National bank may provide hosting and design services for commercially enabled Websites and may provide software and web configurations that enable Internet merchants to acquire and compile information from their end clients that will be used for authentication and to support future transactions over the Website.

O

Comptroller of the Currency

Administrator of National Banks

Washington, DC 20219

Interpretive Letter #928

December 24, 2001 March 2002

12 USC 24(7)

Dear [ ]:

This responds to your letter of August 3, 2001, seeking, on behalf of the

[ ] (the “Bank”) an interpretive letter from the Office of the Comptroller of the

Currency (“OCC”) on the authority of national banks to offer certain electronic commerce and

security-related services to their wholesale and non-profit organization customers. For the

reasons set forth below, we find that the proposed activities are permissible for national banks.

Background

The Bank proposes to engage in several activities in association with its electronic payments

services. For merchants, government agencies, and non-profit service organizations that are

Bank customers (the “Customers”) with previously established web sites, the Bank will design

and host1 a web site and provide software2 enabling: 1) the Customers to process various forms

of payments electronically from their end clients; 2) Customers’ end clients to electronically

schedule and pay for events offered by a Customer organization; and 3) the Customer to acquire

and compile information3 from their end clients (“Client Information”) in connection with the

above described transactions to be used for authentication purposes and to facilitate future

interactions between the Customer and its end client. Also, in connection with these Internet-

related web-services, the Bank will consult with and advise its Customers on how the web site

1 The Bank will require that it host the portion of the page it develops.

2 The software will either be developed by the Bank or obtained from a third party

ture

interactions between the Customer and its end client. Also, in connection with these Internet-

related web-services, the Bank will consult with and advise its Customers on how the web site

1 The Bank will require that it host the portion of the page it develops.

2 The software will either be developed by the Bank or obtained from a third party.

3 The Client Information described in above, will consist of information such as the end client's name, mailing

address, shipping address, e-mail address, telephone number, preferred credit card numbers for billing purposes, and

other billing account information. The Client Information will primarily be used for authentication and security

purposes by the Bank on behalf of its Customer. However, from the end client’s perspective, the Client Information

will enable the Customer to provide a more convenient shopping service since the end client will not have to re-key

their information when they visit the Customer’s site again. The Client Information will also the enable Customer to

communicate more effectively with its end clients by sending out newsletters or communication to the end client’s

e-mail address acquired during the setup process.

- -

2

should be designed and operated so the web site hosted by the Bank and the related information

is secure from unauthorized access while on the Bank's premises, while in transit to and from the

Bank, and while in the Customer's possession. Finally, the Bank will also offer electronic bill

presentment and payment services for its merchant, government agency, and non-profit service

organization customers.

In addition, while the proposed activity will focus on the Bank’s Customers, the Bank will also

market the Group's Internet-related services to non-customers -- who may or may not have an

existing web site -- but who wish to have a payment related portion added to a new web site that

can accommodate the services described above

ant, government agency, and non-profit service

organization customers.

In addition, while the proposed activity will focus on the Bank’s Customers, the Bank will also

market the Group's Internet-related services to non-customers -- who may or may not have an

existing web site -- but who wish to have a payment related portion added to a new web site that

can accommodate the services described above. Any person who wishes to have a payment

portion of a web site designed must have a Bank account for settlement purposes -- thereby

becoming a Bank customer.

Customers that sign up for the services offered by the Bank will be charged various fees,

including a licensing or start-up fee when they initially sign up for the services offered by the

Bank, monthly maintenance and hosting fees, and/or transaction fees in connection with

processing payment transactions.

When the Bank builds and hosts the Customer’s web site, the Bank will do so in a manner that is

consistent with the appropriate levels of security and confidentiality risk control measures that

are consistent with the standards OCC adopted under 15 U.S.C. 6801(b) and codified in 12 CFR

Part 30, Appendix B (the Interagency Guidelines Establishing Standards for Safeguarding

Customer Information).

Bank is aware that the proposed activities will impose added risks to the Bank, including

transaction risk, legal risk, and reputation risk. Through a series of internal and external audits

of the Bank's technology, procedures and controls, the Bank has identified and reduced

operational risks that were identified by making the adjustments recommended in the audits.

The Bank plans to have regular internal and external audits of the activities. The staff that would

conduct the activities have worked closely with the Bank’s internal auditors on the Bank's

recently implemented Information Security Program, required under 12 CFR Part 30, so that the

Program incorporates the current and proposed activities discussed in this letter

ments recommended in the audits.

The Bank plans to have regular internal and external audits of the activities. The staff that would

conduct the activities have worked closely with the Bank’s internal auditors on the Bank's

recently implemented Information Security Program, required under 12 CFR Part 30, so that the

Program incorporates the current and proposed activities discussed in this letter. OCC has

recently completed an information technology review of the Bank that included the proposed

web-hosting activities and systems.

