# OCC Interpretive Letter No. 928: National bank may provide hosting and design services for commercially enabled Websites and may provide software and web configurations that enable Internet merchants to acquire and compile information from their end clients that will be used for authentication and to support future transactions over the Website

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/OCC_INT0928

## Section

- **Citation:** OCC Interpretive Letter No. 928
- **Heading:** National bank may provide hosting and design services for commercially enabled Websites and may provide software and web configurations that enable Internet merchants to acquire and compile information from their end clients that will be used for authentication and to support future transactions over the Website
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** OCC Interpretive Letters / National bank may provide hosting and design services for commercially enabled Websites and may provide software and web configurations that enable Internet merchants to acquire and compile information from their end clients that will be used for authentication and to support future transactions over the Website.

## Text

O
Comptroller of the Currency
Administrator of National Banks
Washington, DC 20219
Interpretive Letter #928
December 24, 2001 March 2002
12 USC 24(7)
Dear [ ]:
This responds to your letter of August 3, 2001, seeking, on behalf of the
[ ] (the “Bank”) an interpretive letter from the Office of the Comptroller of the
Currency (“OCC”) on the authority of national banks to offer certain electronic commerce and
security-related services to their wholesale and non-profit organization customers. For the
reasons set forth below, we find that the proposed activities are permissible for national banks.
Background
The Bank proposes to engage in several activities in association with its electronic payments
services. For merchants, government agencies, and non-profit service organizations that are
Bank customers (the “Customers”) with previously established web sites, the Bank will design
and host1 a web site and provide software2 enabling: 1) the Customers to process various forms
of payments electronically from their end clients; 2) Customers’ end clients to electronically
schedule and pay for events offered by a Customer organization; and 3) the Customer to acquire
and compile information3 from their end clients (“Client Information”) in connection with the
above described transactions to be used for authentication purposes and to facilitate future
interactions between the Customer and its end client. Also, in connection with these Internet-
related web-services, the Bank will consult with and advise its Customers on how the web site

1 The Bank will require that it host the portion of the page it develops.
2 The software will either be developed by the Bank or obtained from a third party
ture
interactions between the Customer and its end client. Also, in connection with these Internet-
related web-services, the Bank will consult with and advise its Customers on how the web site

1 The Bank will require that it host the portion of the page it develops.
2 The software will either be developed by the Bank or obtained from a third party.
3 The Client Information described in above, will consist of information such as the end client's name, mailing
address, shipping address, e-mail address, telephone number, preferred credit card numbers for billing purposes, and
other billing account information. The Client Information will primarily be used for authentication and security
purposes by the Bank on behalf of its Customer. However, from the end client’s perspective, the Client Information
will enable the Customer to provide a more convenient shopping service since the end client will not have to re-key
their information when they visit the Customer’s site again. The Client Information will also the enable Customer to
communicate more effectively with its end clients by sending out newsletters or communication to the end client’s
e-mail address acquired during the setup process.

- -
2
should be designed and operated so the web site hosted by the Bank and the related information
is secure from unauthorized access while on the Bank's premises, while in transit to and from the
Bank, and while in the Customer's possession. Finally, the Bank will also offer electronic bill
presentment and payment services for its merchant, government agency, and non-profit service
organization customers.
In addition, while the proposed activity will focus on the Bank’s Customers, the Bank will also
market the Group's Internet-related services to non-customers -- who may or may not have an
existing web site -- but who wish to have a payment related portion added to a new web site that
can accommodate the services described above
ant, government agency, and non-profit service
organization customers.
In addition, while the proposed activity will focus on the Bank’s Customers, the Bank will also
market the Group's Internet-related services to non-customers -- who may or may not have an
existing web site -- but who wish to have a payment related portion added to a new web site that
can accommodate the services described above. Any person who wishes to have a payment
portion of a web site designed must have a Bank account for settlement purposes -- thereby
becoming a Bank customer.
Customers that sign up for the services offered by the Bank will be charged various fees,
including a licensing or start-up fee when they initially sign up for the services offered by the
Bank, monthly maintenance and hosting fees, and/or transaction fees in connection with
processing payment transactions.
When the Bank builds and hosts the Customer’s web site, the Bank will do so in a manner that is
consistent with the appropriate levels of security and confidentiality risk control measures that
are consistent with the standards OCC adopted under 15 U.S.C. 6801(b) and codified in 12 CFR
Part 30, Appendix B (the Interagency Guidelines Establishing Standards for Safeguarding
Customer Information).
Bank is aware that the proposed activities will impose added risks to the Bank, including
transaction risk, legal risk, and reputation risk. Through a series of internal and external audits
of the Bank's technology, procedures and controls, the Bank has identified and reduced
operational risks that were identified by making the adjustments recommended in the audits.
The Bank plans to have regular internal and external audits of the activities. The staff that would
conduct the activities have worked closely with the Bank’s internal auditors on the Bank's
recently implemented Information Security Program, required under 12 CFR Part 30, so that the
Program incorporates the current and proposed activities discussed in this letter
ments recommended in the audits.
The Bank plans to have regular internal and external audits of the activities. The staff that would
conduct the activities have worked closely with the Bank’s internal auditors on the Bank's
recently implemented Information Security Program, required under 12 CFR Part 30, so that the
Program incorporates the current and proposed activities discussed in this letter. OCC has
recently completed an information technology review of the Bank that included the proposed
web-hosting activities and systems.
Discussion
The OCC has found that, as part of the business of banking and in association with electronic
payments services, national banks may provide merchant customers with services that will
enable the merchant to operate a commercially enabled web site.4 The processing of payments

