complaints forwarded to the providers for response and give the public a window on this process and its outcomes. The CFPB also periodically analyzes the results of this process, usually for one or another particular financial service area — student loans one time, mortgage servicing another and yet another financial service another time. The other agencies, as noted earlier, analyze data related to consumer complaints that are handled through each of them. The agencies often view data about consumer complaints to be an indicator of a need for future regulations. This view is reinforced by provisions in the Dodd‑Frank Act of 2010. The purpose of the CFPB database is to provide consumers with one central point through which they can submit complaints about financial service providers without having to search through the maze of regulatory agencies first and follow the results. Another purpose is to provide a gauge for how well financial service providers are serving their particular customer bases. While the CFPB database can be a useful tool, financial institutions should have a goal of trying to deal with their own customers’ complaints and concerns themselves, before customers become so frustrated that they feel the need to turn to supervisory agencies. One positive aspect of proactively managing the customer complaint process is there is no real downside. William J. Showalter, CRCM, is a senior consultant with Young & Associates Inc. (www.younginc.com), with over 35 years of experience in compliance consulting, advising and assisting financial institutions on consumer compliance and compliance management issues. He authors and edits compliance publications and articles for Young & Associates. Bill can be reached at wshowalter@younginc.com. 16 In Touch

17 In Touch

HOW CFPB’S RULE 1033 COULD AFFECT DATA RIGHTS AND OPEN BANKING BY BRADLEY WALLACE, DIRECTOR OF COMPLIANCE, CSI The Consumer Financial Protection Bureau (CFPB) estimates that 100 million consumers have authorized third parties to access their data. That data drives endless business decisions and capabilities, but financial institutions and technology developers must also be aware of regulations regarding consumers and their rights over their data. One such proposed regulation, Rule 1033, would require financial institutions and other data providers to help consumers access and share their data securely using application programming interfaces (APIs). What is CFPB’s Rule 1033? Section 1033 of the Consumer Financial Protection Act of 2010 was sent for comment in October 2023 and is expected to be finalized in the fall of 2024. This proposed rule would require depository and non‑depository entities to: • Make available to consumers and authorized third parties certain data relating to consumers’ transactions and accounts. • Establish obligations for third parties accessing a consumer’s data, including important privacy protections for that data. • Provide basic standards for data access. • Promote fair, open and inclusive industry standards. Compliance dates for this rule will be staggered based on institutional asset size, ranging from six months to four years from the date of the final rule publication. Rule 1033’s Potential Impact on Financial Data Rights The proposed rule is designed to address challenges with open banking by defining the: • Scope of data that third parties can access on a consumer’s behalf. • Terms on which data is made available. • Mechanics of accessing the data, proposed to be consumer permission based. It seeks to impose a framework in which data transfers occur via APIs instead of existing methods, such as screen scraping or credential sharing. Data providers would be required to maintain a digital interface for consumers and developers, both of which must meet certain 18 In Touch

