APRP Risk Assessment & Mitigation 3 — Questions and Answers
Question 1: Under Regulation E, what is the maximum liability for a consumer who reports an unauthorized electronic fund transfer within 2 business days of learning of the loss?
- $0
- $50 (Correct answer)
- $500
- Unlimited
Correct answer: $50
Regulation E caps consumer liability at $50 if the unauthorized EFT is reported within 2 business days of learning of the loss.
Question 2: A key risk indicator (KRI) differs from a key performance indicator (KPI) in that a KRI:
- Measures how efficiently a process operates
- Signals an increase in the likelihood of future risk events (Correct answer)
- Counts the total number of transactions processed
- Reports on revenues generated by a business unit
Correct answer: Signals an increase in the likelihood of future risk events
KRIs are forward-looking metrics that warn of rising risk levels, while KPIs measure operational or financial performance.
Question 3: Which risk mitigation strategy is most appropriate for a risk with very low probability but potentially catastrophic financial impact?
- Accept the risk and budget for expected losses
- Avoid the risk by exiting the activity entirely
- Transfer the risk through insurance or contractual means (Correct answer)
- Reduce the risk through enhanced operational controls
Correct answer: Transfer the risk through insurance or contractual means
Insurance or contractual transfer is ideal for low-probability, high-severity risks because the premium cost is manageable and the potential loss is too severe to self-insure.
Question 4: In payments risk management, 'velocity checking' is used to mitigate which type of risk?
- Settlement risk
- Fraud risk from rapid successive transactions (Correct answer)
- Liquidity risk from large-value transfers
- Compliance risk from AML thresholds
Correct answer: Fraud risk from rapid successive transactions
Velocity checks flag or block accounts or cards that generate an abnormally high number of transactions within a short period, a common fraud indicator.
Question 5: A risk control self-assessment (RCSA) is most valuable because it:
- Replaces the need for an external audit
- Engages business-line staff to identify and evaluate their own operational risks (Correct answer)
- Automatically generates regulatory reports
- Calculates capital reserve requirements for operational risk
Correct answer: Engages business-line staff to identify and evaluate their own operational risks
RCSAs leverage frontline employees' operational knowledge to surface risks and evaluate control effectiveness in ways that top-down audits may miss.
Question 6: Which scenario best illustrates 'systemic risk' in the payments industry?
- A single merchant experiencing a data breach affecting 500 cardholders
- Failure of a central clearinghouse disrupting settlement across multiple banks (Correct answer)
- A processor miscoding a single transaction to the wrong MCC
- An employee mistakenly processing a duplicate payment to a vendor
Correct answer: Failure of a central clearinghouse disrupting settlement across multiple banks
Systemic risk refers to the potential for the failure of one interconnected entity to cascade across the entire financial system, as a clearinghouse failure would.
Question 7: Which of the following BEST describes the purpose of a Business Impact Analysis (BIA) in payments risk management?
- Determine which fraud rules to activate in a real-time decisioning engine
- Identify critical business functions and quantify the impact of their disruption (Correct answer)
- Calculate chargeback reserve requirements for merchant portfolios
- Assess the creditworthiness of new merchant applicants
Correct answer: Identify critical business functions and quantify the impact of their disruption
A BIA identifies mission-critical functions, establishes recovery time objectives, and quantifies financial and operational harm from disruption to support continuity planning.
APRP Risk Assessment & Mitigation 3
Under Regulation E, what is the maximum liability for a consumer who reports an unauthorized electronic fund transfer within 2 business days of learning of the loss?