Electronic Operations

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 555

[No. 98-77]

RIN 1550-AB00

Electronic Operations

AGENCY: Office of Thrift Supervision, Treasury.

ACTION: Supplemental notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: On October 3, 1997, the Office of Thrift Supervision (OTS)

published a notice of proposed rulemaking (NPR) to streamline and

update its electronic operations regulations. Today's supplemental

notice of proposed rulemaking (Supplemental NPR) seeks comment on

additional proposed rules that would require each savings association

to notify OTS before it establishes a transactional web site. Savings

associations that present supervisory or compliance concerns may be

subject to additional procedural requirements.

DATES: Comments must be received on or before September 14, 1998.

ADDRESSES: Send comments to Manager, Dissemination Branch, Records

Management and Information Policy, Office of Thrift Supervision, 1700 G

Street, NW., Washington DC 20552; Attention Docket No. 98-77. These

submissions may be hand-delivered to 1700 G Street, NW., from 9:00 a.m.

to 5:00 p.m. on business days; they may be sent by facsimile

transmission to FAX Number (202) 906-7555 or by e-mail

[email protected]. Those commenting by e-mail should include

their name and telephone number. Comments will be available for

inspection at 1700 G Street, NW., from 9:00 a.m. until 4:00 p.m. on

business days.

FOR FURTHER INFORMATION CONTACT: Richard Bennett, Counsel (Banking and

Finance), (202) 906-7409; Karen A. Osterloh, Assistant Chief Counsel,

(202) 906-6639; Paul D. Glenn, Special Counsel, Chief Counsel's Office,

(202) 906-6203; Paul J. Robin, Program Analyst, Compliance Policy,

(202) 906-6648; or Paul R. Reymann, Policy Analyst, Supervision Policy,

(202) 906-5645, Office of Thrift Supervision, 1700 G Street NW.,

Washington, DC 20552.

SUPPLEMENTARY INFORMATION:

I. Background

On October 3, 1997, OTS published a notice of proposed rulemaking

(NPR) to streamline and update its regulations relating to electronic

operations.\1\ The NPR followed an April 2, 1997 advance notice of

proposed rulemaking (ANPR) seeking comment on all aspects of banking

affected by electronic operations.\2\

---------------------------------------------------------------------------

\1\ 62 FR 51817 (October 3, 1997).

\2\ 62 FR 15626 (April 2, 1997).

---------------------------------------------------------------------------

The ANPR was designed to elicit information to enhance OTS's

understanding of new electronic banking technologies and the impact of

these technologies on the regulation of Federal savings

associations.\3\ The ANPR asked a series of questions concerning the

types of restrictions or requirements OTS should impose on electronic

operations, including Internet banking.\4\

---------------------------------------------------------------------------

\3\ See 62 FR at 15631 and 15633.

\4\ See 62 FR at 15633.

---------------------------------------------------------------------------

Based on the information obtained through the ANPR, the NPR

proposed to amend OTS's electronic operations regulations to address

advances in technology and to permit prudent innovation through the use

of emerging technology by Federal savings associations. The NPR noted

that OTS would continue to gain additional experience with electronic

technology and might issue more specific guidance regulating particular

elements of electronic operations.\5\

---------------------------------------------------------------------------

\5\ 62 FR at 51820.

---------------------------------------------------------------------------

The comment period on the NPR closed on December 2, 1997. OTS

received nine comment letters on the NPR from five Federal savings

associations, two trade associations, and two technology firms. One

commenter argued that OTS should establish a procedure to review and

approve new products or services, in order to protect the safety and

soundness of the industry. Another commenter urged OTS not to require a

Federal savings association to obtain the OTS's prior approval before

adopting new technologies ``unless absolutely necessary to ensure

industry-wide safety and soundness.''

After considering these comments and reflecting on its supervisory

experience and knowledge, OTS believes that safety and soundness and

compliance considerations currently warrant the agency receiving

advance notice of industry use of one developing technology--

transactional web sites. Such web sites allow savings association

customers to use the Internet to conduct a wide variety of financial

transactions. They may, however, also pose particular security,

compliance, and privacy risks, as discussed more fully in Part II.A.,

below. The notice requirement will enable OTS to better

[[Page 43328]]

assist regulated institutions to deal with these risks. The same

considerations require that the Regional Offices have discretion to

impose additional requirements in appropriate circumstances.