Discussion

The OCC has found that, as part of the business of banking and in association with electronic

payments services, national banks may provide merchant customers with services that will

enable the merchant to operate a commercially enabled web site.4 The processing of payments

4 In association with their electronic payments services, national banks may provide a “package” of Internet-based

services to retail merchants including: hosting web sites on the bank's own server; registering merchants with search

engines and obtaining Universal Resource Locators; providing an electronic communication pathway for product

ordering and payment; maintaining merchants' data associated with the web sites on its server (e.g., price

information, product descriptions, and images); providing merchants with software to create web sites; providing

g web sites on the bank's own server; registering merchants with search

engines and obtaining Universal Resource Locators; providing an electronic communication pathway for product

ordering and payment; maintaining merchants' data associated with the web sites on its server (e.g., price

information, product descriptions, and images); providing merchants with software to create web sites; providing

- -

3

resulting from orders received through a merchant's web site is also clearly part of the business

of banking.5 Merchant credit and debit card processing services generally involve verifying

credit card authorizations at the time of purchase, processing card transactions, settlement of card

transactions, and depositing funds into merchants’ accounts. The fact that the credit and debit

card and other electronic payment transactions would involve purchases of goods or services

over the Internet does not change the nature of the service that would be provided.6 Thus, the

Bank’s proposed payment processing and associated commercial web site hosting activities are

permissible.

OCC has found that the finder authority to host, develop, and support commercially enabled web

sites extends not only to merchants, but also to non-profit service entities such as government

agencies that provide goods and services to the public. OCC Conditional Approval No. 361

(March 3, 2000) (national bank may host web sites for government agencies that offer goods and

services to the public). We believe this rationale applies equally to private non-profit

organizations that provide goods and services to the public.7

Moreover, OCC has found that incidental to a payments processing service and associated

commercial web site hosting, a national bank may provide web design and development services.

reports on transactions, web site “hits,” and sales data; and processing credit card transactions. OCC Interpretive

Letter No. 856 reprinted in [1998-1999 Transfer Binder] Fed. Banking L. Rep

that incidental to a payments processing service and associated

commercial web site hosting, a national bank may provide web design and development services.

reports on transactions, web site “hits,” and sales data; and processing credit card transactions. OCC Interpretive

Letter No. 856 reprinted in [1998-1999 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-313 (March 5, 1999)

(providing or maintaining an Internet web site for merchants is one device that national banks may use as finders to

provide information to the merchants' customers).

5 OCC Corporate Decision No. 99-50 (Dec. 23, 1999) and OCC Corporate Decision No. 2000-08 (June 1, 2000)

(national bank may process for its merchant customers purchases made over the Internet); OCC Interpretive Letter

No. 856, supra. See also OCC Conditional Approval Letter No. 289 (Oct. 2, 1998) (national banks may acquire a

minority interest in a firm that, among other things, provides accounts receivable processing and accounts payable

processing); OCC Conditional Approval Letter No. 282 (July 7, 1998) (national bank may acquire an interest in a

firm that would, among other things, engage in payments processing for the health care firms); OCC Conditional

Approval Letter No. 248 (June 27, 1998) (national bank operating subsidiary may acquire a minority interest in an

entity that provides merchant credit and debit card processing services); and OCC Interpretive Letter No. 731

reprinted in [1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81,048 (July 1, 1996) (national banks as

part of the banking business may collect and process accounts relating to an electronic toll collection system).

6 Likewise, the fact that some of the Bank’s web sites will enable end clients to purchase rights to attend events,

rather than goods or conventional services, does not change the permissibility of the activity. OCC has found that

national banks can process orders and payments for event and attraction tickets

ess may collect and process accounts relating to an electronic toll collection system).

6 Likewise, the fact that some of the Bank’s web sites will enable end clients to purchase rights to attend events,

rather than goods or conventional services, does not change the permissibility of the activity. OCC has found that

national banks can process orders and payments for event and attraction tickets. See OCC Interpretive Letter No.

718 reprinted in [1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-033 (March 14, 1996). There is no

reason why the bank’s electronic finder authority should not include bringing together buyers and sellers of events,

which really are a form of services.

7 As we noted in a prior letter: “In the finder analysis, no distinction should be drawn between bringing together

with a government agency those who wish to purchase goods or services from that agency and those who wish to

consume goods or services from that agency. The latter, most likely individuals seeking forms, benefits, or other

information from the agency, are not “buyers” in the traditional sense; however, as taxpayers, they are essentially

buying information or other goods or services for which their taxes have paid. As such, they qualify as legitimate

subjects for finder activities by national banks. See Corporate Decision No. 98-13 (Feb. 9, 1998) (national bank

operating subsidiary, acting as finder, could bring together individuals who wished to enroll in government-

sponsored health insurance program with appropriate government agency).” Id. at p. 7.

er goods or services for which their taxes have paid. As such, they qualify as legitimate

subjects for finder activities by national banks. See Corporate Decision No. 98-13 (Feb. 9, 1998) (national bank

operating subsidiary, acting as finder, could bring together individuals who wished to enroll in government-

sponsored health insurance program with appropriate government agency).” Id. at p. 7.