performance specifications to receive and respond to data access requests. This approach aims to ensure third parties are acting on behalf of consumers when accessing their data and respect their privacy interests. Rule 1033 also promotes security and reliability, as it would apply a set of consistent standards across the market for sharing data. Third-party access proposals would require these companies to provide an authorization disclosure to inform the consumer of key terms of access and obtain the consumers’ informed consent. According to the CFPB, the proposed rule would “forbid companies that receive data from misusing or wrongfully monetizing the sensitive personal financial data.” What Data Does Rule 1033 Cover? The rule includes a definition of the types of data that providers, such as card issuers and financial institutions, would need to make available upon request. According to the proposed rule, covered data includes: • Transaction information, including historical data (at least 24 months). • Account balances. • Terms and conditions. • Upcoming bill information. • Basic account verification information, such as name, address, email, etc. It excludes confidential commercial information, algorithms, information used to prevent fraud or money laundering or other crimes and information that is required confidential under other laws, as well as other information that the provider cannot retrieve in the ordinary course of business. At the request of a consumer or authorized third party, providers must make covered data available in a machine‑readable format that can be retained by the consumer or authorized by a third party and transferred for processing into separate information systems — all without imposing fees or charges. How Rule 1033 is Accelerating Open Banking So, what does Rule 1033 have to do with open banking? Open banking uses APIs to enable developers to access an institution’s data, which includes customer data. The technological approach enables banks to offer new products or services without building them internally or relying on a single provider. Rule 1033 aims to place data rights in the hands of consumers, expanding the definition of open banking and giving them more control. While that control could make customers less “sticky,” it could be welcome news for institutions that prioritize a relationship‑based approach to customer service, like community banks. As consumers exercise more control over their data, they’re more able to switch to banks that provide personalized service and their desired products instead of remaining with those that hoard all their financial data but provide poor service and lacking products. Data Rights Considerations in Open Banking As with any technology partnership, concerns may arise regarding data sharing and third‑party data breaches. However, there are ways to mitigate risk for your institution. And the opportunities that open banking provides — from improving customer experience to expanding revenue lines — can better position your institution against the competition. As a data steward, your bank should consider several factors to protect your customers and remain compliant. Safeguard your digital services, core platform and any other sectors placed into your open banking ecosystem. Your bank should also ensure you have secure processes in place, including handling file transfers without opening yourself up to any vulnerabilities. To maximize your security and incident preparedness, develop and maintain policies and procedures for preventing and managing a security breach. Additionally, make sure you understand data retention and data deletion obligations. How to Qualify an Open Banking Vendor Partnering with third‑party vendors to enhance your offerings is a key part of open banking, but you must stay vigilant and keep bad actors out of your open banking network. Here are a few considerations your institution should keep in mind when qualifying a vendor: • Qualified Sources: Ensure you’re looking for vendors and applications from reputable industry sources. • Standard Due Diligence: Audit procedures should follow your institution’s established policies. • Adequate Testing Phase: Deploy a testing phase to ensure how your institution’s data is accessed and used through the vendor’s apps. • Security, Audits and Reporting: Verify the vendor uses secure methods to access and store your institution’s data, especially consumer‑related data. Understand what they offer in terms of audit support and reporting capabilities. Sharing Data in the Digital Era When it comes to Rule 1033, your bank has a choice to make. Will you simply implement measures to ensure compliance once required and deliver data upon request? Or will you embrace open banking to better serve current and prospective customers? Developing the right open banking strategy for your institution can provide long‑term benefits for your bank. 19 In Touch

