Electronic Operations

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Parts 545, 555, and 559

[No. 98-119]

RIN 1550-AB00

Electronic Operations

AGENCY: Office of Thrift Supervision, Treasury.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Office of Thrift Supervision (OTS) is issuing a final rule

that streamlines and updates its regulations relating to electronic

operations. Under this rule, Federal savings associations may engage in

prudent innovation through the use of emerging technology. The rule

permits Federal savings associations to use, or participate with others

to use, electronic means or facilities to perform any function, or

provide any product or service, as part of an authorized activity. The

rule also requires each savings association (state- or federally-

chartered) to notify OTS 30 days before it establishes a transactional

web site. Savings associations that present supervisory or compliance

concerns may be subject to additional procedural requirements. Finally,

the rule includes a conforming change to OTS's service corporation

regulation, reflecting a recent statutory change.

EFFECTIVE DATE: January 1, 1999.

FOR FURTHER INFORMATION CONTACT: Richard Bennett, Counsel (Banking and

Finance), (202) 906-7409; Karen A. Osterloh, Assistant Chief Counsel,

(202) 906-6639; Paul D. Glenn, Special Counsel, Chief Counsel's Office,

(202) 906-6203; Paul J. Robin, Program Analyst, Compliance Policy,

(202) 906-6648; or Paul R. Reymann, Senior Policy Analyst, Supervision

Policy, (202) 906-5645, Office of Thrift Supervision, 1700 G Street

NW., Washington, DC 20552.

SUPPLEMENTARY INFORMATION:

I. Background

A. Advance Notice of Proposed Rulemaking

On April 2, 1997, OTS published an advance notice of proposed

rulemaking (ANPR) seeking comment on all aspects of banking affected by

electronic operations.1 The ANPR was designed to elicit

information to enhance OTS's understanding of new electronic banking

technologies and the impact of these technologies on the regulation of

Federal savings associations.2 The ANPR asked a series of

questions concerning the types of restrictions or requirements OTS

should impose on electronic operations, including Internet banking.

---------------------------------------------------------------------------

\1\ 62 FR 15626 (April 2, 1997).

\2\ See 62 FR at 15631 and 15633.

---------------------------------------------------------------------------

B. Notice of Proposed Rulemaking

Based on the comments received on the ANPR, on October 3, 1997, OTS

published a notice of proposed rulemaking (NPR) to streamline and

update its regulations relating to electronic operations.3

The NPR proposed to amend OTS's electronic-related regulations to

address advances in technology and to permit prudent innovation through

the use of emerging technology by Federal savings associations. In

crafting the proposed rule, OTS was guided by two broad principles

suggested by commenters on the ANPR:

---------------------------------------------------------------------------

\3\ 62 FR 51817 (October 3, 1997). The NPR contains a summary of

the comments received on the ANPR.

---------------------------------------------------------------------------

The public and insured depository institutions will be

best served if statutory and regulatory restrictions are kept to a

minimum. The premature imposition of restrictive operational standards

could impede the development of improved financial services.

Federal savings associations should be permitted to

compete effectively with other regulated financial institutions and

unregulated firms offering financial and related services.

Consistent with these principles, OTS proposed a broad enabling

regulation designed to allow Federal savings associations to engage in

any activity through electronic means that they may conduct through

more traditional delivery mechanisms. OTS proposed to eliminate three

existing regulations: Sec. 545.138 (Data-Processing Services),

Sec. 545.141 (Remote Services Units), and Sec. 545.142 (Home Banking

Services). The elimination of these sections would not take away the

authority to engage in any activities described in these sections.

OTS made the proposal to enhance the ability of Federal savings

associations to serve as financial intermediaries and to permit Federal

savings associations to utilize fully their capacities and by-products

generated in providing financial services. The proposal was consistent

with the principles established in the Administration's electronic

commerce policy statement.4 The NPR noted, however, that OTS

would continue to gain additional experience with electronic technology

and might issue more specific guidance regulating particular elements

of electronic operations.5

---------------------------------------------------------------------------

\4\ See ``Framework for Global Electronic Commerce'' (July 1,

1997).

\5\ 62 FR at 51820.

---------------------------------------------------------------------------

C. Comments on NPR--General Discussion

The comment period on the NPR closed on December 2, 1997. OTS

received nine comment letters on the NPR from five Federal savings

associations, two trade associations, and two technology firms.

All of the commenters recognized the need for the agency to revise

or remove its existing regulations in this area. Seven commenters

supported the proposal's overall flexible regulatory approach, while

suggesting modifications or clarifications to particular aspects of the

rule. Two commenters argued that for even greater flexibility the

agency should not issue any new electronic banking regulations. These

two commenters suggested the agency rely entirely on flexible

guidelines and advisories as technology evolves. OTS has addressed

specific comments on the NPR below.

D. Supplemental Notice of Proposed Rulemaking

One commenter on the NPR argued that OTS should establish a

procedure to review and approve new products or services, in order to

protect the safety and soundness of the industry. Another urged OTS not

to require a Federal savings association to obtain OTS's prior approval

before adopting new technologies ``unless absolutely necessary to

ensure industry-wide safety and soundness.'' After considering these

comments, OTS concluded that safety and soundness and compliance

considerations warranted the agency receiving advance notice of

industry use of one developing technology--transactional web sites.

Such web sites allow savings association customers to use the Internet

to conduct a wide variety of financial transactions. They may, however,

also pose particular security, compliance, and privacy risks.

Accordingly, on August 13, 1998, OTS issued a supplemental notice

of proposed rulemaking (Supplemental NPR) seeking comment on additional

proposed rules that would require each savings association to notify

OTS before

[[Page 65674]]

it establishes a transactional web site.6 OTS also proposed

to give the Regional Offices discretion to impose additional

requirements in appropriate circumstances.

---------------------------------------------------------------------------

\6\ 63 FR 43327 (August 13, 1998).

---------------------------------------------------------------------------

Safety and soundness and compliance considerations are similar for

state-chartered and federally-chartered institutions. Thus, the

Supplemental NPR proposed to require every savings association to

notify OTS before it established a transactional web site and to comply

with additional requirements that the Regional Offices may impose in

appropriate circumstances. Since the ANPR and NPR did not specifically

discuss these requirements and applied only to Federal savings

associations, OTS concluded that additional public comment would assist

in the development of a final rule.

E. Comments on Supplemental NPR--General Discussion

The comment period on the Supplemental NPR closed on September 14,

1998. OTS received nine comment letters from six Federal savings

associations, two trade associations, and one public interest

organization.

Two commenters supported the notice requirement. Four commenters

opposed the requirement. The other three commenters did not

specifically support or oppose the requirement. OTS has addressed the

specific comments on the Supplemental NPR below.

II. Today's Final Rule

Today's final rule incorporates the same broad principles and

reflects the same supervisory concerns articulated in the NPR and

Supplemental NPR. OTS continues to believe that it is important to have

enabling regulations in this area. These regulations will help ensure

that OTS has sufficient information to understand developing

technologies, to provide appropriate guidance on these technologies,

and to supervise electronic operations effectively. The proposed

approach in the NPR and Supplemental NPR, with some modifications as

discussed below, will provide both the industry and the agency with the

appropriate amount of flexibility to adapt to changing conditions.

Today's final rule is meant to provide authority for Federal

savings associations' electronic operations and a structure for all

savings associations' use of electronic means and

facilities.7 Standing alone, it cannot, and does not purport

to, answer all questions in this rapidly changing area. These

operations, by their very nature, are evolving, presenting the industry

and the agency with both old issues in a new form (e.g., the

appropriate documentation to open an account) and new issues unique to

electronic operations (e.g., treatment of stored value cards). The

agency has issued, and will continue to issue, guidance as electronic

operations evolve. This guidance has taken the form of letters to chief

executive officers of savings associations, interagency examiner

guidelines, revisions to the Thrift Activities Handbooks, conditions on

the approval of applications, and responses to requests for legal

interpretations.8 The agency expects to continually update

its guidance and to continue to make it available on OTS's web site at

www.ots.treas.gov.