Because the safety and soundness and compliance considerations are

similar for state-chartered and federally-chartered institutions, this

Supplemental NPR proposes to require every savings association to

notify OTS before it establishes a transactional web site and comply

with additional requirements that the Regional Offices may impose in

appropriate circumstances. Since the ANPR and NPR did not specifically

discuss these requirements and the ANPR and NPR applied only to Federal

savings associations, OTS has concluded that additional public comment

would assist in the promulgation of a final rule.

This Supplemental NPR supplements, rather than supersedes the NPR.

OTS intends to promulgate one final rule implementing the NPR and the

Supplemental NPR. However, rather than codifying the final rule in part

545 as OTS had proposed, OTS is proposing to codify the final rule in a

new part 555. The reason is that part 545 only applies to Federal

savings associations while the new requirements proposed would apply to

all savings associations. When OTS publishes the final rule, it intends

to take the provisions designated as subpart B to part 545 in the NPR

and redesignate them, in final form, as subpart A to the new part 555

proposed today. As explained in proposed Sec. 555.100, subpart A to

part 555 would apply only to Federal savings associations, whereas

subpart B to part 555 would apply to all savings associations.

II. Supplemental Proposed Provisions

A. Must I Inform OTS Before I Use Electronic Means or Facilities?

(Proposed Sec. 555.300)

Proposed Sec. 555.300(a) sets forth the general rule that a savings

association does not have to inform OTS in advance when it plans to use

electronic means and facilities except under two circumstances. OTS

encourages a savings association to consult with the appropriate

Regional Office before it begins activities using electronic means or

facilities, even where not required to inform OTS in advance. As with

other activities, OTS will continue to rely on its existing supervisory

examinations and application processes to ensure the savings

association's ability to engage in new activities in a safe, sound,

secure, and compliant manner.6

---------------------------------------------------------------------------

\6\ OTS reviews the safety and soundness of new activities, the

appropriateness of the internal controls and security precautions,

and compliance with applicable laws and regulations on a case-by-

case and institution-by-institution basis in connection with

applications and through the examination process. For institutions

subject to an application process (e.g., de novo applications),

these initial safety and soundness and compliance determinations

will be made in the application review. After application approval

or where no application is required, safety and soundness and

compliance will generally be assessed as a part of the examination

process. This process will review and assess the institution's

identification of risks of the activity, the steps it has taken to

mitigate these risks, the testing it has undertaken to ensure safety

and soundness, and its compliance monitoring process.

---------------------------------------------------------------------------

The proposed rule contains two exceptions to this general rule.

First, proposed Sec. 555.300(b) would require every savings association

to notify OTS before it establishes a transactional web site. OTS

proposes to define a ``transactional web site'' for purposes of this

rule as an Internet site that enables users to conduct financial

transactions such as accessing an account, obtaining an account

balance, transferring funds, processing bill payments, opening an

account, applying for or obtaining a loan, or purchasing other products

or services.

OTS believes that using a web site to conduct such activities

raises safety and soundness and compliance concerns not present when

the activities are conducted through more established technologies. OTS

has been, and continues to be, concerned with the adequacy of firewalls

to prevent hackers from breaking into an association's computer systems

and thereby jeopardizing the association's security.7

However, OTS is also concerned about other operational and compliance

risks presented by Internet banking and intends to increase its

monitoring of web sites for compliance with disclosure laws and

regulations. Additionally, OTS is concerned about protecting the

privacy of individuals submitting information (or about whom

information has been submitted).8 The collection of baseline

information on transactional web sites is an important and integral

part of OTS efforts to enhance its supervision of Internet banking

activities.

---------------------------------------------------------------------------

\7\ Statistics from the United States Senate's Permanent

Investigations Subcommittee indicate that banking, insurance and

securities firms collectively lost more than $800 million in 1996 to

computer crimes. This figure is expected to grow as more financial

services firms conduct business over the Internet. Susana Schwartz,

Internet Security: The Bane of Electronic Commerce?, 22 Insurance &

Technology 40 (Sept. 1997). A 1996 survey by the Computer Security

Institute and the Federal Bureau of Investigations found that of 428

corporations, government agencies, financial institutions, and

universities surveyed, 53 percent reported having been victims of

computer viruses and 42 percent acknowledged unauthorized use of

their computer systems in the prior 12 months. Id. In 1995, the FBI

estimated that computer criminals cost United States businesses $7.5

billion a year. Losses ranged from outright industrial espionage and

willful destruction of files and data to the cost of fixing security

problems. David H. Freedman et al., Cracker, 122 U.S. News & World

Report 56 (June 2, 1997).