4 In association with their electronic payments services, national banks may provide a “package” of Internet-based
services to retail merchants including: hosting web sites on the bank's own server; registering merchants with search
engines and obtaining Universal Resource Locators; providing an electronic communication pathway for product
ordering and payment; maintaining merchants' data associated with the web sites on its server (e.g., price
information, product descriptions, and images); providing merchants with software to create web sites; providing
g web sites on the bank's own server; registering merchants with search
engines and obtaining Universal Resource Locators; providing an electronic communication pathway for product
ordering and payment; maintaining merchants' data associated with the web sites on its server (e.g., price
information, product descriptions, and images); providing merchants with software to create web sites; providing

- -
3
resulting from orders received through a merchant's web site is also clearly part of the business
of banking.5 Merchant credit and debit card processing services generally involve verifying
credit card authorizations at the time of purchase, processing card transactions, settlement of card
transactions, and depositing funds into merchants’ accounts. The fact that the credit and debit
card and other electronic payment transactions would involve purchases of goods or services
over the Internet does not change the nature of the service that would be provided.6 Thus, the
Bank’s proposed payment processing and associated commercial web site hosting activities are
permissible.
OCC has found that the finder authority to host, develop, and support commercially enabled web
sites extends not only to merchants, but also to non-profit service entities such as government
agencies that provide goods and services to the public. OCC Conditional Approval No. 361
(March 3, 2000) (national bank may host web sites for government agencies that offer goods and
services to the public). We believe this rationale applies equally to private non-profit
organizations that provide goods and services to the public.7
Moreover, OCC has found that incidental to a payments processing service and associated
commercial web site hosting, a national bank may provide web design and development services.

reports on transactions, web site “hits,” and sales data; and processing credit card transactions. OCC Interpretive
Letter No. 856 reprinted in [1998-1999 Transfer Binder] Fed. Banking L. Rep
that incidental to a payments processing service and associated
commercial web site hosting, a national bank may provide web design and development services.

reports on transactions, web site “hits,” and sales data; and processing credit card transactions. OCC Interpretive
Letter No. 856 reprinted in [1998-1999 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-313 (March 5, 1999)
(providing or maintaining an Internet web site for merchants is one device that national banks may use as finders to
provide information to the merchants' customers).
5 OCC Corporate Decision No. 99-50 (Dec. 23, 1999) and OCC Corporate Decision No. 2000-08 (June 1, 2000)
(national bank may process for its merchant customers purchases made over the Internet); OCC Interpretive Letter
No. 856, supra. See also OCC Conditional Approval Letter No. 289 (Oct. 2, 1998) (national banks may acquire a
minority interest in a firm that, among other things, provides accounts receivable processing and accounts payable
processing); OCC Conditional Approval Letter No. 282 (July 7, 1998) (national bank may acquire an interest in a
firm that would, among other things, engage in payments processing for the health care firms); OCC Conditional
Approval Letter No. 248 (June 27, 1998) (national bank operating subsidiary may acquire a minority interest in an
entity that provides merchant credit and debit card processing services); and OCC Interpretive Letter No. 731
reprinted in [1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81,048 (July 1, 1996) (national banks as
part of the banking business may collect and process accounts relating to an electronic toll collection system).
6 Likewise, the fact that some of the Bank’s web sites will enable end clients to purchase rights to attend events,
rather than goods or conventional services, does not change the permissibility of the activity. OCC has found that
national banks can process orders and payments for event and attraction tickets
ess may collect and process accounts relating to an electronic toll collection system).
6 Likewise, the fact that some of the Bank’s web sites will enable end clients to purchase rights to attend events,
rather than goods or conventional services, does not change the permissibility of the activity. OCC has found that
national banks can process orders and payments for event and attraction tickets. See OCC Interpretive Letter No.
718 reprinted in [1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-033 (March 14, 1996). There is no
reason why the bank’s electronic finder authority should not include bringing together buyers and sellers of events,
which really are a form of services.
7 As we noted in a prior letter: “In the finder analysis, no distinction should be drawn between bringing together
with a government agency those who wish to purchase goods or services from that agency and those who wish to
consume goods or services from that agency. The latter, most likely individuals seeking forms, benefits, or other
information from the agency, are not “buyers” in the traditional sense; however, as taxpayers, they are essentially
buying information or other goods or services for which their taxes have paid. As such, they qualify as legitimate
subjects for finder activities by national banks. See Corporate Decision No. 98-13 (Feb. 9, 1998) (national bank
operating subsidiary, acting as finder, could bring together individuals who wished to enroll in government-
sponsored health insurance program with appropriate government agency).” Id. at p. 7.
er goods or services for which their taxes have paid. As such, they qualify as legitimate
subjects for finder activities by national banks. See Corporate Decision No. 98-13 (Feb. 9, 1998) (national bank
operating subsidiary, acting as finder, could bring together individuals who wished to enroll in government-
sponsored health insurance program with appropriate government agency).” Id. at p. 7.

