One more question regarding demonstrable consent...

We offer a self enrollment home banking service. The customer (at their convenience) can log onto our website and enroll in home banking. A Self Enrollment Disclosure (which is our EFT Agreement and Disclosure) is provided for them to read and print if they want to keep a copy. At the end of the Self Enrollment Disclosure there is a button for them to click on that they agree to the terms and conditions of the EFT agreement.

Enrolling in estatements is another feature of home banking. If the customer is interested in estatements, they must go through the online process of reading and agreeing to the terms and conditions of the Electronic Statement Disclosure Agreement.

Once they click on the “I agree” an email message is sent directly from the bank to the customers designated email address. Our message to them “Thank you. Your E-Statement has been activated. Please do not respond directly to this email message”

Would this be enough to prove demonstratable consent between the customer and the bank?

Monthly the customer receives an email notification that their statement is available for viewing. They are required to log onto the home banking service to view their statements there.

In order for a customer to receive only electronic statements (no paper statement), there must be two things: consent ("yes I will") and demonstration ("proof that I can")

Consent handshake: Consumers are protected under ESIGN by a requirement that there be a "consent handshake" - an electronic process that demonstrates both the consumer's agreement to obtain the records via electronic means and the consumer's ability to electronically receive/access the record.

Make that three things. "Informed consent" requires (in addition to the affirmative "I will") disclosures outlining key features of the e-delivery system, including hardware and software minimums, availability of paper documents on request, etc.

Our customers are required to access Home Banking in order for them to opt in to estatement.
At the end of the estatement disclosure are the links to "I aggree" or "I disagree". The hardware and software requirements to have homebanking is the same for estatements.

Upon their agreement, they receive an email acknowledgement from the bank acknowledging their agreement to receive estatement.

Is this enough to demonstrate consent or am I missing a piece?

I simply do not agree that you are obtaining the required informed consent of your customers, Paris. The key element that is missing is their demonstration that they are able to receive the type of notice that the agreement contemplates. For example, assume that you are going to provide customers PDF-formatted files of their bank statements on a "pull" basis. That means the customer has to demonstrate that he or she can

• receive an email notifying the customer that a document awaits them
• access a sample document that will be in the same format as the "real thing" and under the same type of access control (e.g., login to online banking system, find the link to the document and pull it down
• open the document and obtain some sort of information from it or print it and return either the information or the printed document to the bank
• agree to obtain future disclosures of the type contemplated (statements) in the same way.

What you have described, Paris, doesn't show that the customer can access documents of the type to be used. So his ability to obtain the written disclosures hasn't been demonstrated.

Keep in mind that eSign is also required for your Self Enrollment Disclosure if it contains Reg E disclosures that must be provided in writing.

I don't think there's been any real regulatory guidance (other than the unenforceable, temporary "eRegs) or case law regarding eSign acceptance. I know one of the largest banks in eCommerce only requires the customer's acknowledgment that their computer meets hardware and software requirements (after full eSign disclosure) and doesn't go through the "consent handshake" process. That's worked for them for years and with millions of customers without any apparent regulatory concern.

It seems that some people interpret this particular eSign requirement more strictly than others. I suggest seeking advice from your legal counsel.

We'd have to know the exact procedures. "Push" statement demonstrable consent would be more difficult than "pull" style demonstrable consent, IMHO. If everything is on the banks site, they can easily demonstrate consent. But you also need to verify you have the correct email. You'd be surprised how often people mis-type their own email addresses. If they've done that, you can't tell them when their statement is ready and notices on your closed system may not be good enough.

I'm going to jump in here because we are working on an e-statement only product. If they later choose they want paper, we will move them to another account. We also will push the statement to them via encrypted .pdf. I'm comfortable up to that point. My question comes from Jim Bledsoe's article from the January ABA Bank Compliance magazine.

If the customer changes his e-mail address and the statement gets bounced, we are planning on calling the customer to update the e-mail address. If we are unsuccessful contacting via phone, must we print the statement off and mail it to them? The last page of his article requires that we do that, but from posts on here, I haven't seen that as a requirement.

Thanks for the help.

Doesn't Section 230.10(e) and related OSC answer this question directly?

If you're hunting for Richard's referral:
http://www.bankersonline.com/regs/230/230-10.html

http://www.bankersonline.com/regs/230/regddcomm.txt

That is my understanding and I am very unpopular here for reminding e-commerce of that requirement. It is especially hard to swallow because our customers must pull their statements from home banking and availability is unrelated to whether or not they receive the e-mail notification (we're not required to make sure that a paper statement is opened and read). Enrolled customers do not want paper statements and management wants to keep using the cheaper electronic delivery. As time goes on, the number of invalid e-mail addresses has become unmanageable. It's very frustrating and a no-win situation for us and the customer.

In this case, you aren't pricing your accounts effectively. If you impose a tree-based delivery fee and offer a low/no cost alternative for tree-free delivery, then you can revise your account agreement so that customers lose the tree-free pricing as soon as the first disclosure-gram bounces. Set up this way, customers pay for the type of delivery they actually get. Like any other incentive price break, they have to behave the way you want in order to qualify.

My two cents. In addition to the procedures you are following here, make sure that you have written procedures outlining how you will track the statements that bounce back and what your procedures will be to provide the statements and/or put the customer back to another statement choice. We maintain a report that records the bounce backs. and we have written next steps....my recommendation comes from recent chats with " our guests".