\8\ OTS has been studying compliance and privacy issues relating

to savings association web sites and notes that a number of industry

and governmental studies have reported on these issues. For example,

two recent industry studies reported a significant number of

potential violations of advertising and disclosure requirements on

the web sites of banks and other financial service providers, though

these studies did not focus on savings associations. The identified

problems included failure to: (1) use the term ``annual percentage

rate'' or ``APR'' and provide advertising disclosures required by

Regulation Z (Truth in Lending Act), (2) include the Equal Housing

Lender logotype and legend as required by the Fair Housing Act, (3)

post annual percentage yields as required by the Truth In Savings

Act, and (4) provide disclaimers that non-insured products are not

insured by the Federal Deposit Insurance Corporation as required by

FDIC regulations. See Richard Insley, Click Here To Violate the Law

(visited July 30, 1998) http://www.moneypage.com/features/

RegZWebsiteViolations.htm>; Jo Ann S. Barefoot, Don't Get You

Compliance Record Tangled in the Web, ABA Banking Journal 26-30

(June 1998). Similarly, a recent Federal Trade Commission report

included an analysis of 125 web sites operated by financial service

providers. It found that while 97 percent of the sites collected

personal information, only 17 percent of those sites contained

appropriate disclosures such as a privacy policy notice or an

information practice statement. See Federal Trade Commission,

Privacy Online: A Report to Congress (June 1998) at 22, 24, 27.

The industry and FTC reports identified only those compliance

problems that could be readily observed by viewing the web site.

These studies raise serious and legitimate concerns regarding both

informational and transactional web sites. Because savings

associations could perform a broad range of activities through

transactional web sites, OTS believes that transactional web sites

are likely to raise other more complex compliance and privacy

issues, in addition to those identified in the studies.

---------------------------------------------------------------------------

While collecting this information will impose a minimal burden on

savings associations, it will also allow individual associations, and

the industry as a whole, to reap important benefits. OTS will be better

able to assist associations that are contemplating or already

conducting Internet operations to identify and address the risks that

accompanying such activities. This will help institutions avoid

problems and protect consumers. The information will also broaden the

agency's awareness of trends in Internet banking operations, which it

can share with institutions.

At this time, OTS is not proposing to require a notice under

Sec. 555.300(b) for any activities using electronic means or facilities

other than transactional web sites. For example, a savings association

would not be required, under this paragraph, to notify OTS before it

establishes an informational web site

[[Page 43329]]

(i.e., a non-transactional web site) such as a web site limited to

advertising and fee and rate posting.9 OTS, however, expects

savings associations to inform the Regional Office of the informational

web site address (the Uniform Resource Locator or

``URL'').10 This will assist OTS to obtain the information

it needs for efficient supervision, particularly in the compliance

area.11 As technologies emerge, OTS may revise the rule to

require notice of activities other than establishing a transactional

web site. As technologies mature and the industry and OTS gain

additional experience, OTS may revise the rule to no longer require

notice before establishing a transactional web site.

---------------------------------------------------------------------------

\9\ Of course, before a savings association could change an

informational web site to a transactional web site by adding

features enabling users to conduct financial transactions on the web

site, the savings association would have to file a notice with OTS.

\10\ OTS is currently considering whether to require this

information as part of the Thrift Financial Report reporting

process.

\11\ OTS is aware that the advertising and disclosure problems

identified by the industry studies cited in footnote 8 above apply

equally to transactional and informational web sites. OTS believes,

however, that the need for advance notice is greater where such

concerns are combined with the other compliance, security, and

privacy issues applicable to transactional web sites. To minimize

regulatory burden, OTS is proposing to limit the advance notice

requirement to transactional web sites. However, OTS will continue

to examine both types of web sites for operational and compliance

problems.

---------------------------------------------------------------------------

Second, a filing may also be required in the circumstances

described in proposed Sec. 555.300(c). If the OTS Regional Office has

informed a savings association of supervisory or compliance concerns

that may affect the savings association's use of electronic means or

facilities, the savings association must follow any additional

procedures the Regional Office has imposed in writing.

B. How Do I Notify OTS? (Proposed Sec. 555.310)

Proposed Sec. 555.310 describes the notice procedures applicable to

notices required by Sec. 555.300(b). Because establishing a

transactional web site is the only activity that would require such a

notice, the notice procedures have been tailored to that activity.