---------------------------------------------------------------------------

\7\ New Sec. 555.200 is similar to the Office of the Comptroller

of the Currency's (OCC) rule on furnishing of products and services

by electronic means and facilities. See 12 CFR 7.1019 (1998).

\8\ See, e.g., Memorandum from Richard M. Riccobono, Deputy

Director, for Chief Executive Officers (November 3, 1998) (Policy

Statement on Privacy and Accuracy of Personal Customer Information);

Memorandum from Richard M. Riccobono, Deputy Director, for Chief

Executive Officers (July 23, 1998) (Interagency Guidance on

Electronic Financial Services and Consumer Compliance); Memorandum

from John Downey, Executive Director, Supervision, for Chief

Executive Officers (June 23, 1997) (Statement on Retail On-Line

Personal Computer Banking); Thrift Activities Regulatory Handbook,

Section 341, Information Technology (October 1997) (Regulatory

Bulletin 32-6, October 15, 1997); Federal Financial Institutions

Examinations Council (FFIEC) Information Systems Examination

Handbook (1996); OTS Order No. 95-88 (May 8, 1995) (application

approval of Internet bank); OTS Op. Chief Counsel (September 19,

1997) (establishment of automated loan machines).

---------------------------------------------------------------------------

Further, while today's final rule removes Secs. 545.138, 545.141,

and 545.142, OTS emphasizes that the new rules continue to authorize

all activities formerly authorized under these provisions.

III. Section-by-Section Discussion

Today's final rule creates a new part 555 to address electronic

operations. In the NPR, OTS originally proposed to place the electronic

operations regulations in a new subpart B to part 545. However, part

545 only applies to Federal savings associations. The notice

requirements proposed in the Supplemental NPR and incorporated into

this final rule, however, apply to all savings associations. Thus, as

proposed in the Supplemental NPR, OTS is placing the electronic

operations regulations in a new part 555.

A. What Does This Part Do? (Sec. 555.100)

Section 555.100 explains the purpose of part 555. Subpart A

explains how a Federal savings association may provide products and

services through electronic means and facilities. Subpart B contains

the advance notice and other requirements applicable to all savings

associations.

OTS received no specific comments on Sec. 555.100 of the

Supplemental NPR (or on Sec. 545.140 of the NPR, which served a similar

function). The section is unchanged from the Supplemental NPR.

B. Authority of Federal Savings Associations to Conduct Electronic

Operations (Subpart A to Part 555)

1. How May I Use or Participate With Others to use Electronic Means and

Facilities? (Proposed Sec. Sec. 545.141, 545.142, and 545.143, Final

Sec. 555.200)

Final Sec. 555.200 combines, with changes, proposed Sec. 545.141,

545.142, and 545.143. Section 555.200(a) corresponds to proposed

Sec. 545.141, but merges part of proposed Sec. 545.143. Section

555.200(b) corresponds to proposed Sec. 545.142 and also merges part of

proposed Sec. 545.143. Sections 555.200(a) and 555.200(b) are discussed

separately below.

Section 555.200(a)

Consistent with OTS's goal of minimizing regulatory restrictions on

electronic operations, proposed Sec. 545.141 would have specifically

permitted Federal savings associations to use electronic means or

facilities to perform any authorized function or provide any authorized

product or service. Electronic means or facilities would include, but

would not be limited to, automated teller machines (ATMs), automated

loan machines, personal computers, the Internet, the World Wide Web,

telephones, and other similar electronic devices. The preamble

explained that this authority would include the opening of savings or

demand accounts and the establishment of loan accounts--functions

previously excluded from the definition of remote service unit--because

performing these functions electronically may enhance the operating

flexibility of Federal savings associations.

Commenters generally supported this section. One commenter,

however, a trade association, argued that proposed Sec. 545.141 was too

broad and did not sufficiently protect the safety and soundness of the

industry. Instead, the commenter emphasized the need for a thorough

risk assessment of any new delivery system to protect safety and

soundness. The commenter urged OTS to establish a procedure whereby OTS

would issue an approval or interpretation before a product or service

was first offered electronically. Once one institution was approved to

use an electronic delivery system,

[[Page 65675]]

approval for subsequent institutions would not be required. Presumably,

subsequent institutions would be required to provide the same

protections and safeguards.

While OTS does not believe that a new procedure is necessary for

most types of electronic operations, OTS has added subpart B to part

555, to deal with the special risks associated with transactional web

sites. As discussed in Section III.C. below, subpart B will enhance

OTS's ability to supervise electronic operations, particularly Internet

banking activities.

Three Federal savings associations asked OTS to clarify whether the

new regulation would permit specific products or services. As noted in

the preamble to the proposed rule, by revising its rules, OTS intends

to allow Federal savings associations to engage in any authorized

activity through electronic means that they may conduct through more

traditional delivery mechanisms.9 To clarify this point, OTS

has revised the language of Sec. 555.200(a) to provide that a Federal

savings association may use electronic means or facilities ``to perform

any function, or provide any product or service, as part of an

authorized activity.''

---------------------------------------------------------------------------

\9\ 62 FR at 51818.

---------------------------------------------------------------------------

As with all activities of Federal savings associations, OTS's

position, like that of its predecessor agency, the Federal Home Loan

Bank Board (FHLBB), has been that if the Home Owners' Loan Act (HOLA)

10 authorizes an activity, a specific authorizing regulation

is not necessary.11 In some cases, the HOLA speaks clearly

on an activity and institutions generally choose to act without

obtaining agency concurrence. In other cases, where the authority is

less clear or specific facts are more determinative, an application or

an interpretive legal opinion may be the best route for resolving

issues of first impression.

---------------------------------------------------------------------------

\10\ 12 U.S.C. 1461-1468c.

\11\ See, e.g., 60 FR 44442, 44444 (August 28, 1995); 48 FR

23032 (May 23, 1983).

---------------------------------------------------------------------------

To assist the industry further, OTS will continue to provide both

formal and informal guidance on authorized activities for Federal

savings associations. If applicable statutes, regulations, court cases,

and OTS opinions do not provide a sufficient basis for a Federal

savings association to determine whether a product or service is

authorized under the HOLA or the use of electronic means or facilities

is appropriate, it may request an interpretive opinion 12 or

consult with OTS's Regional Director for the Region in which its home

office is located.

---------------------------------------------------------------------------

\12\ See OTS Customer Service Plan--Interpretive Opinions

(January 1996). Such questions may also be addressed in the context

of an application process (e.g., de novo applications).

---------------------------------------------------------------------------

OTS has previously provided explicit guidance on several of the

questions about specific products or services raised. For example, the

preamble to the proposed rule stated that Federal savings associations

could establish loan accounts and open savings or demand accounts

through electronic means.13 Similarly, the ANPR indicated

that the term ``electronic means and facilities'' would clearly

encompass new technologies that enable a depository institution to make

risk-based judgments electronically.14 This would include,

for example, automated credit scoring and other forms of automated

underwriting.

---------------------------------------------------------------------------

\13\ 62 FR at 51818. However, all statutory and regulatory

restrictions associated with offering a product or service continue

to apply where electronic means and facilities are used.

One commenter asked whether a signed deposit application would

have to be executed and transmitted with the initial deposit in hard

copy. At one time, FHLBB regulations specifically imposed this type

of signature card requirement. See 12 CFR 545.2(a) (1983). In May

1983, the FHLBB eliminated this specific requirement. 48 FR 23032

(May 23, 1983).

\14\ 62 FR at 15632.

