I understand that the opt-in form, required by the upcoming rules for ODP under Reg. E, can be provided on the Bank's web site. If we provide the model form for secure submission, what else should I be aware of for e-sign or affirmative consent?

You don't have to comply with E-SIGN to deliver the opt-in notice electronically if the consumer agrees to accept it electronically. Because the regulation specifically states the notice may be delivered electronically, E-SIGN won't apply. You can also deliver the confirmation electronically, if the consumer agrees to accept it that way.

Suggestion: If your customer is on a secure server when completing the opt-in form, you can include a spot in the form where the customer provides his email address and a check box authorizing you to email the confirmation to him/her. Just document the fact that the consumer provided the OK (see § 205.13(b) of Reg E).

Thank you, John. Sounds simple enough! I also wondered if you thought we should include any other identifying information, other than what is on the model form, to confirm the identity of the consumer.

Footnote 32 in the Federal Register document reads "Because the disclosures are not required to be in written form, electronic disclosures made under this section are not subject to compliance with the consumer consent and other applicable provisions of the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001 et seq.), which only applies when information is required to be provided to a consumer in writing. The notice is, however, subject to Regulation E’s general requirement that disclosures be clear and readily understandable and in a form the consumer may keep. See 12 CFR §205.4(a)(1)."

If the customer is logged in to online banking, you should be secure in your knowledge of the customer, but will still need to know which account (if more than one is accessible online) the opt-in applies to. You could design the form so that the choices are available for the consumer to check off (in which case, set it up so the consumer can select more than one of them). If the consumer is not logged in, but the communication is secure, I'd suggest requiring the consumer to provide last 4 of SSN or full DOB as minimum ID requirements. Because you have to provide a confirm anyhow you could figure that the risk of an ID slip is fairly low. Maybe you could send the confirm via email only if the consumer already had an email address on file with you, and by snail mail to address of record otherwise.

John, thank you so much. I appreciate you providing the site references and I really like your suggestions for compliance. We are planning to get a head start on this requirement.

If a customer calls can we accept a verbal opt in?

If the institution has provided the customer the overdraft service opt-in information required, the institution can accept a valid opt-in from the consumer by telephone. Be certain to get the account number or numbers and do at least some minimal verification you're actually talking to the consumer you think you are. And then be sure to deliver a written or (if the consumer gives you the OK) electronic confirmation of the opt-in, which will include a statement that the consumer can revoke the opt in at any time.

That fulfills the 4-step process:

1. provide a written notification about your overdraft service and the opt-in provision
2. provide an opportunity to opt in
3. obtain the consumer's opt in, and
4. deliver a written or electronic confirmation of the opt-in with a statement that the consumer can revoke the opt in at any time.

Does the initial member opt-in notification has to be a letter mailed out? Or can it be by email, phone call, etc? Also can the joint-owner on the account opt-in?

It must be written or it may be electronically delivered if the consumer agrees to it. The agreement does not have to conform to E-SIGN Act requirements. A telephonic notice would not, IMO, meet the requirement.

On a joint account, any one joint owner can opt in for the account, and any one joint owner can revoke an opt in regardless of which owner provided it.

What is the definition of this: You can also deliver the confirmation electronically, if the consumer agrees to accept it that way. . If the customer has provided his email address, is that sufficient or does it mean a customer who has already "passed" ESign?

Leaping the E-SIGN hurdles certainly qualifies, if the consumer's agreement to accept electronic records includes disclosure information in general, in addition to statements in particular.

However, for the opt-in disclosure and confirmation, you don't need to get the full-blown E-SIGN handshake and demonstrable consent. All you need is a nod, a signature, a statement in an email or some other indication that your customer agreed to receive the disclosure electronically. So, for example, if you provide a link on your online banking page that says something like "Click here for important information about overdraft services," you can treat the consumer's click on the link as an agreement to receive the disclosure electronically. Similarly, if the same customer clicks on a link on your opt-in form that agrees to your overdraft service for card transactions, the opt-in form itself could include a statement that the consumer agrees to receive a confirmation electronically, and the confirmation could be delivered as the next screen, and include the required notice that the consumer can revoke the opt-in at any time, etc.

Excellent analysis...it makes things easier. Thanks.

I will add that you need to have some way to document compliance. IMO, an annotation maintained in accordance with your documented procedures would meet that need.

John, if the customer opts-in via a link on our site, can we then send the confirmation notice electronically as well, outside of ESign?

Yes, if the consumer approves the electronic method (you would include that approval in the opt-in form button he or she clicks). Then you can return the confirmation with the "you have the right to revoke the consent at any time" language as a follow-up webpage, suggesting that the consumer print a copy for his/her records. That way, you get the whole process taken care of.

John, you may have already discussed this and I missed it; if we have a list of our customers emails can we send the letter and confirmation by email with a short explaination. I just don't want to break any E-sign rules.

Exp. Email Mr. Smith about the ODP changes and attach the ODP letter and confirmation. We can then accept a yes or no from him without him even forwarding us the signed letter?

You cannot send the opt-in disclosure by email unless you have previously obtained Mr. Smith's OK (not necessarily under E-SIGN) to do so. So, if Smith's E-SIGN-compliant authorization covered not only statements but also "any required notices and/or other information concerning my account," or if you blasted out an email to customers asking for an OK to send important information about your Overdraft Service to them via email, and got an emailed OK, you'd be fine. Or, if at the time of setting up an account, you got an email address with an OK to send information about account services.

The emailed notice could have a link to an opt-in page where the customer could fill in account number(s), his name (if not already pre-filled) and hit a "send" button that not only opts him in but also gives you the OK to send the confirmation by email.