Electronic Funds Transfer (EFT) offers an efficient way to move funds but possesses inherent risks. The policy is intended to establish effective controls and mitigate risks surrounding EFT processing requirements.

1. Risk Management of Electronic Funds Transfers:
   As EFTs present a significant fraud risk, the following security practices must be adhered to; exceptions to the security practices in this section may be granted by Treasury Management where deemed appropriate:
   1. The Security Administrator must ensure that:
      • Each employee who enters EFT transactions into a banking system be assigned a unique log-in and password.
      • User IDs are deleted as part of the exit procedure when an employee changes job duties or position or separates from the University.
      • User IDs and passwords for employees on extended leave of 90 days or more are disabled.
   2. The User Department Head must:
      • Review the list of department employees with EFT functions semi-annually to determine if each employee’s access is still necessary.
      • Revoke access for a department employee with EFT functions when it is no longer needed.
      • Review audit logs periodically to confirm that employees have access only to the functions needed to perform their jobs.
   3. Those employees authorized to enter EFTs must:
      • Not share or disclose passwords and account or log-in credentials with anyone.
      • Not have the same User IDs or Passwords used for banking systems as those used to access public sites (such as Gmail, Google, Facebook, Yahoo).
      • Transact EFTs via a system of dual control (two or more employees to transact).
      • Use a secure line when internet access from the EFT PC occurs outside of the University’s secure network.
      • Not use public or unsecured networks.
      • Use bank accounts that are subscribed to the following bank-offered fraud protection services:
        • Automated Clearing House (ACH) debit blocks and filters.
        • Check-clearing blocks for non-checking accounts.
        • Payee Name Positive Pay or Reverse Positive Pay.
        • If available, the use of a maximum dollar amount allowable per transfer (or user defined time interval) to limit exposure if system is compromised.
      • Use multi-factor authentication tools offered by banks (such as tokens, digital certificates, smart cards, etc.).
      • Not share University banking information until discussed with and approved by either Treasury Management or the department handling banking and EFT responsibilities.

2. Compliance with Policy:
   Failure to comply with the requirements of this policy may result in disciplinary action up to and including termination or expulsion in accordance with relevant University policies.

   Direct questions about this policy to Treasury Management.