- -
4
The ability to build the web sites for the participating merchants as part of a commercial Internet
services package is critical to the successful marketing of the package.8 To enhance
marketability and reduce costs to merchants, the firms that will compete with the Bank in
providing Internet commerce products and services are now offering complete packages to
merchants, which include the building of the web sites. See e.g., Bloom, supra; Steven
Marjanovic, First Data to Buy Stake in iMall, a Software Firm, American Banker, Nov. 9, 1998,
at 17; Tami Luhby, Wells Fargo Opens Door to Web for Small Business, American Banker,
Sept. 15, 1998.9
OCC has long held that, under their incidental powers, national banks may sell non-banking
products and services when reasonably necessary to provide banking products on a competitive
basis by creating a package of related services needed to satisfy consumer demand, meet market
competition, and enable the Bank to successfully market its banking services. Thus, for
example, in OCC Interpretive Letter No. 742, OCC found offering of Internet access service was
needed to successfully provide and market the Bank's Internet banking service. We found
limiting the Bank's Internet access services, to block non-banking use, would not meet customer
needs or the competing products in the marketplace. See also, OCC Interpretive Letter No. 611,
supra, (bank selling home banking service can also provide customer access to non-banking
services “to increase the customer base and the usage of the program”); OCC Interpretive Letter
No. 653, reprinted in [1994-1995 Transfer Binder] Fed
cess services, to block non-banking use, would not meet customer
needs or the competing products in the marketplace. See also, OCC Interpretive Letter No. 611,
supra, (bank selling home banking service can also provide customer access to non-banking
services “to increase the customer base and the usage of the program”); OCC Interpretive Letter
No. 653, reprinted in [1994-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 83,601
(December 22, 1994) (national banks may offer non-banking products as part of larger product
or service when necessary, convenient and useful to bank permissible activities). Cf., National
Courier Ass’n v. Board of Governors, 516 F. 2d 1229, 1240 (D.C. Cir. 1975) (incidental powers
of holding companies to provide specialized courier services when service necessary to obtain
full benefit of data processing services).
For this reason, the proposed building of web sites by the Bank for those merchants desiring that
service is incidental to the business of banking. Corporate Decision No. 2000-08, supra and
OCC Interpretive Letter No. 875 reprinted in [1999-2000 Transfer Binder] Fed. Banking L. Rep.
(CCH) ¶ 81-369 (October 31, 1999). See also OCC Interpretive Letters No. 856, supra (national
bank engaged in permissible web site hosting activity may provide merchants with software that
will enable them to design and modify their web sites).
As noted above, one of the features the Bank proposes to provide for merchants in the designed
and hosted web sites would enable the merchant Customer to acquire and compile information
from their end clients that would be used primarily for authentication and security purposes and
to facilitate additional transactions when the end client returns to the web site to conduct
additional business. This “one-click” shopping information concept is becoming increasingly

8 See J
le the merchant Customer to acquire and compile information
from their end clients that would be used primarily for authentication and security purposes and
to facilitate additional transactions when the end client returns to the web site to conduct
additional business. This “one-click” shopping information concept is becoming increasingly

8 See J. Bloom, Vendor Groups Woo Banks into Net Services, American Banker, May 27, 1999, at 14 (reporting that
vice president of the National Retail Federation says merchants of all sizes prefer to outsource the building of virtual
stores).
9 Experts say that without these packages, most smaller companies lack the budget and manpower to do a thorough
job of creating and maintaining a commerce-enabled web site. Bloom, supra.

- -
5
prevalent in electronic commerce. Major firms such as AOL Time Warner, Inc. and Microsoft
are currently developing systems that will allow people to store personal information (such as
names, addresses, and credit card numbers) online to simplify their purchasing transactions on
the Internet. A. Klein and A. Cha, “AOL May Launch an Internet ID Service,” Washington
Post, July 27 2001, p. E-1. Similarly, a number of significant electronic merchants and payment
processors have developed and are refining an “electronic wallet” which performs much the
same function by enabling customers to store identifying, shipping, and payment-related
information so that the customer does not need to re-key the information the next time they
submit an order. See M. Barnett, “It's the Year of the E-wallet,” The Industry Standard, June 30,
1999, viewed July 27, 2001 http://www.cnn.com/tech/computing/9907/01/ewallet.idg/; M. Zane,
“NextCard to Offer E-wallet,” ZDNN, October 18, 1999, viewed July 27, 2001 at
http://www.zdnet.com/printerfriendly/0,6061,2374202-2,00.html; Bloom and J. Kutler, “Web
Wallet Marketers Struggle for Definition and Acceptance,” The American Banker, November 4,
1999; and J
et,” The Industry Standard, June 30,
1999, viewed July 27, 2001 http://www.cnn.com/tech/computing/9907/01/ewallet.idg/; M. Zane,
“NextCard to Offer E-wallet,” ZDNN, October 18, 1999, viewed July 27, 2001 at
http://www.zdnet.com/printerfriendly/0,6061,2374202-2,00.html; Bloom and J. Kutler, “Web
Wallet Marketers Struggle for Definition and Acceptance,” The American Banker, November 4,
1999; and J. Capachin, “Digital Wallets: Their Potential Exceeds Their Performance,”
American Banker, August 17, 2001.
The Bank may permissibly offer this “one-click” shopping information service to Customers of
its commercial web site services for two reasons. First, the service is incidental to the electronic
payments processing service provided by the Bank in that it enhances the convenience of the
service for both the merchants and their end clients. OCC has held, in Interpretive Letter No.
868 reprinted in [1999-2000 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-263 (August 16,
1999), that a national bank can hold a minority interest in a company that designs and distributes
software that performs the same “one-click” shopping function. That letter concludes that the
“one-click” shopping software was permissible because it “will facilitate the electronic transfer
of funds from consumers to businesses and financial institutions” and thus performed “activities
commonly undertaken by banks directly for themselves, other financial institutions, or as part of
servicing customers.”
Second, processing of the retail based information relating to identity, shipping information, and
payment information with respect to end clients and their transactions for merchant Customers is
permissible because it involves the processing of banking, financial, and economic data. Case
authority supports this conclusion. In Ass’n of Data Processing v. Board of Governors, 745 F.2d
677 (D.C. Cir. 1984), the D.C
g of the retail based information relating to identity, shipping information, and
payment information with respect to end clients and their transactions for merchant Customers is
permissible because it involves the processing of banking, financial, and economic data. Case
authority supports this conclusion. In Ass’n of Data Processing v. Board of Governors, 745 F.2d
677 (D.C. Cir. 1984), the D.C. Circuit Court of Appeals upheld a Federal Reserve Board finding
that data processing and database services were closely related to banking (and thus a proper
activity for bank holding companies) if the “data to be processed ... are financial, banking or
economic....”10 Further, the court indicated that “economic data” would include: “agricultural