WHAT SHOULD BE INCLUDED IN A TPS’S OFAC POLICY? BY MATTHEW WADE, EPCOR Anti‑money laundering (AML), and specifically OFAC, concerns are increasingly becoming a greater issue for third parties who engage with financial institutions in the payments space. Banking regulators are closely scrutinizing the financial institutions to determine that their relationships with third parties are not exposing the financial institutions to AML and OFAC issues. What does this mean for third parties, including ACH Third‑Party Senders (TPS)? Should a TPS have an AML/OFAC Policy? If so, how should that policy be constructed? Let’s talk about it. OFAC is the Office of Foreign Assets Control and is a division of the U.S. Department of the Treasury. OFAC administers and enforces economic and trade sanctions against targeted foreign countries and regimes, terrorists and other individuals based on U.S. foreign policy and national security concerns. Among other things, OFAC imposes controls on financial transactions and assets of such designated parties under U.S. jurisdiction. While many OFAC policies and efforts focus on the financial banking industry, its powers are not limited to financial institutions. In fact, U.S. citizens, companies located in the U.S., overseas branches of U.S. companies and, in some cases, overseas subsidiaries of U.S. companies all fall under OFAC jurisdiction. While there is no specific requirement for a TPS to have an AML/OFAC Policy, it is a recommendation often made by EPCOR. A large percentage of the third parties with whom we engage have created such a policy, and doing so exhibits the TPS’s commitment to compliance with U.S. law for both domestic and international payment transactions. If you review any active ACH Origination Agreements, you should find a stipulation where a TPS has agreed to comply with all U.S. laws, of which OFAC would be a part. A thorough policy is an ideal place for a TPS to start in order to demonstrate their organization’s awareness of and commitment to the regulation. It is recommended that the TPS’s AML/OFAC Policy address five essential components: 1. Management Strategy: The organization’s overall direction for AML/OFAC compliance, including allocation of resources, delegation of an AML/OFAC Officer, assignment of duties, establishment of measurement parameters and required reporting. 2. Risk Assessment: Identifying AML/OFAC risks within the TPS activities (not just ACH) and operations. This would entail a thorough understanding of the organization’s clients, products and services, types of payments being facilitated and the geographic parameters of funds movement. The risk assessment should also seek to identify weaknesses and exposure to specific AML/OFAC risks. 3. Internal Control: Establishing a framework for the development and implementation of specific internal controls based on the risk assessments already performed. 4. Testing/Auditing: Internal controls, policies and procedures must be reviewed and tested periodically, and reporting of that testing should be described in the AML/OFAC policy. 