Proposed Sec. 555.310(a) would require a savings association to

provide a written notice to the appropriate Regional Office at least 30

days before establishing a transactional web site. OTS does not propose

to prescribe any particular form for the notice, but contemplates that

it may be brief. The proposed regulation would simply require that a

savings association describe the transactional web site, indicate the

date the transactional web site will become operational, and list a

contact familiar with the deployment, operation, and security of the

transactional web site. Upon receipt of the notice, the Regional Office

may determine that additional information is required to ensure that

the savings association will operate the transactional web site in a

safe, sound, secure, and compliant manner.

A typical notification might include the following text:

[Name of savings association] plans to establish a transactional web

site on the Internet at [URL]. It will be operational on [Date]. The

site will contain mortgage loan applications that can be transmitted

securely to our loan processing office. For further information

contact: [Name at telephone number, e-mail].

This notification requirement would further the approach in the

ANPR and NPR by facilitating OTS's ability to obtain information on the

industry's use of transactional web sites. It would also efficiently

allow OTS to keep abreast of significant changes in the way particular

savings associations interact with their existing or potential

customers to enable OTS to issue appropriate guidance. Finally, it

would respond to the concern raised by the comments on the NPR that OTS

should be vigilant about new electronic operations raising safety and

soundness concerns, by assisting OTS to supervise effectively the

electronic operations of savings associations.

Proposed Sec. 555.310(b) contains a transition provision applicable

to the notice requirement in Sec. 555.310(a). It provides that if a

savings association established a transactional web site after the date

of its last regular onsite OTS safety and soundness examination but

before the effective date of the final rule, it would have to file a

notice describing its activity within 30 days from the effective date

of the final rule. OTS notes that if a savings association began the

activity before its last regular onsite OTS safety and soundness

examination, Sec. 555.310 would not apply to that activity.

III. Request for Comments

OTS invites comments on all aspects of this Supplemental NPR, but

requests that commenters limit their comments to new matters raised by

this Supplemental NPR, rather than matters addressed in the NPR. OTS

solicits specific comment on the following questions:

1. Should OTS require a notice before an association establishes a

transactional web site? Why or why not?

2. Is OTS's proposed definition of a ``transactional web site''

appropriate? Are there alternative terms or definitions that are

commonly used and understood in the industry that should be

substituted? Is the difference between a transactional web site and an

informational web site clear and appropriate?

3. Should OTS require a notice for any other activities such as

establishing any type of web site on an in-house server, providing e-

mail access for the public, or collecting personal information through

an interactive web site tool such as a mortgage calculator?

4. What information should be required in the notice filed with

OTS? Should OTS require the savings association to provide additional

information such as: (a) how it will conduct an activity, including

descriptions of security and internal controls (e.g., the encryption

level used, the testing that has been performed), or (b) how it will

ensure compliance with laws and regulations (e.g., disclosure

requirements)?

5. Is it appropriate for OTS to require the notification 30 days

before a savings association begins an activity?

IV. Executive Order 12866

The Director of OTS has determined that this proposed rule does not

constitute a ``significant regulatory action'' for the purposes of

Executive Order 12866.

V. Paperwork Reduction Act of 1995

OTS invites comment on:

Whether the proposed information collection contained in this

proposal is necessary for the proper performance of OTS's functions,

including whether the information has practical utility;

(1) The accuracy of OTS's estimate of the burden of the proposed

information collection;

(2) Ways to enhance the quality, utility, and clarity of the

information to be collected;

(3) Ways to minimize the burden of the information collection on

respondents, including through the use of automated collection

techniques or other forms of information technology; and

(4) Estimates of capital and start-up costs of operation,

maintenance and purchases of services to provide information.

Respondents are not required to respond to this collection of

information unless it displays a currently valid OMB control number.

The collection of information requirements contained in this

proposal have been submitted to the Office of Management and Budget for

review in accordance with the Paperwork Reduction Act of 1995 (44

U.S.C.

[[Page 43330]]

3507(d)). Comments on the collections of information should be sent to

the Office of Management and Budget, Paperwork Reduction Project

(1550), Washington, DC 20503, with copies to the Regulations and

Legislation Division, Chief Counsel's Office, Office of Thrift

Supervision, 1700 G Street, NW., Washington, DC 20552.

The collection of information requirements in this proposed rule

are found in 12 CFR 555.300 and 555.310. OTS requires this information

for the proper supervision of electronic operations by savings

associations. The likely respondents/recordkeepers are savings

associations.