10 In reaching this conclusion the court said: “The record of this proceeding amply demonstrates, if any
demonstration is needed, that banks regularly develop and process for their customers large amounts of banking,
financial and economic data, and that they do so (and will presumably continue to do so) through the most advanced
technological means.” 745 F.2d at 689. Compare National Retailers Corp. v. Valley Nat'l Bank, 411 F. Supp. 308
(D. Ariz. 1976), aff'd, 604 F.2d 32 (9th Cir. 1979) (a national bank does not to have the authority to offer a data
processing service to retailers involving the collection and compilation of information relating to their retail sales
that had been collected by a special cash register). The district court in National Retailers held that no express
provision of the National Bank Act authorized national banks to publicly market a retail information service (“RIS”)
and concluded that, since the RIS was not within the enumerated powers, the determining issue was whether the RIS
was within the bank’s “incidental powers.” 411 F. Supp. at 313. Thus, by implication, the court held that the
district court in National Retailers held that no express
provision of the National Bank Act authorized national banks to publicly market a retail information service (“RIS”)
and concluded that, since the RIS was not within the enumerated powers, the determining issue was whether the RIS
was within the bank’s “incidental powers.” 411 F. Supp. at 313. Thus, by implication, the court held that the

- -
6
matters, retail sales matters, housing matters, corporate profits matters, and anything of value in
banking and financial decisions.” 745 F.2d at 691 (emphasis added).11
Likewise, the proposed processing of the retail-based Client Information is supported by OCC
precedent. OCC has long held that as part of the business of banking, national banks may
collect, transcribe, process, analyze, and store for itself and others banking, financial, or
economic data.12 OCC precedent establishes that the information that will be included in the
Bank’s E-wallet and Client Information service is banking, financial or economic data. OCC
Corporate Decision No, 2000-08, supra (national bank may, as part of its permissible web
hosting services, provide hosted merchants with information and reports relative to the purchases
and transactions on their web sites); OCC Interpretive Letter No. 677, supra. See also OCC
Interpretive Letter No. 741 reprinted in [1996-1997 Transfer Binder] Fed. Banking L. Rep.
(CCH) ¶81-105 (Aug. 19, 1996) (national bank acting as finder for automobile dealers may also
maintain a comprehensive system that allows dealers to track information on customers referred
and to generate market statistics such as buying trends and cycles); and OCC Interpretive Letter
No. 346, supra. See, e.g., OCC Interpretive Letter No. 737, supra (national bank may provide
transaction and information processing services to support an electronic stored value system);
OCC Interpretive Letter No
n a comprehensive system that allows dealers to track information on customers referred
and to generate market statistics such as buying trends and cycles); and OCC Interpretive Letter
No. 346, supra. See, e.g., OCC Interpretive Letter No. 737, supra (national bank may provide
transaction and information processing services to support an electronic stored value system);
OCC Interpretive Letter No. 653, supra (national bank may act as an informational and payments