5. Training: The policy should provide guidelines for a sufficient AML/OFAC training program for the organization and key employees. In addition to the five components just listed, reporting and record‑keeping of AML/OFAC concerns is another important topic to address in the policy. TPSs need to be aware of their responsibilities and their obligations related to OFAC compliance, especially as it concerns possible restrictions of client activities, reporting to regulatory agencies and potentially freezing funds of which the TPS may have possession. TPSs must ensure they do not process or facilitate transactions for parties targeted by OFAC and that proper action is taken when such transactions are presented. A policy that drives compliance with these responsibilities is paramount. Finally, the policy should establish a process to periodically scan the TPS clients against the Specially Designated Nationals (SDN) list. The SDN list is a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries. The list is updated frequently, and therefore, the client base should be compared to it at appropriate intervals. While there is no formal requirement for a TPS to have an AML/OFAC policy, hopefully the value in creating one has become clear. If you’re a TPS, your ODFI should be able to provide more guidance on AML/OFAC considerations and how your policy should be tailored to your specific ACH activities. However, if you have further questions about AML/OFAC and how these regulations can affect your overall payment processing activities, don’t hesitate to reach out to EPCOR via phone at (800) 500‑0100, email at memserve@epcor.org or website at epcor.org. 20 In Touch

See how you can help your small business clients Visit icbapayments.com today Help small businesses with some help from us. Give your small business clients credit and debit options ICBA Payments uses the power of thousands of community banks to allow you to offer credit options that have great rates, service, and benefits. ICBA Payments can help you: Deliver small business debit and credit solutions Access tools to help efficiently manage your small business programs Manage your portfolio with customized guidance

Congratulations to the banks celebrating September and October anniversaries as chartered institutions! ANNIVERSARIES September 137 years, est. 1887 State Exchange Bank — Mankato 126 years, est. 1898 Peoples Bank & Trust Co. — McPherson 124 years, est. 1900 First State Bank — Ransom 95 years, est. 1929 Farmers State Bank — Fairview October 128 years, est. 1896 Elk State Bank — Clyde 121 years, est. 1903 Haviland State Bank — Haviland 118 years, est. 1906 Stockgrowers State Bank — Maple Hill 118 years, est. 1906 Grant County Bank — Ulysses 118 years, est. 1906 Bank of Commerce & Trust Co. — Wellington 114 years, est. 1910 Union State Bank — Olsburg 36 years, est. 1988 Bankers’ Bank of Kansas — Wichita 32 years, est. 1992 The Trust Company — Manhattan 22 In Touch

Products and Services Reference List 2024‑2025 CBA OFFICERS AND DIRECTORS Joe Rottinghaus Chairman Conway Bank Tanner Johnson Chairman‑Elect Swedish‑American Bank Tom Pruitt Secretary/Treasurer Peoples Bank & Trust Company Irv Mitchell Immediate Past Chairman Wilson State Bank DIRECTORS Jeff Caudle Union State Bank Kent Culbertson First National Bank and Trust Matt Engel Farmers State Bank Cheri Fahrbach First National Bank of Hutchinson Chris Floyd Dream First Bank Brandon Lee Union State Bank Margaret Nightengale Grant County Bank Steven Suellentrop Legacy Bank Michele C. (Mickey) Lundy Past Chairman Tampa State Bank STATE ICBA DIRECTOR Blake Heid First Option Bank CBA STAFF Shawn Mitchell President and CEO shawn@cbak.com Nikki Dohrman Senior Vice President/ Executive Director nikki@cbak.com Yvonna Hansen Vice President of Member Services yvonna@cbak.com Stuart Little Little Government Relations LLC Officers and Directors The following CBA Associate Members are ready to serve you when you need them. Please keep this list handy, and the next time you’re looking for a specific service, you’ll know where to look first! Remember, this is just a sampling of what each company provides. The “*” represents an agreement for a specific endorsed product with that company. Not all products that these companies offer are endorsed by CBA. To see a detailed list and explanation of endorsements, visit CBA at www.cbak.com. Keep in mind that the services listed by each company on this page may only be a sampling of the many services they offer. By their CBA Associate Membership, these companies have shown their commitment to serving community banks. Please look to these companies first, whenever possible, to meet your banking needs. ABSTRACTING Security 1st Title Wichita, KS . . . . . . . . (316) 267‑8371 ACCOUNTING/TAX RETURNS Allen, Gibbs & Houlik LC Wichita, KS . . . . . . . . (316) 267‑7231 Varney & Associates, CPAs LLC Manhattan, KS . . . . . . . (785) 537‑2202 ACH *SHAZAM Johnston, IA . . . . . . . . (515) 288‑2828 ADVERTISING SPECIALTIES *SJC Marketing Susan: St. Joseph, MO . . . . (816) 396‑8575 *Works24 Brian: Edmond, OK . . . . . . . . . .