- -

4

The ability to build the web sites for the participating merchants as part of a commercial Internet

services package is critical to the successful marketing of the package.8 To enhance

marketability and reduce costs to merchants, the firms that will compete with the Bank in

providing Internet commerce products and services are now offering complete packages to

merchants, which include the building of the web sites. See e.g., Bloom, supra; Steven

Marjanovic, First Data to Buy Stake in iMall, a Software Firm, American Banker, Nov. 9, 1998,

at 17; Tami Luhby, Wells Fargo Opens Door to Web for Small Business, American Banker,

Sept. 15, 1998.9

OCC has long held that, under their incidental powers, national banks may sell non-banking

products and services when reasonably necessary to provide banking products on a competitive

basis by creating a package of related services needed to satisfy consumer demand, meet market

competition, and enable the Bank to successfully market its banking services. Thus, for

example, in OCC Interpretive Letter No. 742, OCC found offering of Internet access service was

needed to successfully provide and market the Bank's Internet banking service. We found

limiting the Bank's Internet access services, to block non-banking use, would not meet customer

needs or the competing products in the marketplace. See also, OCC Interpretive Letter No. 611,

supra, (bank selling home banking service can also provide customer access to non-banking

services “to increase the customer base and the usage of the program”); OCC Interpretive Letter

No. 653, reprinted in [1994-1995 Transfer Binder] Fed

cess services, to block non-banking use, would not meet customer

needs or the competing products in the marketplace. See also, OCC Interpretive Letter No. 611,

supra, (bank selling home banking service can also provide customer access to non-banking

services “to increase the customer base and the usage of the program”); OCC Interpretive Letter

No. 653, reprinted in [1994-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 83,601

(December 22, 1994) (national banks may offer non-banking products as part of larger product

or service when necessary, convenient and useful to bank permissible activities). Cf., National

Courier Ass’n v. Board of Governors, 516 F. 2d 1229, 1240 (D.C. Cir. 1975) (incidental powers

of holding companies to provide specialized courier services when service necessary to obtain

full benefit of data processing services).

For this reason, the proposed building of web sites by the Bank for those merchants desiring that

service is incidental to the business of banking. Corporate Decision No. 2000-08, supra and

OCC Interpretive Letter No. 875 reprinted in [1999-2000 Transfer Binder] Fed. Banking L. Rep.

(CCH) ¶ 81-369 (October 31, 1999). See also OCC Interpretive Letters No. 856, supra (national

bank engaged in permissible web site hosting activity may provide merchants with software that

will enable them to design and modify their web sites).

As noted above, one of the features the Bank proposes to provide for merchants in the designed

and hosted web sites would enable the merchant Customer to acquire and compile information

from their end clients that would be used primarily for authentication and security purposes and

to facilitate additional transactions when the end client returns to the web site to conduct

additional business. This “one-click” shopping information concept is becoming increasingly

8 See J

le the merchant Customer to acquire and compile information

from their end clients that would be used primarily for authentication and security purposes and

to facilitate additional transactions when the end client returns to the web site to conduct

additional business. This “one-click” shopping information concept is becoming increasingly

8 See J. Bloom, Vendor Groups Woo Banks into Net Services, American Banker, May 27, 1999, at 14 (reporting that

vice president of the National Retail Federation says merchants of all sizes prefer to outsource the building of virtual

stores).

9 Experts say that without these packages, most smaller companies lack the budget and manpower to do a thorough

job of creating and maintaining a commerce-enabled web site. Bloom, supra.

- -

5

prevalent in electronic commerce. Major firms such as AOL Time Warner, Inc. and Microsoft

are currently developing systems that will allow people to store personal information (such as

names, addresses, and credit card numbers) online to simplify their purchasing transactions on

the Internet. A. Klein and A. Cha, “AOL May Launch an Internet ID Service,” Washington

Post, July 27 2001, p. E-1. Similarly, a number of significant electronic merchants and payment

processors have developed and are refining an “electronic wallet” which performs much the

same function by enabling customers to store identifying, shipping, and payment-related

information so that the customer does not need to re-key the information the next time they

submit an order. See M. Barnett, “It's the Year of the E-wallet,” The Industry Standard, June 30,

1999, viewed July 27, 2001 http://www.cnn.com/tech/computing/9907/01/ewallet.idg/; M. Zane,

