Welcome to BLU3 Technologies

nav2011.jpg

March 2012

1. Vendor Management: We have talked with many financial institutions (FI) in the last few weeks regarding how to handle data security breaches of FI data, especially if the breach occurs while under contract with the vendor. The easy answer is to construct the contract with the service provider or vendor to require notification from the vendor to the Bank as soon as practical (one occurrence occurred in April 2011 and was only reported to the FIs in March of this year!) and allow for the termination of the contract at the FI’s discretion. If the contract does not include those provisions, then the only option is to provide increased monitoring of the provider. What is increased monitoring? Here are some possible actions: Quarterly: Consider asking the vendor (in writing) for results of recent examinations or audits, updated incident response plans (how and when will the vendor notify the FI of any issues or compromises), and raising the risk scores of vendors with issues. Additionally, make sure the proper committees and senior management are aware of the vendor issues and these are addressed/documented in committee minutes. Finally, make sure to carefully consider the relationship with the vendor when the contract is expiring. Many contracts are set to auto-renew (often 6-months before the termination) so put the review on your calendar well ahead of the date the contract ends.

2. Card Fraud (Again!): Something else to watch for. You have probably already heard of our latest data breach that is connected to a processor, Global Payments, and possibly centered more in the New York City area. Here are two links on the topic: http://nyti.ms/GYcJZm http://krebsonsecurity.com/ The first link is the New York Times article on the topic and the second is a link to our buddy Brian Krebs' security blog. In that blog, you will want to read both his April 2 post and from March 30. Brian was the first reporter on the story and his estimates are that up to 10 million could have been breached, while Global Payments is putting the number at 1 to 1.5 million. We all remember how the numbers kept increasing on the old Heartland breach, so it is wise to stay posted on the scope of this newest breach.

COMPLIANCE SECTION (Thanks to Shaun Harms and Bankers Assurance):

1. ATMs: In March 2011 we first heard of a bank in Arkansas get hit with a lawsuit due to the fee notice not being posted at the ATM. This week we have heard from another bank going through the same lawsuit and this person has hit another 6 banks in Arkansas in the last 6 months. He is from California and is traveling around to smaller banks looking for an ATM with no notice and slapping the bank with a class action suit! Please check all of your ATM machines immediately! Especially machines recently replaced for the ADA compliance rules. This is a matter of great importance….don’t be the next one.

2. More on Overdraft Fees (Thanks to Blair Rugh of TriComply): Institutions are required by their debit card networks to honor certain small dollar and some authorized transactions that exceed the authorized amount even if the transaction will cause an overdraft in the member or customer's account. Regulation E provides that an institution may not charge an overdraft fee on a one-time point of sale (POS) debit card or ATM transaction, unless the institution has the member or customer's prior written consent. Consequently, many institutions which do not have formal overdraft programs sent their members or customers the Regulation E prescribed request for consent, and many apparently consented. The result was that an overdraft fee for the force paid transactions was charged to the consenting members and customers and not to those that did not consent.

The FDIC initially determined that this practice was an unfair and deceptive act and practice. Banks being examined were instructed to reimburse all of the offending fees it had collected since July 1, 2010 when the Regulation E rule became effective. But then, the FDIC told at least one bank that it had criticized that it had changed its mind. The practice was determined not to be an unfair or deceptive act or practice and that the bank was not required to reimburse.

So far, so good. But now, the FDIC has backed off its back off. It recently told the Independent Community Bankers Association (ICBA) that they would not cite banks for the practice as unfair or deceptive. But, and it's a big BUT, the FDIC also stated it would not allow banks, which do not have a formal overdraft program, to charge a fee for POS debit card and ATM overdrafts going forward, even though the customer has consented. Also, banks are encouraged to reimburse the offending fees to mitigate litigation risk, but they are not required to do so and they will not be criticized if they do not. Further, the FDIC indicated that such a practice would not affect compliance ratings, which has been confirmed in at least one instance.

If your bank does not have a courtesy overdraft program but you sent the Regulation E notice to your customers, you must cease charging those customers fees for the transactions that you force pay, but you are not required to reimburse for prior transactions. In other words, when the only time you pay an overdraft is when you have a force pay situation, you must cease charging an overdraft fee for your force pay POS and ATM transactions. If you have a courtesy overdraft program, be it formal or ad hoc, you do not need to cease charging such overdraft fees for which you have consent from the customer as provided under Regulation E.

We have not heard of any other agency taking the FDIC's position. Moreover, the CFPB still has not made any decision despite having authority over Regulation E and are tasked with ensuring consistent examinations as proscribed under Dodd Frank.