We have set our security parameters for passwords and inactive use at 90 days. So if a customer does not log into our online banking product for 90 days that customer will need to re-enroll. We also require the customer passwords to be changed every 90 days. We are a small community agricultural based bank,139 million. We have recieved a few complaints from our customers indicating that they feel this period is too short. What are other banks our size doing?

Yes customers complain about changing passcodes, but they need to realize passcode changes are for their own protection.

We use 6 months for password changes, but once every 90 days for logins or they are deleted. If you don't login within that timeframe, you don't need internet banking.

We have a 6 month inactivity time frame. As far as changing passwords I think you will always get negative feedback because people are creatures of habit and hate to change.

If a customer that is enrolled in estatements has their online banking access deleted due to inactivity, are there any issues with not "delivering" a statement? Or is that fine since they can re-enroll at any time?

You must resume sending paper statements if you delete the ability to receive estatements. Alternatively, you will have unlimited Reg E liability since 1005.6(b)(3) bases the liability calculations on when statements are transmitted.

Thanks Brian. This came up in another conversation and I said I'd do additional research because if they don't have access to online banking, they didn't have the opportunity to get their statement. Unintentionally finding a lot of issues today.

To add to your conversation if you charge a paper statement fee...

Resuming paper statements and charging a paper statement fee if the customer previously enrolled in estatements to avoid such a fee has significant UDAP risk since it was the bank who cancelled the service.

That is where this all started, so maybe you'd like to chime in on the other thread: https://www.bankersonline.com/forum/ubbthreads.php/topics/2212128#Post2212128

We tend to think about statements as part of the service provided by the account, but receiving a statement is a legal requirement, not an "opportunity." I agree with Brian that you will have blatant violations of Section 1005.9(b) of Reg E if you turn off e-delivery of statements without turning on paper-based delivery. If the account is capable of EFTs, then you must "send a periodic statement" at least quarterly, whether or not any EFTs post. You said the account is being restricted due to inactivity, so there shouldn't be the usual 6(b)(3) liability concern--because there can't be any unauthorized EFTs if there are no EFTs at all.

There's no regulatory problem switching from e-documents to paper, but there could be business problems. Section 1005.4(a)(1) of Reg. E requires you to deliver all Reg E disclosures, including the ones contained in periodic statements, "in writing." It also acknowledges your ESIGN option to upgrade e-documents to the legal equivalent of paper. It DOES NOT say this is a one-way door. Unless your contract rules out a mixture of methods, you will always satisfy Reg. E with paper.

By activating paper delivery, you may violate your contractual obligation to send statements in electronic form. Go back and read your service agreement and ESIGN preconsent disclosures to see what you've promised the customer. Unless your agreement allows you to send either paper or electrons, you're painted into a corner when you turn off the electrons without closing the account.

Richard, just to be clear, the account isn't restricted due to inactivity. The online banking portal is restricted due to inactivity. So the customer could be conducting EFTs daily, but simply has not logged into online banking in over a year. Our system is set to force the customer to re-enroll in online banking at that time (I'm not sure why you would want to do this, but I wasn't around for the decision). Thank you for your input, it sounds like I have a lot of great talking points to go to the manager in charge of this function.

If the inactivity is limited to non-use of the online banking access device, then Brian is exactly right--you have open-ended exposure until you put paper statements in the hands of these customers. If imposition of a paper statement fee under these circumstances is not covered in your service agreement, then your safest course of action would be to switch to paper, waive the fee, and beef up the account agreements to provide for this situation. Although it's unusual, this will happen from time to time.

If you're having trouble getting the business people to think of a statement primarily as a document that exists to transmit the disclosures required by Regs E and DD, try a gimmick I used long ago with open-end credit account statements. To drive home the point that the regs (Z in my case) control a major part of a typical statement, I copied front and back of a statement, highlighted every word and number that was there because the reg required it and then took a razor blade and cut out the highlighted sections of the pages. What was left looked like a doily. When I held it up in the next meeting, they got the point.

Thank you Brian and Richard for the input. It's very helpful.