“NextCard to Offer E-wallet,” ZDNN, October 18, 1999, viewed July 27, 2001 at

http://www.zdnet.com/printerfriendly/0,6061,2374202-2,00.html; Bloom and J. Kutler, “Web

Wallet Marketers Struggle for Definition and Acceptance,” The American Banker, November 4,

1999; and J

et,” The Industry Standard, June 30,

1999, viewed July 27, 2001 http://www.cnn.com/tech/computing/9907/01/ewallet.idg/; M. Zane,

“NextCard to Offer E-wallet,” ZDNN, October 18, 1999, viewed July 27, 2001 at

http://www.zdnet.com/printerfriendly/0,6061,2374202-2,00.html; Bloom and J. Kutler, “Web

Wallet Marketers Struggle for Definition and Acceptance,” The American Banker, November 4,

1999; and J. Capachin, “Digital Wallets: Their Potential Exceeds Their Performance,”

American Banker, August 17, 2001.

The Bank may permissibly offer this “one-click” shopping information service to Customers of

its commercial web site services for two reasons. First, the service is incidental to the electronic

payments processing service provided by the Bank in that it enhances the convenience of the

service for both the merchants and their end clients. OCC has held, in Interpretive Letter No.

868 reprinted in [1999-2000 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-263 (August 16,

1999), that a national bank can hold a minority interest in a company that designs and distributes

software that performs the same “one-click” shopping function. That letter concludes that the

“one-click” shopping software was permissible because it “will facilitate the electronic transfer

of funds from consumers to businesses and financial institutions” and thus performed “activities

commonly undertaken by banks directly for themselves, other financial institutions, or as part of

servicing customers.”

Second, processing of the retail based information relating to identity, shipping information, and

payment information with respect to end clients and their transactions for merchant Customers is

permissible because it involves the processing of banking, financial, and economic data. Case

authority supports this conclusion. In Ass’n of Data Processing v. Board of Governors, 745 F.2d

677 (D.C. Cir. 1984), the D.C

g of the retail based information relating to identity, shipping information, and

payment information with respect to end clients and their transactions for merchant Customers is

permissible because it involves the processing of banking, financial, and economic data. Case

authority supports this conclusion. In Ass’n of Data Processing v. Board of Governors, 745 F.2d

677 (D.C. Cir. 1984), the D.C. Circuit Court of Appeals upheld a Federal Reserve Board finding

that data processing and database services were closely related to banking (and thus a proper

activity for bank holding companies) if the “data to be processed ... are financial, banking or

economic....”10 Further, the court indicated that “economic data” would include: “agricultural

10 In reaching this conclusion the court said: “The record of this proceeding amply demonstrates, if any

demonstration is needed, that banks regularly develop and process for their customers large amounts of banking,

financial and economic data, and that they do so (and will presumably continue to do so) through the most advanced

technological means.” 745 F.2d at 689. Compare National Retailers Corp. v. Valley Nat'l Bank, 411 F. Supp. 308

(D. Ariz. 1976), aff'd, 604 F.2d 32 (9th Cir. 1979) (a national bank does not to have the authority to offer a data

processing service to retailers involving the collection and compilation of information relating to their retail sales

that had been collected by a special cash register). The district court in National Retailers held that no express

provision of the National Bank Act authorized national banks to publicly market a retail information service (“RIS”)

and concluded that, since the RIS was not within the enumerated powers, the determining issue was whether the RIS

was within the bank’s “incidental powers.” 411 F. Supp. at 313. Thus, by implication, the court held that the

district court in National Retailers held that no express

provision of the National Bank Act authorized national banks to publicly market a retail information service (“RIS”)

and concluded that, since the RIS was not within the enumerated powers, the determining issue was whether the RIS

was within the bank’s “incidental powers.” 411 F. Supp. at 313. Thus, by implication, the court held that the

- -

6

matters, retail sales matters, housing matters, corporate profits matters, and anything of value in

banking and financial decisions.” 745 F.2d at 691 (emphasis added).11

Likewise, the proposed processing of the retail-based Client Information is supported by OCC

precedent. OCC has long held that as part of the business of banking, national banks may

collect, transcribe, process, analyze, and store for itself and others banking, financial, or

economic data.12 OCC precedent establishes that the information that will be included in the

Bank’s E-wallet and Client Information service is banking, financial or economic data. OCC

Corporate Decision No, 2000-08, supra (national bank may, as part of its permissible web

hosting services, provide hosted merchants with information and reports relative to the purchases

and transactions on their web sites); OCC Interpretive Letter No. 677, supra. See also OCC

Interpretive Letter No. 741 reprinted in [1996-1997 Transfer Binder] Fed. Banking L. Rep.