(800) 460‑4653 ALARMS & SECURITY PRODUCTS Federal Protection Springfield, MO . . . . . . (800) 299‑5400 Oppliger Banking Systems Inc. Lenexa, KS . . . . . . . . .(800) 487‑7875 ARTIFICIAL INTELLIGENCE *Agent IQ Drew: Austin, TX . . . . . . (830) 708‑9370 ASSET LIABILITY MANAGEMENT *Financial Management Services Inc. (FMSI) Chuck: Overland Park, KS (913) 955‑3355 See ad pg. 7 *QwickRate Dan: Marietta, GA . . . . . (800) 285‑8626 ATM EQUIPMENT (NEW/USED) Federal Protection Springfield, MO. . . . . . . (800) 299‑5400 Oppliger Banking Systems Inc. Lenexa, KS . . . . . . . . (800) 487‑7875 AUCTION Purple Wave Manhattan, KS . . . . . . . (785) 537‑7653 BACK ROOM SERVICE Modern Banking Systems Ralston, NE . . . . . . . . (800) 592‑7500 BALANCE SHEET CONSULTING *Financial Management Services Inc. (FMSI) Chuck: Overland Park, KS (913) 955‑3355 See ad pg. 7 BANK OPERATIONS The Baker Group Oklahoma City, OK . . . . . (800) 937‑2257 *QwickRate Dan: Marietta, GA . . . . . (800) 285‑8626 BANK/PEER PERFORMANCE *QwickRate Dan: Marietta, GA . . . . . (800) 285‑8626 BANKRUPTCY Spencer Fane LLP Overland Park, KS . . . . . (800) 526‑6529 BANK STOCK LOANS & LOAN OVERLINES Commerce Bank Kansas City, MO . . . . . . (800) 821‑2182 *S&P Global Stacy: Charlottesville, VA . . . (434) 951‑4419 BOND ACCOUNTING First Bankers Banc Securities Overland Park, KS . . . . . (913) 469‑5400 *ICBA Securities Corporation Jim: Memphis, TN . . . . . . (800) 422‑6442 COMPLIANCE ASSISTANCE/REVIEWS *Advanced Business Solutions (ABS) Sandy: Olathe, KS . . . . . . . . . . . (913) 340‑7041 Allen, Gibbs & Houlik LC Wichita, KS . . . . . . . . (316) 267‑7231 *BHG Bank Group Tom: Syracuse, NY . . . . . .(315) 372‑4510 *MPA Systems David: Fort Worth, TX . . . . (888) 233‑1584 Purple Wave Manhattan, KS . . . . . . . (785) 313‑2094 Varney & Associates, CPAs LLC Manhattan, KS . . . . . . . (785) 537‑2202 Young & Associates Inc. Kent, OH . . . . . . . . . (800) 525‑9775 23 In Touch

CONSULTING *Bank Compensation Consulting (BCC) Rich: Plano, TX | (303) 482‑1844 See ad pg. 17 *CRA Partners | SHCP Foundation Kristine . . . . . . . . . . (914) 656‑8643 Young & Associates Inc. Kent, OH . . . . . . . . . (800) 525‑9775 CORRESPONDENT SERVICES Commerce Bank Kansas City, MO . . . . . . (800) 821‑2182 First National Bank of Hutchinson Hutchinson, KS . . . . . . . (800) 293‑0683 The Bankers Bank Oklahoma City, OK . . . . . (800) 522-9220 CORE SERVICES Data Center Inc. (DCI) Hutchinson, KS | (620) 694‑6800 See ad pg. 27 Modern Banking Systems Ralston, NE . . . . . . . . (800) 592‑7500 *SHAZAM Bill M. Johnston: IA . . . . . (515) 306‑8012 CRA/COMPLIANCE *CRA Partners | SHCP Foundation Kristine . . . . . . . . . . (914) 656‑8643 CREDIT AND PORTFOLIO RISK MANAGEMENT Young & Associates Inc. Kent, OH . . . . . . . . . (800) 525‑9775 CREDIT CARD PROGRAM *ICBA Payments Heather: Washington, D.C. . . (800) 242‑4770 CREDIT SUPPORT *Advanced Business Solutions (ABS) Sandy: Olathe, KS . . . . . . . . . . . (913) 340‑7041 DATA ANALYTICS KlariVis Roanoke, VA . . . . . . . (540) 357‑0011 *QwickRate Dan: Marietta, GA . . . . . (800) 285‑8626 DATA PROCESSING Data Center Inc. (DCI) Hutchinson, KS | (620) 694‑6800 See ad pg. 27 Modern Banking Systems Ralston, NE . . . . . . . . (800) 592‑7500 DEBIT/ATM CARD SERVICES *ICBA Payments Heather: Washington, D.C. . . (800) 242‑4770 *SHAZAM Matt M. Johnston: IA . . . . (515) 480‑5767 DIGITAL LENDING *BHG Bank Group Tom: Syracuse, NY . . . . . .