Since the rule became effective we have been copying the confirmation notices because our vendor did not have a fix in to provide a report listing the confirmations sent the prior day. To date they have yet to do this - we are a fairly large bank with 50+ branches so this is not acceptable to say the least.

My question, our vendor's compliance guru (as they keep referring her) is telling management that it's not a requirement to retain the notice of confirmation and that a report is not necessary. However, my arguement is this: how can we audit/confirm that the program is working the way it should when we don't have a report to confirm this. That we must rely on someone to copy each notice and retain it.

Any thoughts??? In my opinion 205.13 applies to the full reg - not just a specific area....

Administrative Enforcement, Record
Retention - Section 205.13
Section 917 of the EFTA sets forth the federal agencies
responsible for enforcing compliance with the provisions of
the Act.
Record retention
Financial institutions must maintain evidence of compliance
with the EFTA and Regulation E for at least two years. The
agency supervising the financial institution may extend this
period. The period may also be extended if the financial
institution is subject to an action filed under Sections 910, 915
or 916(a) of the EFTA, which generally apply to the financial
institution’s liability under the EFTA and Regulation E.
Persons subject to the EFTA who have actual notice that they
are being investigated or subject to an enforcement proceeding
must retain records until disposition of the proceeding.
Records may be stored on microfiche, microfilm, magnetic
tape, or in any other manner capable of accurately retaining
and reproducing the information.

I'm going to play Devil's Advocate for a moment.

Do you keep a copy of every disclosure you make under Regulation E with a customer's signature acknowledging receipt? For instance, there's a requirement you provide a receipt for transactions at electronic terminals. It applies to you, the account holding institution even if the terminal is operated by a supermarket in Saigon. Do you worry about the fact that you can't possibly know, let alone document, that that Vietnamese supermarket provided a receipt? Can you prove that your institution provided a specific version of account disclosures to a particular consumer? How about documenting that you provide account disclosures to consumer X, who stopped in to request them (he's not a customer)?

You need to have policies and procedures in place that are reasonably designed to ensure that you provide the confirmation and that you don't assess an OD fee for a covered card transaction until after you've sent it. If your policies hold your bank to a higher documentation standard, you'll be held to that self-imposed standard by an examiner.

I'm not saying that your retention of all those copies is wrong; I'm suggesting it's unnecessary.

Written procedures explaining what to do when an opt in is received, (including sending a confirmation) should be adequate for evidence of compliance. As John notes, such procedures are certainly acceptable as proof of compliance in other areas of Regulation E, CC, DD, etc.

Moreover, a copy of a confirmation does not prove it was sent, only that it was written. Proof of mailing would be your next step. If you raise the standards, compliance with the raised standards will be expected of you.