“business of banking” includes only the enumerated powers. This position has since been repudiated by the Supreme
Court’s ruling in NationsBank v. Variable Life Annuity Co., 513 U.S. 251 (1995), that the “business of banking” is
not limited to the enumerated powers. The National Retailers court failed to consider that non-enumerated
informational services can come within the “business of banking” and specifically that the processing of banking,
financial and related economic data is part of the business of banking. Ass’n of Data Processing, supra. In light of
these defects, the holding of National Retailers is not entitled to much weight.
11 Federal Reserve Board has approved as closely related to the business of banking a wide range of data processing
services for businesses. Letter to Thomas A. Plant, from Virgil Mattingly (Nov. 25, 1997) (data processing support
for the bookkeeping, accounting, and recordkeeping of nonfinancial firms); Compagnie de Paribas, 82 Fed. Res.
Bull. 82 (1996) (data processing for payroll, accounts receivable, and billing services); The Bank of New York, et
al., 80 Fed Res. Bull. 1107 (1994) (electronic data capture an electronic data interchange services in which
merchants are provided with information relating to inventory and the buying patterns of customers that could be
used by the merchants for inventory control, targeted marketing, and other purposes); and Banc One Corp., et al., 79
Fed. Res. Bull. 1158 (1993) (same).
12 An earlier version of 12 C.F.R
ed Res. Bull. 1107 (1994) (electronic data capture an electronic data interchange services in which
merchants are provided with information relating to inventory and the buying patterns of customers that could be
used by the merchants for inventory control, targeted marketing, and other purposes); and Banc One Corp., et al., 79
Fed. Res. Bull. 1158 (1993) (same).
12 An earlier version of 12 C.F.R. § 7.1019 stated that “as part of its banking business and incidental thereto, a
national bank may collect, transcribe, process, analyze, and store for itself and others, banking, financial, or related
economic data.” OCC Interpretive Ruling 7.3500, 39 Fed. Reg. 14195 (Apr. 22, 1974). Although in its 1984
revision of the ruling, the OCC deleted this statement because it believed that “specific examples [of permissible
electronic activities] are inappropriate given the imprecision of terms and rapid pace of change in the data
processing industry,” the “analytical framework” embodied in the ruling remained the same. 49 Fed. Reg. 11157
(Mar. 26, 1984). OCC has consistently expressed this view. See OCC Interpretive Letter No. 677 reprinted in
[1995-1996 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 83625 (June 28, 1995). See also OCC Interpretive
Letter No. 737 reprinted in [1996-1997 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 81-101 (August 19, 1996)
(national bank may provide transaction and information processing services to support an electronic stored value
system); OCC Interpretive Letter No. 653 reprinted in [1994-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶
83,601 (Dec. 22, 1994) (national bank may act as an informational and payments interface between insurance
underwriters and general insurance agents); and OCC Interpretive Letter No. 346 reprinted in (1985-1987 Transfer
Binder) Fed. Banking L. Rep. (CCH) ¶ 85,516 (July 31, 1985) (national banks may maintain records on
commodities transactions).
4-1995 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶
83,601 (Dec. 22, 1994) (national bank may act as an informational and payments interface between insurance
underwriters and general insurance agents); and OCC Interpretive Letter No. 346 reprinted in (1985-1987 Transfer
Binder) Fed. Banking L. Rep. (CCH) ¶ 85,516 (July 31, 1985) (national banks may maintain records on
commodities transactions).

- -
7
interface between insurance underwriters and general insurance agents).13 Other agency
precedent also supports this conclusion.14
The Bank proposes to offer electronic bill presentment to its web enabled customers. OCC has
found that electronic bill presentment is part of the business of banking.15
Finally, the Bank also desires to consult with and advise its customers on how a web site should
be designed and operated so that the site hosted by the Bank and information related to that site
concerning payment transactions and end client information is secure from unauthorized access
while on the Bank's premises, while in transit to and from the Bank, and while in the Customer’s
possession.
Some of the Bank’s proposed security services are clearly encompassed within the hosting,
design, and development services discussed above and thus are not a separate product or service.
When transaction and client information is within the Bank’s environment, the Bank will be
responsible for the security of the information. The Bank will be operating the host server and,
through its system design, will specify appropriate logical access controls. Also, by hosting the
server, the Bank will provide physical security. Finally, in designing and developing the
commercially enabled web sites or a portion thereof the Bank will design in appropriate security.
Adequate security is part of these authorized services and need not be separately analyzed or
authorized.
However, it is contemplated that transactional and client information will be made available to
Customers and placed in environments under their control
. Finally, in designing and developing the
commercially enabled web sites or a portion thereof the Bank will design in appropriate security.
Adequate security is part of these authorized services and need not be separately analyzed or
authorized.
However, it is contemplated that transactional and client information will be made available to
Customers and placed in environments under their control. The issue is whether the Bank can
provide Customers with advice on security with respect to the information when it is in
Customers’ environments. For the reasons below, we find that, in this context, the security
consulting proposed by the Bank is a logical outgrowth of its banking business and, thus,
permissible.16

13 In connection with the Client Information services it provides to its Customers, the Bank will have access to
personal information regarding its Customers’ end clients. The OCC expects the Bank to limit its use and disclosure
of the Customer's client information to that which is necessary to perform the services for the Bank's Customers.
The OCC also expects the Bank to establish appropriate security measures for safeguarding this information. These
issues should be addressed in the Bank's agreements with its Customers.
14 Bank of New York, et al., supra (electronic data capture and electronic data interchange services in which
merchants are provided with information relating to inventory and the buying patterns of customers that can be used
by the merchants for inventory control, targeted marketing, and other purposes involve “banking, financial, or
economic data”) and Banc One Corp., et al., supra (same).
15 See, e.g., OCC Corporate Decision No. 2000-08, supra; OCC Conditional Approval No. 304 (March 5, 1999)
(electronic bill payment and presentment services over the Internet); OCC Interpretive Letter No. 731, supra
(operation of electronic toll collection system); OCC Interpretive Letter No. 836, reprinted in [1996-1997 Transfer
Binder] Fed
onomic data”) and Banc One Corp., et al., supra (same).
15 See, e.g., OCC Corporate Decision No. 2000-08, supra; OCC Conditional Approval No. 304 (March 5, 1999)
(electronic bill payment and presentment services over the Internet); OCC Interpretive Letter No. 731, supra
(operation of electronic toll collection system); OCC Interpretive Letter No. 836, reprinted in [1996-1997 Transfer
Binder] Fed. Banking Law. Rep. (CCH) ¶ 81-290 (March 12, 1996) (data processing and electronic data interchange
system to assist in the billing and collection for medical services).
16 The Supreme Court has held that the National Bank Act, in 12 U.S.C. § 24(Seventh), contains a broad grant of the
power to engage in the “business of banking.” See NationsBank of North Carolina, N.A. v. Variable Life Annuity
Co., 513 U.S. 251 (1995) (“VALIC”). Specifically, the Court has said that the business of banking “is not limited to

