ABA Banking Journal - April 2008 - (Page 56)

COMPLIANCE CLINIC addressed in the Federal Reserve consumer regulation amendments are the practical application of getting a consumer’s affirmative consent to receiving disclosures electronically and how to get the consumer to demonstrate that he/she can access information in electronic form. Richard Insley of APR Systems, Inc., a recognized expert in internet bank compliance, says that there is a big difference between “demonstration,” which is required by E-Sign, and “declaration.” Many banks try to use a declaration by the consumer that electronic disclosures are desired or acceptable, without requiring consumers to demonstrate their ability to receive disclosures in electronic form. The regulators do not prescribe a certain way that banks must use for getting a consumer to demonstrate the ability to receive disclosures in electronic form. However, the regulators do expect that banks use a method that achieves the desired result. Compliance controls The regulators are becoming more interested in the processes and controls in place to prevent compliance problems and detect such problems early so that they can be corrected. Waiting for the examiners to come in annually or less frequently to identify compliance concerns leaves a bank vulnerable for too long to the reputational and other risks of noncompliance. Good internal controls relative to a bank’s internet website should involve: • Written policies and procedures that address the regulatory requirements applicable to the bank’s website and its functions; • Templates for portions of the website that have frequent updates; • Compliance officer’s involvement in approving additions and changes to the website; • Training for the appropriate employ56 APRIL 2008/ABA BANKING JOURNAL ees about website compliance requirements; • Periodic monitoring and audit of the website for regulatory compliance and other regulatory considerations; • Vendor management and oversight if the website is handled externally; • Senior management oversight of website strategy and direction. If, despite such controls, a bank has compliance concerns with its website, does the bank have a process for correcting those deficiencies and documenting the corrections? That’s a critical step. Security As bank websites get more functionality beyond display of information, security becomes even more important—both customer and bank security. Many of the regulatory advisements in the past few years have been related to security issues, such as multifactor authentication, threat response programs, identity theft scams, and website spoofing. Banks and consumers are warned not to use e-mail to communicate personal financial information to each other that can be used to steal someone’s identity. Banks are strongly encouraged to use multiple authentication factors to provide customer access to account information to decrease the risk of intrusion by unauthorized parties. Banks are expected to develop processes for notifying regulators and customers when a breach of security is detected that could impact customer information. Updates and changes Evolution in bank websites means change. There are ongoing changes caused by product changes and routine rate changes. Web pages are periodically redesigned to provide a fresh look or easier navigation. Any time there are changes, there is an increased risk for compliance errors, particularly if the bank’s compliance officer is not included in the review process. A related problem is the delay in making changes to correct compliance deficiencies. If a bank uses a third party to operate its website, there could be delays in getting changes made that are needed to meet compliance requirements. Sometimes the third party is unwilling to make changes, because they either do not understand the bank regulatory requirements or they don’t care. If a bank is the first or only one to bring the problem to its attention, the third party may not want to put in the work or expense to deal with the issue. It would be wrong to assume that once a website is in place, an annual compliance monitoring review is sufficient to keep the bank in compliance. That may have been the case in the past, but not now. Don’t lose sight of the basics Websites of banks may be maturing and creating new compliance concerns. But, the old basic compliance requirements have not gone away. Banks still need to be sure to remember the old standbys, such as: • Include all required disclosures when a Regulation Z or DD triggering term is included in the website; • Spell out the term “Annual Percentage Yield” somewhere in the site and don’t use only the abbreviation, APY; • Use privacy notices on the website that match the bank’s written privacy notice and the bank’s actual privacy practices; • Equal Housing Lender logos must be legible—not too blurred or too small; • Application forms must contain the required disclosures about requests for income or monitoring information. The list could go on. Bank website compliance rules are still around and growing in complexity. Keep one eye on the old favorites and the other on the future possibilities of the internet and how to comply in both worlds. BJ Subscribe at www.ababj.com http://www.aprsystems.com http://www.ababj.com

Table of Contents Feed for the Digital Edition of ABA Banking Journal - April 2008

ABA Banking Journal - April 2008 Contents Editor's Column You Can't Beat Wal-Mart: Or Can You? Snapshot: Non-Interest Income Shoulders More Weight ABA National Conference for Community Bankers Report 100th Anniversary: Then & Now ABA Resources ABA Chairman's Position Banks Plus Insurance: How to Make It Work Pass the Aspirin 2008: Year of Rich Internet Apps? Tough Time For That IPO Your Audience Needs to Know Who You Are Telepresence: Costly But Very Cool Webnotes Better Websites Mean Tougher Compliance Mailbox Banker's Mart To Advertise/Index of Advertisers The Economy

ABA Banking Journal - April 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.