---------------------------------------------------------------------------

In addition, OTS and the FHLBB have long recognized that Federal

savings associations may open accounts and transfer funds for persons

overseas. For example, the FHLBB opined that Federal savings

associations may solicit deposits and open accounts for individuals who

are not citizens or residents of the United States by mail or

electronic means.15 Since this is an authorized activity

under the HOLA, this final rule permits a Federal savings association

to engage in this activity through electronic operations. However,

Federal savings associations engaging in such electronic activities

must comply with all applicable requirements, including addressing

safety and soundness concerns and ensuring compliance with other

federal laws and requirements.16

---------------------------------------------------------------------------

\15\ See Memorandum from Jack D. Smith, Deputy General Counsel,

FHLBB, to Alvin Smuzynski, Deputy Director, Supervisory Activities

(December 7, 1987). Pursuant to that opinion, the institution was

permitted to undertake the activity where the institution maintained

the deposits in United States dollar denominations, offered standard

money market and term certificate of accounts with interest rates

and other terms and conditions that were the same as those offered

by the institution to those residing in the United States, and

complied with the requirements applicable to the type of accounts.

See also FHLBB Op. General Counsel (May 10, 1984).

\16\ OTS anticipates that it will shortly publish a proposed

``Know Your Customer'' rule, as part of an interagency rulemaking

effort.

---------------------------------------------------------------------------

OTS has not opined on whether certain activities cited by

commenters are authorized for Federal savings associations.

Specifically, one commenter asked whether a Federal savings association

may issue, use, and deal in all forms of electronic monetary value,

including stored value and smart-card technologies. Another commenter

asked whether a Federal savings association may use and participate in

digital authentication and certification, including serving as a

certificate authority (an entity certifying electronic signatures for

use in electronic commerce).

OTS has not opined on whether every activity that could involve the

use of electronic money or participation in digital authentication

regimes is an authorized activity for Federal savings

associations.17 With any new activity, the factual context

and the accompanying safeguards are often critical to determining

whether and how an activity may be conducted, whether or not electronic

means are involved. Thus, OTS believes that it is important that

savings associations continue to consult with their Regional Offices to

obtain up-to-date guidance as they move forward in the use of

electronic means and facilities.

---------------------------------------------------------------------------

\17\ With regard to electronic monetary value, OTS has opined

that a Federal savings association has authority to market and sell

prepaid telephone cards as agent for a telephone company. OTS Op.

Chief Counsel (August 29, 1996). We also note that the other federal

banking agencies have indicated that financial institutions may deal

in other types of electronic monetary value. See OCC Interpretive

Letter No. 718 (March 14, 1996) (national banks may dispense

alternate media such as public transportation tickets, event and

attraction tickets, gift certificates, prepaid phone cards,

promotional and advertising materials, electronic benefits transfer

scripts, and credit and debit cards) and Federal Deposit Insurance

Corporation General Counsel's Op. No. 8, published in, 61 FR 40490

(Aug. 2, 1996) (discussing whether, and under what circumstances,

funds underlying stored value cards may be considered deposits under

the Federal Deposit Insurance Act, 12 U.S.C. 1811-1835a).

With regard to digital authentication and certification, Federal

savings associations have incidental authority under the HOLA to

guarantee customer signatures for documentary transactions in which

an association has an interest as part of its deposit taking,

lending, or trust business, as well as guarantees executed as a

separate customer service with respect to stock transfers and

similar transactions in which the association has no direct

interest. FHLBB Op. General Counsel (August 11, 1981). In addition,

the OCC has authorized a national bank operating subsidiary to act

as a certification authority and repository for certificates that

verify digital signatures. The authority was not limited to

transactions in which the subsidiary had a direct interest. OCC Op.

Chief Counsel (January 12, 1998) (Operating Subsidiary Application

by Zions First National Bank, Salt Lake City, Utah).

OTS believes the reasoning of the other regulators appears

persuasive. OTS will consider these opinions when it reviews a

Federal savings association's authority to conduct such activities

as these issues are presented to the agency.

---------------------------------------------------------------------------

Another Federal savings association asked OTS to adopt an expansive

[[Page 65676]]

interpretation of the phrase ``authorized product or service.'' The

commenter's proposed interpretation would clarify that as long as the

primary electronic product or activity is permitted, the Federal

savings association may provide a minor ancillary application, even

though the ancillary application is not specifically authorized by the

HOLA. Federal savings associations possess powers that are incident to

the express powers of Federal savings associations, as set forth in the

HOLA.18 Today's final rule allows Federal savings

associations to use electronic means or facilities to perform any

function, or provide any product or service, as part of an authorized

activity, including activities authorized under the incidental powers

doctrine. OTS will review whether particular activities are authorized

as incidental powers on a case-by-case basis as these issues are

presented to the agency.

---------------------------------------------------------------------------

\18\ See OTS Op. Chief Counsel (August 29, 1996) at 2.

---------------------------------------------------------------------------

As noted above, Sec. 555.200(a) continues to permit Federal savings

associations to perform all data processing and transmission services

formerly authorized under Sec. 545.138(a) and (b). When Sec. 545.138

was promulgated in 1983, the FHLBB imposed certain data and customer

restrictions designed to ensure that a Federal savings association

would conduct data processing and transmission services consistent with

the authority provided in HOLA.19 OTS recognizes that the

HOLA may authorize the provision of data processing services in

additional circumstances. Accordingly, the final rule, like the OCC's

rule, does not impose specific data or customer restrictions. Rather,

final Sec. 555.200(a) merely requires that services provided through

electronic means and facilities must be a ``part of an authorized

activity.'' This restriction means that data processing and

transmission services provided must be authorized under the HOLA,

either expressly or as an incidental power.

---------------------------------------------------------------------------

\19\ See 48 FR 7428, 7429-7430 (February 22, 1983).

---------------------------------------------------------------------------

Final Sec. 555.200(a) has also been revised to incorporate

provisions in proposed Sec. 545.143, entitled ``How may I participate

with others in the use of electronic means and facilities?'' Proposed

Sec. 545.143 would have permitted a Federal savings association to

participate with others to perform, provide, or deliver activities,

functions, products, or services described in the proposed rule. A

Federal savings association could have participated with an entity that

is not subject to examination by a Federal agency regulating financial

institutions only if that entity agreed, in writing, to permit OTS to

examine its electronic means or facilities, to pay for any related OTS

examination fees, and to make all relevant records in its possession,

written or electronic, available to OTS for examination. OTS also

indicated that if the participation by a Federal savings association

was through a service corporation, OTS's service corporation rules

would apply.20

---------------------------------------------------------------------------

\20\ See 12 CFR 559.4 (1998).

---------------------------------------------------------------------------

The Examination Parity and Year 2000 Readiness for Financial

Institutions Act,21 has obviated the need for proposed

Sec. 545.143 as a separate section of the rule. Section 3 of this

legislation provides:

---------------------------------------------------------------------------

\21\ Pub. L. No. 105-164 (enacted March 20, 1998).

[I]f a savings association, a subsidiary thereof, or any savings

and loan affiliate or entity, as identified by section 8(b)(9) of

the Federal Deposit Insurance Act [12 U.S.C. 1818(b)(9)], that is

regularly examined or subject to examination by the Director [of

OTS], causes to be performed for itself, by contract or otherwise,

any service authorized under [HOLA] * * *, such performance shall be

subject to regulation and examination by the Director to the same

extent as if such services were being performed by the savings

---------------------------------------------------------------------------

association on its own premises.

In light of this legislation, today's final rule simply clarifies

the authority of a Federal savings association to participate with

others to perform any function, or provide any product or service, as

part of an authorized activity, through electronic means and

facilities. This language has been merged into final Sec. 555.200(a).

OTS is making a similar conforming change to Sec. 555.200(b), discussed

below.

In making these changes, OTS is removing the proposed requirement

concerning record availability since this requirement is implicit in

examinations authorized by the legislation. OTS is also removing the

proposed requirement concerning examination fees. The other banking

agencies do not charge fees specifically for examinations of service

providers. OTS does not intend to impose fees for the examination of

service providers, except as otherwise provided for under OTS's

assessment rule and Thrift Bulletins.

While the relevance of many of the comments on proposed

Sec. 545.143 has been negated by this intervening legislation, it is

useful to respond to some of the points raised by commenters on the

NPR. Two commenters criticized the third party examination, fee, and

record requirements as burdensome and unnecessary. In implementing the

new legislation, OTS will focus its service provider examinations on

those whose activities could have a direct impact on the safety and

soundness of savings associations.\22\ Data processing servicers and

ATM servicers are among the types of service providers OTS examines

because they provide functions critical to financial operations.