- -
8
To date, OCC has authorized national banks to provide security consulting for other financial
institutions as a correspondent service. No-Objection Letter 90-3 reprinted in [1990-1991
Transfer Binder] Fed. Banking L. Rep. (CCH), ¶ 83207 (May 2, 1990); OCC Interpretive Letter
No. 398 reprinted in [1988-1989 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶ 85,622
(September 28, 1987); No-Objection Letter 86-15 reprinted in [198X-198X Transfer Binder]
Fed. Banking L. Rep. (CCH), ¶ 84,021 (June 6, 1986); and OCC Interpretive Letter No. 137
reprinted in [1981-1982 Transfer Binder] Fed. Banking L. Rep. (CCH), ¶ 85218 (Dec. 27, 1979).
However, the OCC has permitted national banks to provide consulting and advisory services for
non-correspondents in many areas that are financially related or in which banks have developed
extensive expertise.
For example, national banks may engage in lease consulting services. OCC Interpretive Letter
No. 567 reprinted in [1991-1992 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶83,337
(October 29, 1991)
r, the OCC has permitted national banks to provide consulting and advisory services for
non-correspondents in many areas that are financially related or in which banks have developed
extensive expertise.
For example, national banks may engage in lease consulting services. OCC Interpretive Letter
No. 567 reprinted in [1991-1992 Transfer Binder] Fed. Banking L. Rep. (CCH) ¶83,337
(October 29, 1991). They may offer financial and consulting services, including market research
and analysis, strategic planning, advertising and promotion planning, product development,
personnel management, employee relations, affirmative action, and salary and benefit plans to
banks and commercial customers. OCC Interpretive Letter No. 137, supra. They are permitted
to provide consumer financial counseling. Id.; OCC Interpretive Letter No. 367 reprinted in
[1985-1987 Transfer Binder] Fed. Banking L. Rep. (CCH) 85,537 (August 19, 1986). National
banks can also offer employee benefit consulting services (including health benefit consulting) to
corporations wishing to establish qualified benefit plans and relocation consulting for employees
of a bank or its affiliates, or customers of the bank. OCC Corporate Decision No. 98-51
(November 30, 1998). They may engage in financial consulting and advisory services for other
financial institutions and the general public, including, among other things, acting as a conduit in
conveying loan terms to prospective borrowers or purchasers, supplying financial information
regarding a third party, or engaging on behalf of others in research in contemplation of
prospective transactions. OCC Interpretive Letter No. 238 reprinted in [1983-1984 Transfer
Binder] Fed. Banking L. Rep. (CCH) ¶ 85,402 (February 9, 1982). Finally, OCC has recognized
that national banks operating as certification authorities can provide consulting or advisory
services to help customers, including other banks, to implement digital signature systems. OCC
Conditional Approval No. 267 (January 12, 1998)
ons. OCC Interpretive Letter No. 238 reprinted in [1983-1984 Transfer
Binder] Fed. Banking L. Rep. (CCH) ¶ 85,402 (February 9, 1982). Finally, OCC has recognized
that national banks operating as certification authorities can provide consulting or advisory
services to help customers, including other banks, to implement digital signature systems. OCC
Conditional Approval No. 267 (January 12, 1998).
Thus, advisory and consulting services are an appropriate way for banks to exercise their core
competencies. This has important implications under the logical outgrowth test. As OCC
observed in prior precedent:

the enumerated powers in § 24 Seventh and that the Comptroller therefore has discretion to authorize activities
beyond those specifically enumerated.” 513 U.S. at 258-59, N. 2. In exercising this discretion, the OCC is guided
by several factors reflected in case law and followed by OCC precedent: (1) is the activity functionally equivalent to
or a logical outgrowth of a recognized banking activity; (2) would the activity respond to customer needs or
otherwise benefit the bank or its customers; (3) does the activity involve risks similar in nature to those already
assumed by banks; and (4) whether the activity is expressly authorized by law for state-chartered banks.

- -
9
Among other things, the “logical outgrowth” test recognizes that the “business of
banking” is defined not only by the services and products that banks provide, but also by
the core competencies that banks use to produce them. ***
Clearly, “the business of banking is not static....” New York State Ass’n of Life
Underwriters v. New York State Banking Department, 632 N.E.2d 876, 880 (N.Y. 1994).
OCC recognizes that the evolution of “business of banking” is not restricted to lines of
business reflecting only products banks have sold or functions banks have served
previously
e competencies that banks use to produce them. ***
Clearly, “the business of banking is not static....” New York State Ass’n of Life
Underwriters v. New York State Banking Department, 632 N.E.2d 876, 880 (N.Y. 1994).
OCC recognizes that the evolution of “business of banking” is not restricted to lines of
business reflecting only products banks have sold or functions banks have served
previously. Rather, the “business of banking” must be -- and is -- sufficiently flexible to
enable banks to develop and exploit their unique core competencies and optimize the
return on those competencies by marketing products and services reflecting or using
those competencies. Today, banks face a rapidly changing market that demands rapidly
evolving skills. Thus, it is vital that they be able to plan strategically and adapt and
respond appropriately.
OCC Conditional Approval No. 267, supra.
In that letter, OCC concluded that as part of the business of banking national banks could act as
digital certification authorities because, inter alia, the certification authority activity was a logical
outgrowth of the core competence that banks had developed in verifying and authenticating
customer identities through paper and electronic systems. Here we similarly find that rendering
advice is one way that banks can and, with appropriate limitations, should be able to exploit their
core competencies. Indeed, some OCC letters authorizing advisory activities reflect the rationale
that the particular advisory activities are permissible because they involve the bank in providing
advice on an activity that the bank could provide directly to the advisee. For example, in
concluding that a national bank can offer financial advisory services on credit funding
alternatives to public and private entities, OCC found the activity permissible because it “will
involve the Bank’s own expertise developed internally in considering direct loans to these types
of borrowers.” Unpublished Letter from Thomas Taylor (May 25, 1984)
provide directly to the advisee. For example, in
concluding that a national bank can offer financial advisory services on credit funding
alternatives to public and private entities, OCC found the activity permissible because it “will
involve the Bank’s own expertise developed internally in considering direct loans to these types
of borrowers.” Unpublished Letter from Thomas Taylor (May 25, 1984).
Thus, we find that where a bank would be permitted as part of the business of banking to provide
a service and related expertise to an entity, the bank should also be permitted, as part of the
business of banking, to employ that expertise to provide advice to that entity as to how the entity
can perform the service for itself. This will enable a bank that has developed extensive expertise
on a service to share that expertise and competence with persons to whom the bank could have
sold the service. The risk exposures of providing advice on an activity, while somewhat
different from providing the actual service, would certainly be no greater and can be properly
limited and controlled.17