(CCH) ¶81-105 (Aug. 19, 1996) (national bank acting as finder for automobile dealers may also

maintain a comprehensive system that allows dealers to track information on customers referred

and to generate market statistics such as buying trends and cycles); and OCC Interpretive Letter

No. 346, supra. See, e.g., OCC Interpretive Letter No. 737, supra (national bank may provide

transaction and information processing services to support an electronic stored value system);

OCC Interpretive Letter No

n a comprehensive system that allows dealers to track information on customers referred

and to generate market statistics such as buying trends and cycles); and OCC Interpretive Letter

No. 346, supra. See, e.g., OCC Interpretive Letter No. 737, supra (national bank may provide

transaction and information processing services to support an electronic stored value system);

OCC Interpretive Letter No. 653, supra (national bank may act as an informational and payments

“business of banking” includes only the enumerated powers. This position has since been repudiated by the Supreme

Court’s ruling in NationsBank v. Variable Life Annuity Co., 513 U.S. 251 (1995), that the “business of banking” is

not limited to the enumerated powers. The National Retailers court failed to consider that non-enumerated

informational services can come within the “business of banking” and specifically that the processing of banking,

financial and related economic data is part of the business of banking. Ass’n of Data Processing, supra. In light of

these defects, the holding of National Retailers is not entitled to much weight.

11 Federal Reserve Board has approved as closely related to the business of banking a wide range of data processing

services for businesses. Letter to Thomas A. Plant, from Virgil Mattingly (Nov. 25, 1997) (data processing support

for the bookkeeping, accounting, and recordkeeping of nonfinancial firms); Compagnie de Paribas, 82 Fed. Res.

Bull. 82 (1996) (data processing for payroll, accounts receivable, and billing services); The Bank of New York, et

al., 80 Fed Res. Bull. 1107 (1994) (electronic data capture an electronic data interchange services in which

merchants are provided with information relating to inventory and the buying patterns of customers that could be

used by the merchants for inventory control, targeted marketing, and other purposes); and Banc One Corp., et al., 79

Fed. Res. Bull. 1158 (1993) (same).

12 An earlier version of 12 C.F.R

ed Res. Bull. 1107 (1994) (electronic data capture an electronic data interchange services in which

merchants are provided with information relating to inventory and the buying patterns of customers that could be

used by the merchants for inventory control, targeted marketing, and other purposes); and Banc One Corp., et al., 79

Fed. Res. Bull. 1158 (1993) (same).

12 An earlier version of 12 C.F.R. § 7.1019 stated that “as part of its banking business and incidental thereto, a

national bank may collect, transcribe, process, analyze, and store for itself and others, banking, financial, or related

economic data.” OCC Interpretive Ruling 7.3500, 39 Fed. Reg. 14195 (Apr. 22, 1974). Although in its 1984

revision of the ruling, the OCC deleted this statement because it believed that “specific examples [of permissible

electronic activities] are inappropriate given the imprecision of terms and rapid pace of change in the data

processing industry,” the “analytical framework” embodied in the ruling remained the same. 49 Fed. Reg. 11157

(Mar. 26, 1984). OCC has consistently expressed this view. See OCC Interpretive Letter No. 677 reprinted in

[1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 83625 (June 28, 1995). See also OCC Interpretive

Letter No. 737 reprinted in [1996-1997 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-101 (August 19, 1996)

(national bank may provide transaction and information processing services to support an electronic stored value

system); OCC Interpretive Letter No. 653 reprinted in [1994-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶

83,601 (Dec. 22, 1994) (national bank may act as an informational and payments interface between insurance

underwriters and general insurance agents); and OCC Interpretive Letter No. 346 reprinted in (1985-1987 Transfer

Binder) Fed. Banking L. Rep. (CCH) ¶ 85,516 (July 31, 1985) (national banks may maintain records on

commodities transactions).

4-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶

83,601 (Dec. 22, 1994) (national bank may act as an informational and payments interface between insurance

underwriters and general insurance agents); and OCC Interpretive Letter No. 346 reprinted in (1985-1987 Transfer

Binder) Fed. Banking L. Rep. (CCH) ¶ 85,516 (July 31, 1985) (national banks may maintain records on

commodities transactions).

- -

7

interface between insurance underwriters and general insurance agents).13 Other agency

precedent also supports this conclusion.14

The Bank proposes to offer electronic bill presentment to its web enabled customers. OCC has

found that electronic bill presentment is part of the business of banking.15

Finally, the Bank also desires to consult with and advise its customers on how a web site should

be designed and operated so that the site hosted by the Bank and information related to that site

concerning payment transactions and end client information is secure from unauthorized access

while on the Bank's premises, while in transit to and from the Bank, and while in the Customer’s

possession.

Some of the Bank’s proposed security services are clearly encompassed within the hosting,

design, and development services discussed above and thus are not a separate product or service.