---------------------------------------------------------------------------

\22\ See Statement of Ellen Seidman, Director, Office of Thrift

Supervision, concerning Examination Parity and Year 2000 Readiness

for Financial Institutions Act, before the Committee on Banking and

Financial Services, United States House of Representatives, February

5, 1998, at 8-10.

---------------------------------------------------------------------------

Another Federal savings association explained that the software

industry is wary of providing unrestricted access to their information

without explicit assurances of confidentiality to protect proprietary

trade secrets. The commenter stated that, at a minimum, the final rule

should provide that any information reviewed or gathered during an

examination of a service provider will be treated as ``unpublished OTS

information'' under 12 CFR 510.5 (1998), which provides confidentiality

safeguards.

OTS treats service provider examination reports as confidential

unpublished OTS information.\23\ Consistent with this regulation, these

reports are not publicly available, but OTS does share the examination

reports of service providers with the Federal banking agencies. It also

shares relevant portions of the examination reports with Federal and

State savings associations that use the services of those service

providers.

---------------------------------------------------------------------------

\23\ See 12 CFR 510.5(a)(2)(ii) (1998).

---------------------------------------------------------------------------

Section 555.200(b)

Former Sec. 545.138(c) subjected marketing by-products and excess

capacity of data processing and transmission services to significant

restrictions. In contrast, under proposed Sec. 545.142, a Federal

savings association could market and sell electronic capacities and by-

products to third parties if it acquired or developed the capacities

and by-products in good faith as part of providing financial services.

The proposed rule was substantially identical to the OCC rule on

marketing and selling such capacities.\24\

---------------------------------------------------------------------------

\24\ See 12 CFR 7.1019 (1998).

---------------------------------------------------------------------------

Two commenters expressly supported the proposed section. Upon

further review, OTS believes it is necessary to make two minor

clarifications to Sec. 555.200(b).

First, the final rule indicates that the marketing and selling of

electronic capacities and by-products to third-parties is to enable

Federal savings

[[Page 65677]]

associations to optimize their resources. This language conforms the

OTS rule more closely to the OCC's rule.

Second, the final rule indicates that a Federal savings association

may also participate with others to market and sell electronic

capacities and by-products to third-parties. Like the revision to

Sec. 555.200(a) discussed above, this change incorporates part of

Sec. 555.143 of the proposed rule.

One Federal savings association asked OTS to define the phrase

``electronic capacities and by-products'' to clarify that Federal

savings associations may provide ``fully integrated solutions to a

range of business needs.'' These solutions may involve a combination of

software development, computer systems design and construction,

electronic communication (including sending electronic mail), and data

processing and storage.

OTS does not believe it is appropriate to make the clarification

requested by the commenter. As long as a Federal savings association

acquired or developed its electronic capacities and by-products in good

faith as part of providing financial services, the Federal savings

association may market and sell them to third-parties. OTS cautions,

however, that to the extent a Federal savings association may wish to

engage in additional activities in connection with the marketing and

sale of such capacities and by-products, the additional activities must

be authorized under the HOLA, either expressly or as an incidental

power.

2. What Precautions Must I Take? (Proposed Sec. 545.144, Final

Sec. 555.210)

Although OTS believes that it is vital that Federal savings

associations establish appropriate internal controls for risks and

security measures when they engage in electronic operations, it did not

propose to codify static risk or security requirements. Because methods

of electronic commerce and their attendant security measures are

continually evolving, OTS's proposed rule reflected the view that it is

impracticable to prescribe security measures that would remain useful

for the indefinite future.

Instead, proposed Sec. 545.144 would have required a Federal

savings association to adopt standards and policies designed to ensure

secure operations. In addition, the proposed rule would have required a

Federal savings association to implement security measures adequate to

prevent unauthorized access to its records and its customers' records,

and to prevent financial fraud through the use of electronic means or

facilities. The proposed rule also stated that a Federal savings

association must comply with the current security devices requirements

of part 568, if it provides an ATM, an automated loan machine, or

another similar electronic device.

One Federal savings association noted that the banking industry has

not yet embraced any particular standards with respect to encryption,

authentication, digital signatures, and other technical matters

affecting transmission over the Internet. Accordingly, the commenter

urged OTS to avoid imposing unnecessary regulatory impediments or

micro-managing system implementation or maintenance. While the

commenter was not critical of proposed Sec. 545.144, the commenter

criticized OTS's imposition of certain security-related conditions on

approvals of recent applications, such as requiring an applicant to

have its delivery of services over the Internet tested and reviewed by

independent computer security specialists before commencing operation.

The commenter urged OTS to reconsider whether there is a need to impose

such conditions.

In approving applications to commence operations, OTS requires

proof that adequate security measures are in place for safe, sound, and

secure operations. To date, these requirements routinely have included

testing and review by independent computer security specialists. OTS

tailors specific conditions on a case-by-case basis. It may be possible

that future applications may not raise these security concerns.

However, currently OTS believes such a condition in application

approval orders remains essential to safe and sound internal

operations. Similarly, under the notice procedures in subpart B to part

555 of this final rule (including the 30-day advance notice

requirement), OTS will have an opportunity to consider, before any

savings association establishes a transactional web site, whether the

savings association will be able to conduct such operations in a safe,

sound, secure, and compliant manner.

In the preamble to the proposed rule, OTS indicated that it

``expects Federal savings associations to establish security measures

that are consistent with current industry standards, and to continually

monitor and regularly update these security procedures to keep pace

with changes to industry standards.'' 25 One trade

association urged OTS to incorporate this statement in the final rule.

---------------------------------------------------------------------------

\25\ 62 FR at 51819.

---------------------------------------------------------------------------

OTS believes that such interpretive statements are best contained

in OTS policy statements, advisories, and other explanatory materials,

rather than the regulation. For similar reasons, OTS has deleted from

the final rule the proposed statement indicating that Federal savings

associations should adopt standards and policies on security issues.

Instead, the rule requires Federal savings associations to implement

security measures designed to ensure secure operations.

Another trade association urged OTS to provide guidelines alerting

Federal savings associations to security issues that should be

addressed before a new electronic delivery mechanism is implemented. As

summarized in Section II above, OTS has issued such guidelines and

advisories to Federal savings associations, both on its own and as part

of FFIEC.

OTS has made clarifying revisions to the section. These revisions

require that the management of Federal savings associations identify,

assess, and mitigate potential risks and establish prudent internal

controls, in addition to implementing security measures that are

designed to ensure secure operations.26 These risks may be

strategic, legal, regulatory, or operational.27

---------------------------------------------------------------------------

\26\ Further guidance on these requirements is provided in

Appendix A to Part 570, section 341 of the Thrift Activities

Regulatory Handbook, and Statement on Retail On-Line Personal

Computer Banking.

\27\ See Statement on Retail On-Line Personal Computer Banking.

---------------------------------------------------------------------------

C. Requirements Applicable to All Savings Associations

1. Must I Inform OTS Before I Use Electronic Means or Facilities?

(Sec. 555.300)

Proposed Sec. 555.300(a) of the Supplemental NPR sets forth the

general rule that a savings association does not have to inform OTS

before it uses electronic means and facilities. However, two exceptions

apply. First, proposed Sec. 555.300(b) would require a savings

association to file a written notice with OTS before it establishes a

transactional web site. Second, proposed Sec. 555.300(c) would provide

that if the OTS Regional Office has informed a savings association of

any supervisory or compliance concerns that may affect the savings

association's use of electronic means or facilities, the savings

association must follow any additional procedures the Regional Office

has imposed in writing. Proposed Sec. 555.300(a) also would encourage

savings associations to consult with OTS even in circumstances not

covered by the notice requirement or other procedures in

Sec. 555.300(b) or (c).

[[Page 65678]]

Four commenters indicated that the proposed notice requirement

would help OTS to monitor adequately savings associations'

technological innovations and to assess security, compliance, and

privacy risks. Some commenters, however, expressed concerns.