17 The advising bank would potentially be liable if it failed to render competent advice. Accordingly, we would
expect advising banks to take suitable steps to control that risk, such as keeping adequate records of the advice
rendered, obtaining appropriate insurance coverage, and ensuring that the staff rendering the advice is competent,
trustworthy, and has appropriate professional credentials. Moreover, we would expect that generally a bank would
only render advice on banking services that it has actual direct experience in performing adequately. This would not
generally include, for example, a bank that has relied upon outsourcing for an activity. Additionally, when acting in
an advisory or consulting capacity, a bank should not actually engage in a management role or exercise any form of
ver, we would expect that generally a bank would
only render advice on banking services that it has actual direct experience in performing adequately. This would not
generally include, for example, a bank that has relied upon outsourcing for an activity. Additionally, when acting in
an advisory or consulting capacity, a bank should not actually engage in a management role or exercise any form of

- -
10
Here the Bank proposes to provide advice on maintaining the security of information relating to
transactions arising from a commercially enabled web site the Bank designed and hosts for its
Customer. Clearly, the Bank could provide safekeeping and security services directly to its
Customers on this information.18 The OCC recently issued a letter concluding that, as part of the
business of banking, a national bank can provide electronic safekeeping services for personal
information and valuable confidential trade or business information. OCC Conditional Approval
No. 479, (July 27, 2001). That letter found national banks have established safekeeping
functions that encompass securing valuable business records and papers and that the electronic
safekeeping of such records is an electronic expression of this established safekeeping function.
The information for which the Bank would provide its Customers security consulting services
would qualify for direct safekeeping under this precedent. Thus, it would be a logical outgrowth
for the Bank to provide security consulting with respect to that information. In other words,
since the Bank as part of the business of banking can and will provide safekeeping services for
its Customers with respect to this information, it is a logical outgrowth of that business for the
Bank to advise its Customers on maintaining the security of that information when it is in the
Customers’ systems and under their control.
The proposed consulting activities would also respond to customer needs or otherwise benefit the
Bank or its customers
n and will provide safekeeping services for
its Customers with respect to this information, it is a logical outgrowth of that business for the
Bank to advise its Customers on maintaining the security of that information when it is in the
Customers’ systems and under their control.
The proposed consulting activities would also respond to customer needs or otherwise benefit the
Bank or its customers. The Customers would clearly benefit because the Bank could insure that
the security program of the Customer integrated with the program and systems of the Bank that
initially would hold and process the information. The Bank would benefit because it would be
able to allocate additional resources to upgrading its security expertise (and enhance its own
security) since it would be able to share the cost of that expertise with its consulting Customers.
Finally, the proposed advisory activity would involve risks similar in nature to those already
assumed by banks. As noted in OCC Conditional Approval No. 479, supra:
[T]he offering of electronic safekeeping of data will expose banks to risks similar to those
that banks are already expert in handling. As noted, national banks have long experience
in safekeeping of physical items and documents for their customers. In that capacity,
they have developed extensive procedures and regimes to handle the responsibilities and
risks that arise from this bailment. See, generally, Ann Graham, 1 BANKING LAW, Ch.
10 (Safe Deposit Boxes); James McBain, Safe Deposit Department, 72 BANKING L. J.
533 (1955). Moreover, OCC has developed guidance on this activity. Comptroller’s
Handbook: Consigned Items and Other Customer Services, supra. Much of this
experience, process, and guidance can and should be applied to electronic safekeeping
activities. While the use of electronic media to store and access items raises additional

operating control over the advisee
over, OCC has developed guidance on this activity. Comptroller’s
Handbook: Consigned Items and Other Customer Services, supra. Much of this
experience, process, and guidance can and should be applied to electronic safekeeping
activities. While the use of electronic media to store and access items raises additional

operating control over the advisee. Finally, banks providing advisory services should be careful to define clearly in
their engagement letters or agreements the scope of advice rendered and the bank’s liability for that advice.
18 In fact, as noted above, the Bank will be responsible for the security of this information during the time that it is in
the Bank’s environment and under its control.