When transaction and client information is within the Bank’s environment, the Bank will be

responsible for the security of the information. The Bank will be operating the host server and,

through its system design, will specify appropriate logical access controls. Also, by hosting the

server, the Bank will provide physical security. Finally, in designing and developing the

commercially enabled web sites or a portion thereof the Bank will design in appropriate security.

Adequate security is part of these authorized services and need not be separately analyzed or

authorized.

However, it is contemplated that transactional and client information will be made available to

Customers and placed in environments under their control

. Finally, in designing and developing the

commercially enabled web sites or a portion thereof the Bank will design in appropriate security.

Adequate security is part of these authorized services and need not be separately analyzed or

authorized.

However, it is contemplated that transactional and client information will be made available to

Customers and placed in environments under their control. The issue is whether the Bank can

provide Customers with advice on security with respect to the information when it is in

Customers’ environments. For the reasons below, we find that, in this context, the security

consulting proposed by the Bank is a logical outgrowth of its banking business and, thus,

permissible.16

13 In connection with the Client Information services it provides to its Customers, the Bank will have access to

personal information regarding its Customers’ end clients. The OCC expects the Bank to limit its use and disclosure

of the Customer's client information to that which is necessary to perform the services for the Bank's Customers.

The OCC also expects the Bank to establish appropriate security measures for safeguarding this information. These

issues should be addressed in the Bank's agreements with its Customers.

14 Bank of New York, et al., supra (electronic data capture and electronic data interchange services in which

merchants are provided with information relating to inventory and the buying patterns of customers that can be used

by the merchants for inventory control, targeted marketing, and other purposes involve “banking, financial, or

economic data”) and Banc One Corp., et al., supra (same).

15 See, e.g., OCC Corporate Decision No. 2000-08, supra; OCC Conditional Approval No. 304 (March 5, 1999)

(electronic bill payment and presentment services over the Internet); OCC Interpretive Letter No. 731, supra

(operation of electronic toll collection system); OCC Interpretive Letter No. 836, reprinted in [1996-1997 Transfer

Binder] Fed

onomic data”) and Banc One Corp., et al., supra (same).

15 See, e.g., OCC Corporate Decision No. 2000-08, supra; OCC Conditional Approval No. 304 (March 5, 1999)

(electronic bill payment and presentment services over the Internet); OCC Interpretive Letter No. 731, supra

(operation of electronic toll collection system); OCC Interpretive Letter No. 836, reprinted in [1996-1997 Transfer

Binder] Fed. Banking Law. Rep. (CCH) ¶ 81-290 (March 12, 1996) (data processing and electronic data interchange

system to assist in the billing and collection for medical services).

16 The Supreme Court has held that the National Bank Act, in 12 U.S.C. § 24(Seventh), contains a broad grant of the

power to engage in the “business of banking.” See NationsBank of North Carolina, N.A. v. Variable Life Annuity

Co., 513 U.S. 251 (1995) (“VALIC”). Specifically, the Court has said that the business of banking “is not limited to

- -

8

To date, OCC has authorized national banks to provide security consulting for other financial

institutions as a correspondent service. No-Objection Letter 90-3 reprinted in [1990-1991

Transfer Binder] Fed. Banking L. Rep. (CCH), ¶ 83207 (May 2, 1990); OCC Interpretive Letter

No. 398 reprinted in [1988-1989 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 85,622

(September 28, 1987); No-Objection Letter 86-15 reprinted in [198X-198X Transfer Binder]

Fed. Banking L. Rep. (CCH), ¶ 84,021 (June 6, 1986); and OCC Interpretive Letter No. 137

reprinted in [1981-1982 Transfer Binder] Fed. Banking L. Rep. (CCH), ¶ 85218 (Dec. 27, 1979).

However, the OCC has permitted national banks to provide consulting and advisory services for

non-correspondents in many areas that are financially related or in which banks have developed

extensive expertise.

For example, national banks may engage in lease consulting services. OCC Interpretive Letter

No. 567 reprinted in [1991-1992 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶83,337

(October 29, 1991)

r, the OCC has permitted national banks to provide consulting and advisory services for

non-correspondents in many areas that are financially related or in which banks have developed

extensive expertise.

For example, national banks may engage in lease consulting services. OCC Interpretive Letter

No. 567 reprinted in [1991-1992 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶83,337

(October 29, 1991). They may offer financial and consulting services, including market research

and analysis, strategic planning, advertising and promotion planning, product development,

personnel management, employee relations, affirmative action, and salary and benefit plans to

banks and commercial customers. OCC Interpretive Letter No. 137, supra. They are permitted

to provide consumer financial counseling. Id.; OCC Interpretive Letter No. 367 reprinted in

[1985-1987 Transfer Binder] Fed. Banking L. Rep. (CCH) 85,537 (August 19, 1986). National

banks can also offer employee benefit consulting services (including health benefit consulting) to

corporations wishing to establish qualified benefit plans and relocation consulting for employees

of a bank or its affiliates, or customers of the bank. OCC Corporate Decision No. 98-51