Four commenters argued that the notice requirement would place

savings associations at a competitive disadvantage, since other banking

regulators do not impose a similar notice requirement. OTS does not

anticipate that the notification requirement will place savings

associations at a significant competitive disadvantage. As discussed

below, in general, once an association has addressed any follow-up

questions from the Regional Office and the 30-day period has expired,

the association will be free to bring its transactional web site on-

line. No affirmative authorization from OTS is necessary except where

the Regional Office may otherwise indicate.

While providing this information will impose a minimal burden on

savings associations, the process will allow individual associations,

and the industry as a whole, to reap important benefits. The notice

will make it easier for OTS to obtain information on the industry's use

of transactional web sites. As a result, OTS will be better able to

assist associations that are contemplating or already conducting

Internet operations to identify and address the risks that accompany

such activities. The information will also broaden OTS's awareness of

trends in Internet banking operations, which OTS can share with

institutions. It will also efficiently allow OTS to keep abreast of

significant changes in the way particular savings associations interact

with their existing or potential customers to enable OTS to issue

appropriate guidance. Finally, the procedure responds to the concern

raised by the commenter on the NPR who indicated that OTS should be

vigilant about new electronic operations raising safety and soundness

concerns, since the procedure will assist OTS to supervise effectively

the electronic operations of savings associations.28

---------------------------------------------------------------------------

\28\ A September 30, 1998 report prepared, at OTS's request, by

the Office of Inspector General (OIG), United States Department of

the Treasury, made several suggestions. Among these were that OTS:

(1) develop a complete list of savings associations providing on-

line and Internet banking services; (2) enhance monitoring of

savings associations' web sites for compliance with federal

disclosure regulations and laws, and (3) begin to focus more on the

operational risks presented by on-line and Internet banking. The OIG

recommended these steps to help OTS determine risks, plan strategic

examination coverage, identify staff development needs, and foster

examination uniformity and consistency. See Office of Inspector

General, U.S. Dep't of the Treasury, Consultative Report on the

Office of Thrift Supervision Examination of On-Line and Internet

Banking Risks, (OIG-CA-98-003, 1998).

---------------------------------------------------------------------------

One commenter asserted that transactions conducted over the

Internet pose no more risk than transactions performed using other

technologies for which no prior notice is required. This commenter also

asserted that the notice was unnecessary since the industry already

fully understands the risks associated with the Internet.

OTS does not agree that transactions conducted over the Internet

pose no more risk than transactions performed through other more

established technologies.29 While it is true that risks are

inherent in all electronic capabilities, the use of an electronic

channel such as the Internet to deliver products and services

introduces unique risks due to the increased speed at which systems

operate, user anonymity, and broad access in terms of geography, user

groups, applications, databases, and peripheral systems.

---------------------------------------------------------------------------

\29\ See 63 FR at 43328.

---------------------------------------------------------------------------

As explained in the preamble to the Supplemental NPR, OTS has been,

and continues to be, concerned with the adequacy of firewalls to

prevent hackers from breaking into an association's computer systems

and thereby jeopardizing the association's security.30 OTS

is also concerned about other operational and compliance risks

presented by Internet banking and intends to increase its monitoring of

web sites for compliance with disclosure laws and

regulations.31 Additionally, OTS is concerned about

protecting the privacy of individuals submitting information (or about

whom information has been submitted).32

---------------------------------------------------------------------------

\30\ Id.

\31\ As noted in the preamble to the Supplemental NPR, OTS is

aware that advertising and disclosure problems may apply equally to

transactional and informational web sites. OTS believes, however,

that the need for advance notice is greater where such concerns are

combined with the other compliance, security, and privacy issues

related to transactional web sites. To minimize regulatory burden,

OTS is limiting the advance notice requirement to transactional web

sites. However, OTS will continue to examine both types of web sites

for operational and compliance problems. See 63 FR at 43329 n. 11.

\32\ 63 FR at 43328.

---------------------------------------------------------------------------

Even traditional risks that are similar to those in customary

banking activities must be considered in a new light. For example, if

an association conducts lending or deposit gathering activities over an

electronic channel, credit risks must be considered in the context of

the high-speed, wide-access electronic environment. The collection of

baseline information on transactional web sites is an important and

integral part of OTS efforts to enhance its supervision of Internet

banking activities.

Another commenter noted that the costs of developing a web site are

substantial and would be incurred before the savings association files

the notice. Consistent with Sec. 555.300(a), OTS encourages

associations concerned about expending resources to develop a

transactional web site to consult with their Regional Office in the

early stages of development, even before filing a notice.

In lieu of the notice requirement, several commenters urged OTS to

continue to rely on existing supervisory guidance, examination

oversight, and application processes to ensure that Internet activities

are conducted in a safe, sound, secure, and compliant manner. One

commenter encouraged OTS to address transactional web sites in the

Statement on Retail On-Line Personal Computer Banking and in additional

questions in the Pre-Examination Response Kit. Another commenter

suggested that the additional guidance should address such issues as

development costs, security and privacy issues, and compliance matters.

OTS has provided and will continue to provide important guidance to

the industry. OTS has addressed development costs, security, privacy,

and compliance matters in its Statement on Retail On-Line Personal

Computer Banking and in section 341 of the Thrift Activities Regulatory

Handbook. OTS will update and supplement this guidance as necessary.

However, this guidance is not a substitute for OTS's obtaining

information necessary for proper supervision.

OTS proposed to define a transactional web site as ``an Internet

site that enables users to conduct financial transactions such as

accessing an account, obtaining an account balance, transferring funds,

processing bill payments, opening an account, applying for or obtaining

a loan, or purchasing other products or services.'' 33 Four

commenters supported OTS's proposed definition. Two commenters

indicated that the Supplemental NPR adequately distinguished between

transactional and informational web sites.

---------------------------------------------------------------------------

\33\ 63 FR at 43330 (proposed Sec. 555.300(b)).

---------------------------------------------------------------------------

In light of the generally favorable comments, OTS does not believe

significant changes to the definition are necessary. However, OTS is

making one clarifying change to the definition of transactional web

site in response to a comment. The commenter recommended clarifying the

meaning of the phrase ``purchasing other products

[[Page 65679]]

or services'' used in the definition. The final rule clarifies that the

phrase refers to any authorized products or services.

Another commenter asked OTS whether a new notice would be required

when the type and level of activities conducted on a transactional web

site are increased or substantially modified. A new notice will not be

required in such circumstances. Once the savings association alerts OTS

about its transactional web site, the agency will be able to monitor

and examine the web site without a need for subsequent notices when

changes are made.34

---------------------------------------------------------------------------

\34\ However, as noted in the preamble to the Supplemental NPR,

before a savings association may change an informational web site to

a transactional web site, the savings association must file a notice

with OTS. 63 FR at 43329 n. 9.

---------------------------------------------------------------------------

Other commenters, however, suggested further revisions or

clarifications that OTS believes would be too limiting. One commenter

indicated that the covered web sites should be those that transact

business equivalent to a branch through which money passes. Another

argued that a web site is not transactional if an applicant may only

complete and return a loan application electronically, but would be

transactional if the web site also permits the application to be

processed through an automated credit scoring system and is used to

notify the customer of an approval or denial.

OTS does not agree that transactional web sites subject to the

notice requirement should be limited to those that are used for

monetary transactions or are used to notify the customer of an

application approval or denial. The same concerns about providing a

secure environment apply where confidential information is exchanged in

other circumstances that are transactional, but do not necessarily

constitute a monetary transaction or notification on an application.

However, it is appropriate to clarify a related matter. OTS will

not consider a web site to be transactional simply because it allows

the sending of e-mail messages. For an association simply to include an

e-mail address on its web site does not necessarily invite the public

to attempt to conduct transactions with the association over the

Internet or to submit confidential information. For example, the public

may use the e-mail address for a variety of tasks (e.g., inquiring

about products or services offered, requesting that a customer service

representative call, or asking that forms or information be mailed). In

contrast, a web site that provides an electronic application form for

transmission to the association by e-mail would be considered

transactional. Such an application, by its nature, is designed to

conduct a transaction and will likely actively elicit the submission of

confidential information to the association over the Internet through

the questions contained in the application.