- -
11
risks, banks already have extensive expertise in dealing with these risks and OCC has
provided guidance on addressing these risks. In this regard, as noted above, OCC expects
that banks offering this service will comply with the requirements under the new
Interagency Guidelines Establishing Standards for Safeguarding Customer Information.
Footnotes omitted.
Thus, banks are expert in dealing with business information security risks and in managing the
risks of safekeeping activities regarding that information. Moreover, as noted above, banks have
considerable experience in managing the special risks that arise when acting in an advisory
capacity.
Conclusion
For the reasons set forth below, the proposed activities described in your letter of August 3,
2001, pertaining to electronic commerce and security-related services to their commercial and
quasi-commercial customers activities are permissible for national banks.
Sincerely,
/s/
Julie L. Williams
First Senior Deputy Comptroller and
Chief Counsel

## Nearby sections

- [OCC Interpretive Letter No. 719 Letter concludes that an ESOP is a "company' for purposes of 12 U.S.C. 371c and that an ESOP that controls at least 25% of a bank's voting stock is an "affiliate" under sec. 371c (supersedes existing OCC interpretive letter #261). (10/26/89)](https://www.frixlaw.com/law-library/statutes/OCC_INT0719.md)
- [OCC Interpretive Letter No. 720 Group of affiliate national banks may collectively own, through operating subsidiaries, minority interest in a merchant credit card processing subsidiary. (01/26/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0720.md)
- [OCC Interpretive Letter No. 722 A national bank may invest CIF assets in mutual funds, including mutual funds that pay the bank a servicing fee, without the bank having to reduce its trustee fees, if the bank concludes, based upon a reasoned opinion of trust counsel, that such an arrangement is authorized by applicable state law, is consistent with the trust instrument, is appropriate for the particular trust accounts, and is consistent with OCC regulations, including in particular 12 C.F.R. 9.18(b)(12). (03/12/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0722.md)
- [OCC Interpretive Letter No. 724 Bank can sell vehicle service contracts to customers who use home equity loan proceeds to purchase a vehicle, and the maturity of the service contract may be different from the maturity of the loan. (04/22/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0724.md)
- [OCC Interpretive Letter No. 725 National bank to establish an operating subsidiary to engage in permissible derivatives-related activities. (05/10/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0725.md)
- [OCC Interpretive Letter No. 726 Letter concerns the application of the Community Reinvestment Act (CRA) regulations to financial institutions' support of microenterprise lending programs. (06/21/96).](https://www.frixlaw.com/law-library/statutes/OCC_INT0726.md)
- [OCC Interpretive Letter No. 730 Letter concludes that loans proposed by the bank to an unaffiliated distributor of mutual funds would not be subject to interaffiliate lending restrictions contained in 12 U.S.C. 371C. (05/29/96).](https://www.frixlaw.com/law-library/statutes/OCC_INT0730.md)
- [OCC Interpretive Letter No. 732 National bank may make a 5.5% investment in software company which is engaged in the design, development, marketing and maintenance of a network for electronic funds transfers and electronic data interchange, including transacting electronic commerce and marketing software products for use on its world-wide electronic commerce network. (05/10/96).](https://www.frixlaw.com/law-library/statutes/OCC_INT0732.md)
- [OCC Interpretive Letter No. 733 National bank receiver is subject to the rights of secured creditors and creditors entitled to setoff. U.S. legal principles regarding enforcement of security interests are applicable to a receivership of a federal branch or agency conducted under National Bank Act. Therefore, receiver of an uninsured federal branch or agency does not have the right to interfere with the rights of secured creditors, including application of collateral held in U.S. to obligations of a non-U.S. office of the bank. (06/19/96).](https://www.frixlaw.com/law-library/statutes/OCC_INT0733.md)
- [OCC Interpretive Letter No. 736 Lending limit exception for participations not limited to banks. Non-banks may act as participants. (07/25/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0736.md)
- [OCC Interpretive Letter No. 737 Huntington National Bank's acquisition of minority interest in a limited liability company providing stored value systems. (08/19/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0737.md)
- [OCC Interpretive Letter No. 738 National bank's participation in a guaranty issued by an agent for a syndication of lenders with respect to their borrower's letter of credit reimbursement obligations to another bank or financial institution is permissible under I.R. 7.1016. (08/14/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0738.md)
- [OCC Interpretive Letter No. 740 Letter advises the Bank as follows: 1) The question of whether "salary" as used in 12 C.F.R. 2.4 includes an officer's base salary, bonuses, director's fees and/or any other compensation paid by the Bank must be determined by the Bank's management; 2) the question of whether the payment bonuses for credit life sales under 12 C.F.R. 2.4 is based on salary received by the recipient in a calendar year, a fiscal year, or any 12-month period must be determined by the Bank's management; and 3) pursuant to 12 C.F.R. 2.4, if the Bank's CEO is a loan officer and the CEO participates in the bonus plan under which payments based on credit life insurance sales are made, the CEO must be included in averaging the salaries of loan officers that participate in the Bank's bonus or incentive plan. (08/19/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0740.md)
- [OCC Interpretive Letter No. 741 National bank may acquire majority interest in company which operates call center facility which operates programs by which potential customers for new or used automobiles may access databases containing information on the used and new car inventories of numerous automobile dealerships in its metropolitan area. (08/19/96)](https://www.frixlaw.com/law-library/statutes/OCC_INT0741.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/OCC_INT0928. Check the current official text before relying on it. Not legal advice.