Click Here for Violations!

by Richard Insley

Does your bank have a Website? If you answered "yes", there's a 50/50 chance it won't pass your next compliance examination. If, "no", you're not done yet. Ask around. You wouldn't be the first compliance officer to discover your bank's Website on your own. If you answered "unsure", you need to put this topic near the top of your priorities list.

No matter how you responded, the Internet lies somewhere in your future. A good number of banks have Websites and many more are developing them. Chances are, if you bank isn't online yet, someone is working on it - and this is where you enter the picture.

The Internet is a new delivery channel for banking products and services, probably the most exciting delivery channel ever. With only a small investment, any bank can create an impressive presence online. Websites start with as little as the bank's name, address and phone number - an electronic business card. Most bank sites feature information about branch locations and products. Many include interest "rate boards" featuring up-to-the- minute quotes on deposit products, credit cards, and a variety of loans. A few banks have interactive sites that allow the customer to send electronic applications for new loan and deposit accounts. Even virtual banking services (online statements, customer service, and third party payments) are within reach of modest-sized community banks.

At almost all levels of sophistication, bank Websites must comply with a variety of familiar rules and regulations, starting with simple things like "Member FDIC." The number and complexity of rules depends on your site - more rules apply as you expand its business functions. Because most banks feature consumer credit products on their Websites, compliance with Regulation Z becomes a central issue-but you'd never know it by looking at many sites.

So if Website compliance is such a big deal, why haven't I been hearing more about it? Regulators have been slow to regulate and police Cyberspace. It's as new to them as it is to you. The Fed has done very little to interpret or call attention to those sections of its regulations that apply to Websites, but this will change in 1998. New rules and commentary updates will certainly address online compliance issues. Also likely to change are lax supervision practices. Examiners are being trained and equipped to "surf the 'Net" looking for violations of banking regulations. As they gain experience, a list of "most common violations" in Cyberspace will emerge.

What's going to be on that list? Want a preview, now? During January 1998, APR Systems, Inc. conducted a study of compliance with Regulation Z at 50 randomly selected bank Websites from coast to coast. Each site was audited to determine if Reg. Z applied and, if so, whether the bank was in full compliance with applicable rules.

At every other bank Website, one or more violations of Regulation Z were apparent! Although alarming, a 50% violation rate only tells part of the story. Many of the banks that lacked violations passed because they weren't using their sites in ways that trigger Reg. Z. Adjusting the results to include only those banks that needed to comply, the violation rate climbs to 86% - that's worse than 6-to-1 odds that you will be cited for Reg. Z violations if you trigger a rule.

The list of Reg. Z "cyber-violations" begins with easily understood rules. Failure to use the term "annual percentage rate" (or, "APR" in some cases) is a very obvious error, yet many banks have rate boards on their sites that lack this required term. Another common problem begins with a rate board, or possibly just promotional text. Whenever a "trigger term" is mentioned, additional disclosures must be given - typical repayment terms and APR for closed end credit and Finance Charges and other charges for open end. Variable rate provisions must also be mentioned. Many of the violations discovered in the study resulted from missing or incomplete disclosures when trigger terms were used. Even if your site complies with the advertising standards today, failure to keep the information up to date will eventually turn into a "bait and switch" violation.

Most banks will want to offer online application forms for credit cards, personal loans, and maybe even equity lines and mortgages. Regardless of how the application is taken, "time of application" disclosures and booklets must be provided to these customers within the usual time frames. Because credit card and equity line application forms must be accompanied by disclosures, violations of these rules can happen the second a customer clicks into an online application form.

For now, the rules for Cyberspace are no different than for paper-based advertisements, forms, booklets and other disclosures. If you know how to comply with Regulation Z in the "real" world, you should be able to guide the development of your bank's Website. Here are several steps to improve your odds for a violation-free Website.

Richard C. Insley, President of APR Systems, Inc., provides internet training, web site development, and Truth in Lending services to financial institutions and regulators.

ACTION STEPS

Reread the advertising rules governing your online products. These should include FDIC's rules for deposit insurance, fair housing guidelines, and Regs. B, M, Z, and DD.
Review your site thoroughly. Do it online, not with paper copies. Look at your promotions the way a customer would and be sure the typical customer would see all the necessary notices and disclosures.
Check the frequency of updates of time-sensitive information like rate boards. Assume that examiners will hold you to the same standards as rates posted in branch lobbies. If information on your Website looks stale, request that it be updated or removed.
Wherever there are wording, prominence, sequencing, graphical or other mechanical requirements, evaluate your compliance on the same basis as these rules would apply to paper. Watch for proposed rulemakings during 1998 that would increase or change these standards for Webpages.
If you're not already a member of your bank's Website development team, ask to be included. Compliance costs are lowest when you get involved early in the game.