One commenter recommended that OTS define an ``informational web

site.'' OTS does not believe that a separate definition of this term is

necessary. As noted in the preamble to the Supplemental NPR, an

informational web site is a non-transactional web site, such as one

limited to advertising and fee and rate posting.35

---------------------------------------------------------------------------

\35\ 63 FR at 43329.

---------------------------------------------------------------------------

Six commenters opposed a notice requirement for electronic

activities other than a transactional web site. Three commenters

explained that OTS already has sufficient authority to examine any

activity that raises safety and soundness concerns.

OTS is not requiring a notice under Sec. 555.300(b) for any

activities using electronic means or facilities other than

transactional web sites. For example, a savings association would not

be required to notify OTS before it establishes an informational web

site.36 As with other activities, OTS will continue to rely

on its existing supervisory examinations and application processes to

ensure the savings association's ability to engage in new activities in

a safe, sound, secure, and compliant manner.37

---------------------------------------------------------------------------

\36\ However, OTS has implemented a change to the Thrift

Financial Report (TFR). The electronic filing software now collects

information on all savings associations' Internet web site

addresses. This change was effective for the third quarter 1998 TFR.

\37\ OTS reviews the safety and soundness of new activities, the

appropriateness of the internal controls and security precautions,

and compliance with applicable laws and regulations on a case-by-

case and institution-by-institution basis in connection with

applications and through the examination process. For institutions

subject to an application process (e.g., de novo applications),

these initial safety and soundness and compliance determinations

will be made in the application review. After application approval

or where no application is required, safety and soundness and

compliance will generally be assessed as a part of the examination

process. This process will review and assess the institution's

identification of risks of the activity, the steps it has taken to

mitigate these risks, the testing it has undertaken to ensure safety

and soundness, and its compliance monitoring process.

---------------------------------------------------------------------------

As technologies emerge, OTS may revise the rule to require notice

of activities other than establishing a transactional web site.

Similarly, as technologies mature and the industry and OTS gain

additional experience, OTS may revise the rule to no longer require

notice before establishing a transactional web site.

OTS is also making an editorial change to Sec. 555.300(a). The

change clarifies that OTS encourages consultations with the Regional

Office regardless of whether the notice requirement in Sec. 555.300(b)

or the additional procedures in Sec. 555.300(c) apply.

2. How do I Notify OTS? (Sec. 555.310)

Proposed Sec. 555.310 of the Supplemental NPR described the advance

notice procedures. Proposed Sec. 555.310(a) would require a savings

association to provide a written notice to the appropriate Regional

Office at least 30 days before establishing a transactional web site.

Proposed Sec. 555.310(b) contained a transition provision applicable to

transactional web sites established after the date of the association's

last regular onsite OTS safety and soundness examination but before the

effective date of the rule.

Two commenters supported the 30-day advance notice period. Another

commenter argued that the 30-day notice period would be too long and

suggested a 10-day notice period. Another commenter urged OTS to permit

a savings association to apprise OTS within 30 days after establishing

a transactional web site. This notice would permit OTS to review the

web site in an examination.

OTS has decided to retain the 30-day advance notice procedure as

proposed. As discussed above, OTS does not anticipate this procedure

will be burdensome. Thirty days is an appropriate time period to allow

OTS to consider the notice and ask any follow-up questions that may be

necessary.

In the Supplemental NPR, OTS did not propose to prescribe any

particular form for the notice. Proposed Sec. 555.310(a) would simply

require that a savings association describe the transactional web site,

indicate the date the transactional web site will become operational,

and list a contact familiar with the deployment, operation, and

security of the transactional web site. The preamble to the

Supplemental NPR indicated that, upon receipt of the notice, the

Regional Office may require additional information to ensure that the

savings association will operate the transactional web site in a safe,

sound, secure, and compliant manner.38 The preamble further

indicated that OTS contemplated that the notice may be brief. It

contained sample language that read:

---------------------------------------------------------------------------

\38\ 63 FR at 43329.

[Name of savings association] plans to establish a transactional

web site on the Internet at [URL]. It will be operational on [Date].

The site will contain mortgage loan applications that can be

transmitted securely

[[Page 65680]]

to our loan processing office. For further information contact:

[Name at telephone number, e-mail].39

---------------------------------------------------------------------------

\39\Id.

Four commenters stated that OTS should not require any information

in the notice beyond that described in the Supplemental NPR. One

commenter specifically endorsed OTS's sample statement in the preamble

as sufficient. One commenter, however, recommended that institutions

describe how they will conduct the activity, the type of security they

will use, the internal controls they will follow, and the program they

will follow to ensure compliance with all applicable laws and

regulations. Another commenter observed that an overview of controls

and safeguards designed to preserve privacy and security and protect

against financial fraud would be sufficient. 40

One commenter suggested that if OTS discovers that new information is

necessary following this rulemaking, it should require this information

in guidance, rather than in a revised rule.

---------------------------------------------------------------------------

\40\ One commenter, however, noted that security information may

be difficult to obtain when the web site is maintained by a service

bureau. This commenter noted that service bureaus often claim that

the release of such information will compromise their systems.

---------------------------------------------------------------------------

OTS is adopting the requirements concerning the contents of the

notice as proposed. It believes these requirements will provide

sufficient information to the Regional Offices without being burdensome

or inflexible. The guidance contained in the preamble to the

Supplemental NPR, including the sample language set forth above,

remains valid.

Several commenters sought clarification of the review procedures.

One commenter sought assurance that the notice process was

informational only. Two commenters sought clarification whether OTS

would approve or disapprove notices (e.g., where there are supervisory

or compliance concerns). One noted that if prior OTS approval is

required, the notice process would impose substantial financial,

strategic, and compliance risks on institutions. Another commenter

urged OTS to review all notices within the notice period and quickly

act to prevent a savings association from establishing a transactional

web site that could threaten its safety and soundness.

The procedure will work as follows: The savings association will

file a written notice with the Regional Office. The Regional Office

will review the notice and may ask follow-up questions. In general,

once an association has addressed those follow-up questions from the

Regional Office and the 30-day period has expired, the association will

be free to bring its transactional web site on-line. No affirmative

authorization from OTS is necessary except where the Regional Office

may otherwise indicate. If, however, by the end of the 30-day period,

the Regional Office informs the association that there are supervisory

or compliance concerns that may affect the association's establishment

of a transactional web site, the association must follow any procedures

that the Regional Office imposes in writing. The procedures the

Regional Office may impose could include, for example, requiring

further information to be submitted or precautions to be taken before

the savings association may establish the transactional web site,

limiting in some fashion the ways in which the association may use the

transactional web site, or prohibiting the association from

establishing a transactional web site.

One commenter opposing notice procedures observed that the advance

notice only made sense if the Regional Office would review the notice

before the roll-out of the web site. This commenter, however, predicted

that OTS Regional Offices may apply inconsistent standards and that

this inconsistency could be problematic since web sites provide

services nationwide. The commenter suggested that the final rule should

require the Regional Office to notify the thrift of any conditions it

would impose on web site operations. OTS will issue industry guidance

to help a savings association deploy a transactional web site in a

safe, sound, secure, and compliant manner. OTS will also issue uniform

guidance to its Regional Offices to verify that transactional web sites

are in compliance with the industry guidance and this regulation and

that savings associations have established an adequate infrastructure

for operating safe, sound, secure, and compliant transactional web

sites.

One commenter urged OTS to require public notice and comment before

a savings association may establish a transactional web site. This

commenter indicated that, in some states, financial institutions must

provide public notice and comment before opening a deposit-collecting

branch or deposit-taking ATM.

OTS does not believe it is appropriate to require a public comment

procedure. Moreover, OTS posts notices on its web site upon filing. The

same policy will apply to notices for transactional web sites. This

procedure will provide adequate information to the public.