(November 30, 1998). They may engage in financial consulting and advisory services for other

financial institutions and the general public, including, among other things, acting as a conduit in

conveying loan terms to prospective borrowers or purchasers, supplying financial information

regarding a third party, or engaging on behalf of others in research in contemplation of

prospective transactions. OCC Interpretive Letter No. 238 reprinted in [1983-1984 Transfer

Binder] Fed. Banking L. Rep. (CCH) ¶ 85,402 (February 9, 1982). Finally, OCC has recognized

that national banks operating as certification authorities can provide consulting or advisory

services to help customers, including other banks, to implement digital signature systems. OCC

Conditional Approval No. 267 (January 12, 1998)

ons. OCC Interpretive Letter No. 238 reprinted in [1983-1984 Transfer

Binder] Fed. Banking L. Rep. (CCH) ¶ 85,402 (February 9, 1982). Finally, OCC has recognized

that national banks operating as certification authorities can provide consulting or advisory

services to help customers, including other banks, to implement digital signature systems. OCC

Conditional Approval No. 267 (January 12, 1998).

Thus, advisory and consulting services are an appropriate way for banks to exercise their core

competencies. This has important implications under the logical outgrowth test. As OCC

observed in prior precedent:

the enumerated powers in § 24 Seventh and that the Comptroller therefore has discretion to authorize activities

beyond those specifically enumerated.” 513 U.S. at 258-59, N. 2. In exercising this discretion, the OCC is guided

by several factors reflected in case law and followed by OCC precedent: (1) is the activity functionally equivalent to

or a logical outgrowth of a recognized banking activity; (2) would the activity respond to customer needs or

otherwise benefit the bank or its customers; (3) does the activity involve risks similar in nature to those already

assumed by banks; and (4) whether the activity is expressly authorized by law for state-chartered banks.

- -

9

Among other things, the “logical outgrowth” test recognizes that the “business of

banking” is defined not only by the services and products that banks provide, but also by

the core competencies that banks use to produce them. ***

Clearly, “the business of banking is not static....” New York State Ass’n of Life

Underwriters v. New York State Banking Department, 632 N.E.2d 876, 880 (N.Y. 1994).

OCC recognizes that the evolution of “business of banking” is not restricted to lines of

business reflecting only products banks have sold or functions banks have served

previously

e competencies that banks use to produce them. ***

Clearly, “the business of banking is not static....” New York State Ass’n of Life

Underwriters v. New York State Banking Department, 632 N.E.2d 876, 880 (N.Y. 1994).

OCC recognizes that the evolution of “business of banking” is not restricted to lines of

business reflecting only products banks have sold or functions banks have served

previously. Rather, the “business of banking” must be -- and is -- sufficiently flexible to

enable banks to develop and exploit their unique core competencies and optimize the

return on those competencies by marketing products and services reflecting or using

those competencies. Today, banks face a rapidly changing market that demands rapidly

evolving skills. Thus, it is vital that they be able to plan strategically and adapt and

respond appropriately.

OCC Conditional Approval No. 267, supra.

In that letter, OCC concluded that as part of the business of banking national banks could act as

digital certification authorities because, inter alia, the certification authority activity was a logical

outgrowth of the core competence that banks had developed in verifying and authenticating

customer identities through paper and electronic systems. Here we similarly find that rendering

advice is one way that banks can and, with appropriate limitations, should be able to exploit their

core competencies. Indeed, some OCC letters authorizing advisory activities reflect the rationale

that the particular advisory activities are permissible because they involve the bank in providing

advice on an activity that the bank could provide directly to the advisee. For example, in

concluding that a national bank can offer financial advisory services on credit funding

alternatives to public and private entities, OCC found the activity permissible because it “will

involve the Bank’s own expertise developed internally in considering direct loans to these types

of borrowers.” Unpublished Letter from Thomas Taylor (May 25, 1984)

provide directly to the advisee. For example, in

concluding that a national bank can offer financial advisory services on credit funding

alternatives to public and private entities, OCC found the activity permissible because it “will

involve the Bank’s own expertise developed internally in considering direct loans to these types

of borrowers.” Unpublished Letter from Thomas Taylor (May 25, 1984).