Estimated average annual burden hours per respondent: 2 hours.

Estimated number of respondents: 100 respondents.

Estimated total annual reporting burden: 200 hours.

Start up costs to respondents: None.

VI. Regulatory Flexibility Act Analysis

Pursuant to section 605(b) of the Regulatory Flexibility Act, OTS

certifies that this proposed rule will not have a significant impact on

a substantial number of small entities. In conjunction with the NPR,

this Supplemental NPR should make it easier for savings associations,

including small institutions, to engage in electronic operations. While

it imposes a notice requirement on savings associations using one

particular type of electronic means or facility (i.e., a transactional

web site) and allows Regional Office to impose case-by-case

restrictions for supervisory or compliance reasons, these requirements

are the minimum necessary for proper supervision, and should not have a

significant impact on a substantial number of small institutions.

VII. Unfunded Mandates Act of 1995

Section 202 of the Unfunded Mandates Reform Act of 1995, Pub. L.

104-4 (Unfunded Mandates Act), requires that an agency prepare a

budgetary impact statement before promulgating a rule that includes a

Federal mandate that may result in expenditure by state, local, and

tribal governments, in the aggregate, or by the private sector, of $100

million or more in any one year. If a budgetary impact statement is

required, section 205 of the Unfunded Mandates Act also requires an

agency to identify and consider a reasonable number of regulatory

alternatives before promulgating a rule. OTS has determined that the

proposed rule will not result in expenditures by state, local, or

tribal governments or by the private sector of $100 million or more.

Accordingly, this rulemaking is not subject to section 202 of the

Unfunded Mandates Act.

List of Subjects 12 CFR Part 555

Accounting, Consumer protection, Credit, Electronic funds

transfers, Investments, Reporting and recordkeeping requirements,

Savings associations.

Accordingly, the Office of Thrift Supervision proposes to amend

chapter V, title 12 of the Code of Federal Regulations by adding part

555 as set forth below:

PART 555--ELECTRONIC OPERATIONS

Sec.

555.100 What does this part do?

Subpart A--Authority of Federal Savings Associations To Conduct

Electronic Operations [Reserved]

Subpart B--Requirements Applicable to All Savings Associations

555.300 Must I inform OTS before I use electronic means or

facilities?

555.310 How do I notify OTS?

Authority: 12 U.S.C. 1462a, 1463, 1464.

Sec. 555.100 What does this part do?

Subpart A of this part describes how a Federal savings association

may provide products and services through electronic means and

facilities. Subpart B of this part contains requirements applicable to

all savings associations.

Subpart A--Authority of Federal Savings Associations to Conduct

Electronic Operations [Reserved]

Subpart B--Requirements Applicable to All Savings Associations

Sec. 555.300 Must I inform OTS before I use electronic means or

facilities?

(a) General. A savings association (``you'') are not required to

inform OTS before you use electronic means or facilities, except as

provided in paragraphs (b) and (c) of this section. OTS encourages you

to consult with your Regional Office before you engage in activities

using electronic means or facilities in circumstances not covered by

paragraphs (b) or (c) of this section.

(b) Activities requiring advance notice. You must file a written

notice as described in Sec. 555.310 before you establish a

transactional web site. A transactional web site is an Internet site

that enables users to conduct financial transactions such as accessing

an account, obtaining an account balance, transferring funds,

processing bill payments, opening an account, applying for or obtaining

a loan, or purchasing other products or services.

(c) Other procedures. If the OTS Regional Office has informed you

of any supervisory or compliance concerns that may affect your use of

electronic means or facilities, you must follow any procedures it has

imposed in writing.

Sec. 555.310 How do I notify OTS?

(a) Notice requirement. You must file a written notice with the

appropriate Regional Office at least 30 days before you establish a

transactional web site. The notice must do three things:

(1) Describe the transactional web site.

(2) Indicate the date the transactional web site will become

operational.

(3) List a contact familiar with the deployment, operation, and

security of the transactional web site.

(b) Transition provision. If you established a transactional web

site after the date of your last regular onsite OTS safety and

soundness examination but before [Effective date of final rule], you

must file a notice describing your activity by [30 days after effective

date of final rule].

Dated: August 7, 1998.

By the Office of Thrift Supervision.

Ellen Seidman,

Director.

[FR Doc. 98-21704 Filed 8-12-98; 8:45 am]

BILLING CODE 6720-01-P