IV. Other Rule Provisions

A. Conforming Amendment to Branch Offices Regulation

The proposed rule would revise OTS's branch office regulation to

clarify that electronic facilities (such as automated loan machines)

are not branch offices. Three commenters specifically supported this

section, although two requested clarifications. One Federal savings

association argued that the final rule should indicate that all

electronic facilities and the Internet are excluded from the definition

of ``branch office.'' The proposed rule would have excluded an

``electronic facility'' from the definition of ``branch office,'' but

did not indicate that an ``electronic means'' was also excluded.

For consistency in terminology, the final rule has been revised to

exclude all ``electronic means or facilities'' from the definition of

``branch office.'' Under Sec. 555.200(a), the Internet continues to be

an electronic means or facility and is not considered to be a branch.

Another Federal savings association asked whether a ``hybrid

office'' would be treated as a branch office. This commenter defined a

hybrid office as an office in which a Federal savings association

conducts the majority of its operations electronically, but conducts

some functions in person by appointment. The type of office the

commenter has described may be either a branch office \41\ or an agency

\42\ depending upon the types of services provided. A Federal savings

association may request an OTS opinion if it requires further guidance

on this topic.\43\

---------------------------------------------------------------------------

\41\ 12 CFR 545.92 (1998).

\42\ 12 CFR 545.96 (1998).

\43\ OTS will shortly undertake another rulemaking to clarify

the regulations governing various types of offices.

---------------------------------------------------------------------------

B. Conforming Amendment to Subordinate Organizations Rule

The Examination Parity and Year 2000 Readiness for Financial

Institutions Act, discussed above, applies to Federal and State savings

associations and provides OTS with the authority to examine service

corporations. Accordingly, OTS is conforming the service corporation

examination provision of its Subordinate Organizations regulation, 12

CFR 559.3(o)(2), to reflect this authority.

V. Other Issues Raised by Commenters

A. Preemption

One Federal savings association commenting on both the NPR and the

[[Page 65681]]

Supplemental NPR urged OTS to add specific preemption provisions

stating that OTS's electronic operations regulations preempt state laws

purporting to restrict or govern the electronic operations of federal

savings associations. The commenter noted that various states have

enacted such laws. The commenter argued that preemption would encourage

Federal savings associations to participate in various electronic

banking activities, facilitate the development of best industry

practices, and prevent the development of a patchwork of conflicting

state and local rules.

Electronic operations and related state and federal laws are still

evolving. Thus, OTS believes it is premature to craft specific

preemption regulations in the area of electronic operations. OTS

intends to address specific state laws on a case-by-case basis as they

are raised to the agency.

The commenter may have raised this matter, in part, because the

electronic operations provisions will not be placed in part 545, but

rather in a new part 555. Part 545 currently contains regulations

pertaining to electronic operations \44\ and also contains a general

provision preempting state laws affecting ``Operations.'' \45\ However,

the movement of the electronic operation provisions to a new part 555

does not indicate a substantive change. OTS will apply principles of

preemption consistently with its prior interpretations of OTS's

authority under the HOLA.\46\ Accordingly, the regulations in subpart A

to part 555 will have preemptive effect where appropriate to: (1)

facilitate the safe and sound operations of a Federal savings

association, (2) enable a Federal savings association to operate

according to the best thrift institution practices in the United

States, or (3) further other purposes of the HOLA.\47\

---------------------------------------------------------------------------

\44\ 12 CFR 545.138, 545.141, and 545.142 (1998).

\45\ 12 CFR 545.2 (1998).

\46\ See 12 CFR 545.2 (Operations), 557.11-557.13 (Deposits),

and 560.2 (Lending and Investment) (1998).

\47\ Accord 12 CFR 557.11(a) and 560.2(a) (1998).

---------------------------------------------------------------------------

When evaluating preemption of a state law, OTS will focus first on

the underlying activity affected by the state law. For example, if a

state law affects a Federal savings association's ability to take

deposits or lend using electronic means and facilities, OTS will apply

the part 557 or part 560 preemption analysis for deposit or lending

activities, respectively. OTS will evaluate other activities that may

be conducted electronically, on a case-by-case basis.

While OTS intends to give Federal savings associations maximum

flexibility to operate electronically according to a uniform federal

scheme of regulation, OTS has recognized that some types of state laws,

under certain circumstances, generally will not be preempted.\48\

Consistent with this approach, OTS will determine that a state law

regulating electronic operations is not preempted if it furthers a

vital state interest, and either has only an incidental effect on

Federal savings associations' ability to provide financial services

electronically or is not otherwise contrary to the purposes of OTS's

rule.

---------------------------------------------------------------------------

\48\ See 12 CFR 557.13 and 560.2(c) (1998).

---------------------------------------------------------------------------

B. Community Reinvestment Act

Several commenters on the NPR addressed the impact of emerging

electronic technologies on Community Reinvestment Act (CRA)

requirements. The comments generally argued that the current CRA

requirements do not: (1) provide adequate recognition of loans,

investments and services generated outside of a Federal savings

association's traditional assessment area (i.e. the area surrounding

its branch network), or (2) permit Federal savings associations with

Internet operations to define their CRA assessment areas more broadly

than the branch network concept allows. Some commenters offered options

intended to address these types of concerns. These included allowing

Federal savings associations that engage in alternate delivery systems

to be treated as limited purpose institutions or to define an

assessment area in a manner that is tied to the customer base rather

than a particular geography. One commenter on the Supplemental NPR

expressed concern that financial institutions may use web sites to

conduct business nationwide, but would be required to include only

certain geographical areas in their CRA assessment areas.

Currently, OTS is working on an interagency basis to resolve these

concerns and other CRA issues arising from the use of alternative

methods of delivering financial products and services. The interagency

effort involves revisiting the definition of an assessment area for

institutions that use alternative delivery systems. Until this

interagency effort is completed, OTS intends to allow the new

electronic technologies to develop within the existing CRA regulatory

framework. Specific CRA issues that arise in connection with an

application will continue to be handled on a case-by-case basis in an

effort to adapt existing laws to modern technologies and innovations.

49 An institution, of course, always has the option of

taking advantage of the flexibility in the existing CRA regulation by

developing and seeking approval of a strategic plan that would link CRA

performance to its particular business strategy. 50

---------------------------------------------------------------------------

\49\ While not specifically involving electronic operations, the

1997 application from the Travelers Group is illustrative of an

institution's efforts to develop a new approach on CRA. The

Travelers Group filed an application to convert a state-chartered

bank to a Federal savings association charter. The converted Federal

savings association was to engage in consumer lending and trust

services nationwide. In its application, Travelers stated that its

CRA obligation extended throughout all the communities where it does

business and made an initial pledge to make at least $430 million of

home equity loans to low- and moderate-income borrowers over three

years. OTS approved Travelers' application. See Order No. 97-120

(November 24, 1997).

\50\ See 12 CFR 563e.27 (1998).

---------------------------------------------------------------------------

C. Other Interagency Issues

Both trade association commenters on the NPR urged OTS, other

Federal bank regulators, and the Treasury Department to coordinate

their activities to ensure the development of consistent approaches to

electronic operations issues, to minimize regulatory burdens, and to

avoid potential conflicts. One commenter on the Supplemental NPR

indicated it would only support the notice requirement for

transactional web sites if all banking regulators imposed the same

requirement on their regulated institutions.

As OTS issues rules and guidance on electronic operations, it

continually strives for consistency with other Federal banking

regulators. Accordingly, OTS will continue to participate in all

interagency efforts to establish consistent regulatory approaches to

electronic operations issues.

One Federal savings association noted that when the Federal banking

agencies and the Department of Justice review a merger or acquisition

for its impact on competition, the analysis focuses on the relevant

product and geographic markets. These concepts generally require an

analysis of deposits taken, loans made, and services provided in the

geographic areas served by the combining institutions. The commenter

urged the Federal banking agencies to view Internet banking activities

as outside the scope of the traditional antitrust analysis and

recognize that current technology gives Federal savings associations

and banks the ability to conduct business with customers all over the

country.