(315) 372‑4510 DIGITAL RELATIONSHIP BANKING *Agent IQ Drew: Austin, TX . . . . . . (830) 708‑9370 DIRECTORS AND OFFICERS INS. *Travelers Danielle: St. Louis, MO . . . (800) 255‑5072 *UNICO Group Inc. Diana: Lenexa, KS | (800) 755‑0048 See ad pg. 28 DIRECTORS EXAMS Allen, Gibbs & Houlik LC Wichita, KS . . . . . . . . (316) 267‑7231 Varney & Associates, CPAs LLC Manhattan, KS . . . . . . . (785) 537‑2202 DISASTER RECOVERY FACILITY PROGRAM *MPA Systems David: Fort Worth, TX . . . . (888) 233‑1584 DOCUMENT MANAGEMENT *Trust Exchange Leo: Austin, TX . . . . . . . (888) 777‑8434 EDUCATION *CRA Partners | SHCP Foundation Kristine . . . . . . . . . . (914) 656‑8643 EMERGENCY FACILITIES/MODULAR BANK BUILDINGS FOR LEASE *MPA Systems David: Fort Worth, TX . . . . (888) 233‑1584 EMPLOYEE AND EXEC. BENEFITS *Bank Compensation Consulting (BCC) Rich: Plano, TX | (303) 482‑1844 See ad pg. 17 Woner, Reeder & Girard P.A. Topeka, KS . . . . . . . . (785) 235‑5330 ESCROWS Security 1st Title Wichita, KS . . . . . . . . (316) 267‑8371 FINANCIAL INST. BOND *Travelers Danielle: St. Louis, MO . . . (800) 255‑5072 *UNICO Group Inc. Diana: Lenexa, KS | (800) 755‑0048 See ad pg. 28 HUMAN RESOURCES *UNICO Group Inc. Diana: Lenexa, KS | (800) 755‑0048 See ad pg. 28 INFORMATION TECHNOLOGY Integris Olathe, KS . . . . . . . . (325) 947‑5550 Kansas Bankers Technologies Salina, KS . . . . . . . . . (888) 752‑8435 KlariVis Roanoke, VA . . . . . . . (540) 357-0011 RESULTS Technology Overland Park, KS . . . . . (877) 435‑8877 Varney & Associates, CPAs LLC Manhattan, KS . . . . . . . (785) 537‑2202 INSURANCE — BANK *Bank Compensation Consulting (BCC) Rich: Plano, TX | (303) 482‑1844 See ad pg. 17 *Travelers Danielle: St. Louis, MO . . . (800) 255‑5072 *UNICO Group Inc. Diana: Lenexa, KS | (800) 755‑0048 See ad pg. 28 INTEREST RATE RISK SERVICE *Financial Management Services Inc. (FMSI) Chuck: Overland Park, KS (913) 955‑3355 See ad pg. 7 *ICBA Securities Corporation Jim: Memphis, TN . . . . . . (800) 422‑6442 INTERNAL AUDIT *Advanced Business Solutions (ABS) Sandy: Olathe, KS . . . . . . . . . . . (913) 340‑7041 INTERNET BANKING Data Center Inc. (DCI) Hutchinson, KS | (620) 694‑6800 See ad pg. 27 *ICBA Payments Heather: Washington, D.C. . . (800) 242‑4770 KlariVis Roanoke, VA . . . . . . . (540) 357-0011

INTERNET WORLD WIDE W.E.B. Oppliger Banking Systems Inc. Lenexa, KS . . . . . . . . (800) 487‑7875 INVESTMENTS Central States Capital Markets Kansas City, MO . . . . . . (800) 851‑6459 Commerce Bank Kansas City, MO . . . . . . (800) 821‑2182 *Financial Management Services Inc. (FMSI) Chuck: Overland Park, KS (913) 955‑3355 See ad pg. 7 First Bankers Banc Securities Overland Park, KS . . . . . (913) 469‑5400 *ICBA Securities Corporation Jim: Memphis, TN . . . . . . (800) 422‑6442 IT SECURITY Integris Olathe, KS . . . . . . . . .(325) 947‑5550 Kansas Bankers Technologies Salina, KS . . . . . . . . . (888) 752‑8435 *RESULTS Technology Darla: Overland Park, KS . . . (877) 435‑8877 LEGAL SERVICES Spencer Fane LLP Overland Park, KS . . . . . (800) 526‑6529 Woner, Reeder & Girard P.A. Topeka, KS . . . . . . . . (785) 235‑5333 LENDING *BHG Bank Group Tom: Syracuse, NY . . . . . .(315) 372‑4510 LOAN COLLECTIONS AND WORKOUTS Spencer Fane LLP Overland Park, KS . . . . . (800) 526‑6529 Woner, Reeder & Girard P.A. Topeka, KS . . . . . . . . (785) 235‑5330 LONG RANGE PLANNING The Capital Corporation LLC Overland Park, KS . . . . . (913) 498‑8188 Varney & Associates, CPAs LLC Manhattan, KS . . . . . . . (785) 537‑2202 MARKETING Harland Clarke Newton, KS . . . . . . . . (800) 322‑0818 *SHAZAM Johnston, IA . . . . . . . . (515) 288‑2828 *SJC Marketing Susan: St. Joseph, MO . . . . (816) 396‑8575 *Works24 Brian: Edmond, OK . . . . . . . . . .