Thus, we find that where a bank would be permitted as part of the business of banking to provide

a service and related expertise to an entity, the bank should also be permitted, as part of the

business of banking, to employ that expertise to provide advice to that entity as to how the entity

can perform the service for itself. This will enable a bank that has developed extensive expertise

on a service to share that expertise and competence with persons to whom the bank could have

sold the service. The risk exposures of providing advice on an activity, while somewhat

different from providing the actual service, would certainly be no greater and can be properly

limited and controlled.17

17 The advising bank would potentially be liable if it failed to render competent advice. Accordingly, we would

expect advising banks to take suitable steps to control that risk, such as keeping adequate records of the advice

rendered, obtaining appropriate insurance coverage, and ensuring that the staff rendering the advice is competent,

trustworthy, and has appropriate professional credentials. Moreover, we would expect that generally a bank would

only render advice on banking services that it has actual direct experience in performing adequately. This would not

generally include, for example, a bank that has relied upon outsourcing for an activity. Additionally, when acting in

an advisory or consulting capacity, a bank should not actually engage in a management role or exercise any form of

ver, we would expect that generally a bank would

only render advice on banking services that it has actual direct experience in performing adequately. This would not

generally include, for example, a bank that has relied upon outsourcing for an activity. Additionally, when acting in

an advisory or consulting capacity, a bank should not actually engage in a management role or exercise any form of

- -

10

Here the Bank proposes to provide advice on maintaining the security of information relating to

transactions arising from a commercially enabled web site the Bank designed and hosts for its

Customer. Clearly, the Bank could provide safekeeping and security services directly to its

Customers on this information.18 The OCC recently issued a letter concluding that, as part of the

business of banking, a national bank can provide electronic safekeeping services for personal

information and valuable confidential trade or business information. OCC Conditional Approval

No. 479, (July 27, 2001). That letter found national banks have established safekeeping

functions that encompass securing valuable business records and papers and that the electronic

safekeeping of such records is an electronic expression of this established safekeeping function.

The information for which the Bank would provide its Customers security consulting services

would qualify for direct safekeeping under this precedent. Thus, it would be a logical outgrowth

for the Bank to provide security consulting with respect to that information. In other words,

since the Bank as part of the business of banking can and will provide safekeeping services for

its Customers with respect to this information, it is a logical outgrowth of that business for the

Bank to advise its Customers on maintaining the security of that information when it is in the

Customers’ systems and under their control.

The proposed consulting activities would also respond to customer needs or otherwise benefit the

Bank or its customers

n and will provide safekeeping services for

its Customers with respect to this information, it is a logical outgrowth of that business for the

Bank to advise its Customers on maintaining the security of that information when it is in the

Customers’ systems and under their control.

The proposed consulting activities would also respond to customer needs or otherwise benefit the

Bank or its customers. The Customers would clearly benefit because the Bank could insure that

the security program of the Customer integrated with the program and systems of the Bank that

initially would hold and process the information. The Bank would benefit because it would be

able to allocate additional resources to upgrading its security expertise (and enhance its own

security) since it would be able to share the cost of that expertise with its consulting Customers.

Finally, the proposed advisory activity would involve risks similar in nature to those already

assumed by banks. As noted in OCC Conditional Approval No. 479, supra:

[T]he offering of electronic safekeeping of data will expose banks to risks similar to those

that banks are already expert in handling. As noted, national banks have long experience

in safekeeping of physical items and documents for their customers. In that capacity,

they have developed extensive procedures and regimes to handle the responsibilities and

risks that arise from this bailment. See, generally, Ann Graham, 1 BANKING LAW, Ch.

10 (Safe Deposit Boxes); James McBain, Safe Deposit Department, 72 BANKING L. J.

533 (1955). Moreover, OCC has developed guidance on this activity. Comptroller’s

Handbook: Consigned Items and Other Customer Services, supra. Much of this

experience, process, and guidance can and should be applied to electronic safekeeping

activities. While the use of electronic media to store and access items raises additional

operating control over the advisee

over, OCC has developed guidance on this activity. Comptroller’s

Handbook: Consigned Items and Other Customer Services, supra. Much of this

experience, process, and guidance can and should be applied to electronic safekeeping

activities. While the use of electronic media to store and access items raises additional

operating control over the advisee. Finally, banks providing advisory services should be careful to define clearly in

their engagement letters or agreements the scope of advice rendered and the bank’s liability for that advice.

18 In fact, as noted above, the Bank will be responsible for the security of this information during the time that it is in

the Bank’s environment and under its control.

- -

11

risks, banks already have extensive expertise in dealing with these risks and OCC has

provided guidance on addressing these risks. In this regard, as noted above, OCC expects

that banks offering this service will comply with the requirements under the new

Interagency Guidelines Establishing Standards for Safeguarding Customer Information.

Footnotes omitted.

Thus, banks are expert in dealing with business information security risks and in managing the

risks of safekeeping activities regarding that information. Moreover, as noted above, banks have

considerable experience in managing the special risks that arise when acting in an advisory

capacity.

Conclusion

For the reasons set forth below, the proposed activities described in your letter of August 3,

2001, pertaining to electronic commerce and security-related services to their commercial and

quasi-commercial customers activities are permissible for national banks.

Sincerely,

/s/

Julie L. Williams

First Senior Deputy Comptroller and

Chief Counsel