The entry of financial institutions into electronic operations

raises a host of new issues. OTS has attempted through

[[Page 65682]]

this rulemaking and guidelines to address issues that have arisen. To

date, the antitrust issue cited by the commenter has not been a

critical issue in an application. Currently, financial business through

electronic operations constitutes a very small portion of financial

services offered by Federal savings associations. OTS will consider

providing guidance on this issue and other issues in the future should

they emerge as prominent issues.

VI. Executive Order 12866

The Director of OTS has determined that this final rule does not

constitute a ``significant regulatory action'' for the purposes of

Executive Order 12866.

VII. Paperwork Reduction Act of 1995

The collection of information requirements in this rule have been

submitted to and approved by the Office of Management and Budget in

accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d))

under OMB control number 1550-0095.

Comments on all aspects of this information collection should be

sent to the Office of Management and Budget, Paperwork Reduction

Project (1550-0095), Washington, DC 20503, with copies to the

Regulations and Legislation Division, Chief Counsel's Office, Office of

Thrift Supervision, 1700 G Street, NW., Washington, DC 20552.

Under the Paperwork Reduction Act of 1995, no persons are required

to respond to a collection of information unless it displays a

currently valid OMB control number. The valid OMB control number

assigned to the collection of information in this final rule is

displayed at 12 CFR 506.1.

The collection of information requirements are found in 12 CFR

555.300 and 555.310. OTS requires this information for the proper

supervision of electronic operations by savings associations. The

likely respondents/recordkeepers are savings associations.

VIII. Regulatory Flexibility Act Analysis

Pursuant to section 605(b) of the Regulatory Flexibility Act, OTS

certifies that this regulation will not have a significant impact on a

substantial number of small entities. This final rule should make it

easier for Federal savings associations, including small institutions,

to engage in electronic operations. While it imposes a notice

requirement on savings associations using one particular type of

electronic means or facility (i.e., a transactional web site) and

allows Regional Offices to impose case-by-case restrictions for

supervisory or compliance reasons, these requirements are the minimum

necessary for proper supervision and should not have a significant

impact on a substantial number of small institutions.

IX. Unfunded Mandates Act of 1995

Section 202 of the Unfunded Mandates Reform Act of 1995, Pub. L.

104-4 (Unfunded Mandates Act), requires that an agency prepare a

budgetary impact statement before promulgating a rule that includes a

Federal mandate that may result in expenditure by state, local, and

tribal governments, in the aggregate, or by the private sector, of $100

million or more in any one year. If a budgetary impact statement is

required, section 205 of the Unfunded Mandates Act also requires an

agency to identify and consider a reasonable number of regulatory

alternatives before promulgating a rule. OTS has determined that the

rule will not result in expenditures by state, local, or tribal

governments or by the private sector of $100 million or more.

Accordingly, this rulemaking is not subject to section 202 of the

Unfunded Mandates Act.

List of Subjects

12 CFR Part 545

Accounting, Consumer protection, Credit, Electronic funds

transfers, Investments, Reporting and recordkeeping requirements,

Savings associations.

12 CFR Part 555

Accounting, Consumer protection, Credit, Electronic funds

transfers, Investments, Reporting and recordkeeping requirements,

Savings associations.

12 CFR Part 559

Reporting and recordkeeping requirements, Savings associations,

Securities.

Accordingly, the Office of Thrift Supervision amends chapter V,

title 12 of the Code of Federal Regulations as set forth below:

PART 545--OPERATIONS

1. The authority citation for part 545 continues to read as

follows:

Authority: 12 U.S.C. 1462a, 1463, 1464, 1828.

2. Section 545.92 is amended by revising paragraph (a) to read as

follows:

Sec. 545.92 Branch offices.

(a) General. A branch office of a Federal savings association is

any office other than its home office, agency office, administrative

office, data processing office, or an electronic means or facility

under part 555 of this chapter.

* * * * *

Secs. 545.138 through 545.142 [Removed]

3. Sections 545.138 through 545.142 are removed.

4. Part 555 is added to read as follows:

PART 555--ELECTRONIC OPERATIONS

Sec.

555.100 What does this part do?

Subpart A--Authority of Federal Savings Associations to Conduct

Electronic Operations

555.200 How may I use or participate with others to use electronic

means and facilities?

555.210 What precautions must I take?

Subpart B--Requirements Applicable to All Savings Associations

555.300 Must I inform OTS before I use electronic means or

facilities?

555.310 How do I notify OTS?

Authority: 12 U.S.C. 1462a, 1463, 1464.

Sec. 555.100 What does this part do?

Subpart A of this part describes how a Federal savings association

may provide products and services through electronic means and

facilities. Subpart B of this part contains requirements applicable to

all savings associations.

Subpart A--Authority of Federal Savings Associations to Conduct

Electronic Operations

Sec. 555.200 How may I use or participate with others to use

electronic means and facilities?

(a) General. A federal savings association (``you'') may use, or

participate with others to use, electronic means or facilities to

perform any function, or provide any product or service, as part of an

authorized activity. Electronic means or facilities include, but are

not limited to, automated teller machines, automated loan machines,

personal computers, the Internet, the World Wide Web, telephones, and

other similar electronic devices.

(b) Other. To optimize the use of your resources, you may market

and sell, or participate with others to market and sell, electronic

capacities and by-products to third-parties, if you acquired or

developed these capacities and by-products in good faith as part of

providing financial services.

Sec. 555.210 What precautions must I take?

If you use electronic means and facilities under this subpart, your

management must:

[[Page 65683]]

(a) Identify, assess, and mitigate potential risks and establish

prudent internal controls; and

(b) Implement security measures designed to ensure secure

operations. Such measures must be adequate to:

(1) Prevent unauthorized access to your records and your customers'

records;

(2) Prevent financial fraud through the use of electronic means or

facilities; and

(3) Comply with applicable security devices requirements of part

568 of this chapter.

Subpart B--Requirements Applicable to All Savings Associations

Sec. 555.300 Must I inform OTS before I use electronic means or

facilities?

(a) General. A savings association (``you'') are not required to

inform OTS before you use electronic means or facilities, except as

provided in paragraphs (b) and (c) of this section. However, OTS

encourages you to consult with your Regional Office before you engage

in any activities using electronic means or facilities.

(b) Activities requiring advance notice. You must file a written

notice as described in Sec. 555.310 before you establish a

transactional web site. A transactional web site is an Internet site

that enables users to conduct financial transactions such as accessing

an account, obtaining an account balance, transferring funds,

processing bill payments, opening an account, applying for or obtaining

a loan, or purchasing other authorized products or services.

(c) Other procedures. If the OTS Regional Office informs you of any

supervisory or compliance concerns that may affect your use of

electronic means or facilities, you must follow any procedures it

imposes in writing.

Sec. 555.310 How do I notify OTS?

(a) Notice requirement. You must file a written notice with the

appropriate Regional Office at least 30 days before you establish a

transactional web site. The notice must do three things:

(1) Describe the transactional web site.

(2) Indicate the date the transactional web site will become

operational.

(3) List a contact familiar with the deployment, operation, and

security of the transactional web site.

(b) Transition provision. If you established a transactional web

site after the date of your last regular onsite OTS safety and

soundness examination but before January 1, 1999, you must file a

notice describing your activity by February 1, 1999.

PART 559--SUBORDINATE ORGANIZATIONS

5. The authority citation for part 559 continues to read as

follows:

Authority: 12 U.S.C. 1462, 1462a, 1463, 1464, 1828.

6. Section 559.3 is amended by revising paragraph (o)(2) to read as

follows:

Sec. 559.3 What are the characteristics of, and what requirements

apply to, subordinate organizations of federal savings associations?

* * * * *

(o) * * *

(2) A service corporation is subject to examination by OTS.

* * * * *

Dated: November 20, 1998.

By the Office of Thrift Supervision.

Ellen Seidman,

Director.

[FR Doc. 98-31746 Filed 11-27-98; 8:45 am]

BILLING CODE 6720-01-P