(800) 460‑4653 MERCHANT PROCESSING *SHAZAM Johnston, IA . . . . . . . . (515) 288‑2828 MERGERS/ACQUISITIONS The Capital Corporation LLC Overland Park, KS . . . . . (913) 498‑8188 Olsen Palmer Kansas City, MO . . . . . . (816) 379‑4029 Spencer Fane LLP Overland Park, KS . . . . . (800) 526‑6529 MOBIL CUSTOMER ENGAGEMENT *Agent IQ Drew: Austin, TX . . . . . . (830) 708‑9370 NETWORK SECURITY Kansas Bankers Technologies Salina, KS . . . . . . . . . (888) 752‑8435 PAYMENTS *ICBA Payments Heather: Washington, D.C. . . (800) 242‑4770 PORTFOLIO MANAGEMENT Central States Capital Markets Kansas City, MO . . . . . . (800) 851‑6459 *Financial Management Services Inc. (FMSI) Chuck: Overland Park, KS (913) 955‑3355 See ad pg. 7 PROMOTIONAL PRODUCTS Harland Clarke Newton, KS . . . . . . . . (800) 322‑0818 RETIREMENT PLANNING Central States Capital Markets Kansas City, MO . . . . . . (800) 851‑6459 First Bankers Banc Securities Overland Park, KS . . . . . (913) 469‑5400 SECONDARY MORTGAGE MARKET LENDING FHLBank Topeka Topeka, KS . . . . . . . . (800) 933‑2988 Mortgage Investment Services Shawnee, KS | (913) 390‑1010 See ad pg. 5 SECURITY MONITORING Federal Protection Springfield, MO . . . . . . (800) 299‑5400 SUPPLEMENTAL HEALTH INSURANCE *UNICO Group Inc. Diana: Lenexa, KS | (800) 755‑0048 See ad pg. 28 TECHNOLOGY SERVICES Integris Olathe, KS . . . . . . . . (325) 947‑5530 Kansas Bankers Technologies Salina, KS . . . . . . . . . (888) 752‑8435 KlariVis Roanoke, VA . . . . . . . (540) 357-0011 *RESULTS Technology Darla: Overland Park, KS . . . (877) 435‑8877 *QwickRate Dan: Marietta, GA . . . . . (800) 285‑8626 *S&P Global Stacy: Charlottesville, VA . . . (434) 951‑4419 TELECOMMUNICATIONS CONSULTING Verge Network Solutions Inc. Oklahoma City, OK . . . . . (405) 782‑8400 TELECOMMUNICATIONS SERVICES Verge Network Solutions Inc. Oklahoma City, OK . . . . . (405) 782‑8400 TELECOMMUNICATIONS SYSTEMS Verge Network Solutions Inc. Oklahoma City, OK . . . . . (405) 782‑8400 THIRD PARTY COMPLIANCE MANAGEMENT *Trust Exchange Leo: Austin, TX . . . . . . . (888) 777‑8434 THIRD PARTY RISK MANAGEMENT & CONSULTING *Trust Exchange Leo: Austin, TX . . . . . . . (888) 777‑8434 TITLE INSURANCE Security 1st Title Wichita, KS . . . . . . . . (316) 267‑8371 WEBSITE DEVELOPMENT *S&P Global Stacy: Charlottesville, VA . . . (434) 951‑4419 WHOLESALE LENDING FHLBank Topeka Topeka, KS . . . . . . . . (800) 933‑2988 Mortgage Investment Services Shawnee, KS | (913) 390‑1010 See ad pg. 5 Last Update: Sept. 10, 2024 Visit CBA online at www.cbak.com. 25 In Touch

www.fin-ed.info/cbak Empowering Financial Marketers: Harness the Power of AI in Your Marketing Strategy Three Key Risk Assessments in Your ERM Program: ERM, IT & Internal Controls Annual MLO Training & SAFE Act Compliance Loan Documentation for All Legal Entities Deposit Operations Year-End Wrap-Up & Update Auditing Call Reports: Compliance, Regulator Expectations & Best Practices When a Depositor Dies: Actions to Take, Mistakes to Avoid Executive Total Compensation: Strategies to Motivate & Incent the Right Behaviors Traditional & Roth IRAs Part B: Distributions, Taxation, Withholding & Penalties Auditing Consumer Real Estate Files Chapter 7 & 13 Consumer Bankruptcies: Special Rules, Cramdowns & Risks BSA Officer & Staff Year-End Wrap-Up Taking the Mystery Out of Loan Stress Testing Harnessing ITMs & VTMs: Risks, Implementation Considerations & Compliance Robbery: Plan, Prevent, Prevail The Board Secretary's Role: Organizing, Planning, Tracking & Maintaining Accurate Minutes Electronic Payment Fraud: When Is Your Institution Liable? ACH Disputes Part 1: Reg E vs. ACH Rules Before 60 Days 1 -OCT 1 -OCT 2-OCT 3-OCT 7-OCT 8-OCT 9-OCT 10-OCT 15-OCT 16-OCT 17-OCT 21 -OCT 22-OCT 23-OCT 24-OCT 29-OCT 30-OCT 31 -OCT x In partnership to grow Kansas’s community banks. BANK TRAINING WEBINARS Live & On-Demand Managing Loan Concentrations: CRE & More Lending Exam Targets Locked: Preparing Your TRID, Fair Lending & CRA Programs for Increased Scrutiny Form 1099 Reporting: Third-Party Vendors, Foreclosures, Debt Forgiveness & More Hottest IRA Issues: Reporting, Compliance & Required Minimum Distributions Legal Issues of Checks Consumer RE Appraisals: Ordering, Controls, Thresholds, USPAP Requirements & Compliance 10 Reg CC Myths Return to Sender: Selecting Relevant ACH Return Reason Codes When a Borrower Dies: Actions to Take, Mistakes to Avoid Corporate Tax Returns: Analysis, Limitations & Red Flags What Are the UDAAP Risks in 2025? ACH Disputes Part 2: Reg E vs. ACH Rules After 60 Days 4-NOV 6-NOV 7-NOV 12-NOV 13-NOV 14-NOV 18-NOV 19-NOV 20-NOV 21 -NOV 25-NOV 26-NOV

RkJQdWJsaXNoZXIy MTg3NDExNQ==