If we get an undeliverable message after emailing the statement, do we need to redeliver the e-statement via an alternate email or street address? The statement is available to the customer when they log in to our on-line system.

Thanks,

You can deliver the statement by another method, but it is my understanding that you are not required to do so. It's really no different than not needing to resend a paper statement after one gets returned.

So you deliver statements that are E-Sign compliant via e-mail?

Yes in an encrypted email, in a pdf format after the customer has demonstrated that they can receive and open pdf sample during the enrollment process. The pdf is sent without data, once the ID and password is entered and authenticated, the pdf will open with the data.

A webinar we listened to stated that if an emailed e-disclosure is returned undelivered, we must attempt redelivery by sending it to an alternate email address or street address.

Thanks,

I don't think you are going to find a citation for this and this is not the consensus I have heard in the past. That said, ESIGN is a law with no implementing regulation and, therefore, you are on your own to "interpret" the law (until the courts do that for you). If the webinar presenter is an attorney, maybe they know something I don't as I'm not an attorney.

That said, redelivery by another method is always an acceptable practice that will ensure compliance.

There was a short period between enactment of ESIGN and 2007 when the Fed had plugged electronic delivery requirements into a number of its consumer protection regulations. There were provisions for things like undelivered emails. Someone apparently pointed out there was not authority for the Fed to interpret the ESIGN Act, and all of the regs were amended in 2007 to remove the ESIGn related provisions. It's rather amazing how much residual impact some of those rescinded requirements still have.

Thank You. Another question - the webinar stated that we should maintain records of the customers consent. We have a report that lists customers who have enrolled. Is this enough? What are we suppose to retain?

Thanks,

A record of their electronic demonstrable consent.

Banker-12, there are several risks in E-SIGN processes to include "I didn't agree to that" and "that was not me" so you want to be able to recreate what they did and how you knew it was them and that is retention, knowing they signed in with credentials, that a cat didn't step on the Enter key and borrow $10K. You need your substitute for "here is the document you signed, this is your signature, and we checked your ID before you signed here."

FWIW I'll be covering this on May 9.

https://www.bankersonline.com/webinars/esign0518

B-12:
John has you covered on the first question. This was never an ESIGN problem--just one caused and subsequently corrected by the Fed. There is, however, the possibility you have shot yourself in the foot. Even though the laws and regs require nothing at this time, what's in your e-delivery service agreement? If you agreed to retry delivery by alternate means, then you're stuck with that obligation until you and the customer agree otherwise.

Andy has you covered on the second question. Even though there's no clear requirement in law or reg, your real concern is the risk of repudiation. What will you do if these e-delivery customers refuse to acknowledge that they consented or refuse to acknowledge that the electronic "X" on an electronic agreement is, in fact, their electronic "X"? What evidence will it take to persuade a court that the borrower is lying and that the e-signature is valid? Whatever your attorney will need to defend you successfully in court later is what you need to capture and retain now;.

Thank you all. Our agreement does not mention delivering by alternate means.
Customers have to log in to online banking to enroll; part of the enrollment process is for them to enter the required enrollment passcode we provide.

So they enroll using your online banking and you then deliver via e-mail. How does that equate to getting demonstrable consent if they consent in one fashion and statements are delivered by another method?

Part of the enrollment process is to open a pdf sample of a statement to demonstrate that they will be able to open it when it's emailed to them. To open the emailed pdf they will have to log in using the same online banking credentials.

I am really confused. The statement is available on your on-line banking system. That is where the E-Sign agreement is delivered and demonstrable consent is given.

Is the e-mail that you are saying is rejecting just a notice that the new statement is available? Is this e-mail notification mentioned in your E-Sign agreement? Sounds like this e-mail thing is a holdover from days gone by and you need to read your E-Sign agreement very carefully to see how it is addressed.

Customers enroll in our on-line banking system, the agreement is delivered and demonstrate that they can open a pdf. The e-sign agreement states that they are electing to receive statements by email and it describes the whole process from when they receive the email with the pdf attached to how to open it securely.

The undeliverable emails we get is the email that contains the statement in pdf. Our agreement does not state that we will resend via an alternate method. however, all statements are available on our on-line banking system (not mentioned in the agreement but customer sees it when they log in).

The piece we're having trouble understanding stems from this: Based on this and your additional responses, I understand your statement e-delivery system to be both "push" and "pull." Are you saying that you email a copy of the statement and also park a copy of that same statement online for customer retrieval--i.e.--redundancy?

Yes but the statement online does not have the error resolution page; so I guess it's not the same statement.

I guess I am confused with this entire set-up. I go to the on-line banking website and agree to receive statements via E-sign and provide demonstrable consent by opening a PDF file. Then you actually e-mail the statements to me. I'm not sure how that is demonstrable consent. What if I don't even have an e-mail browser installed on my computer or I have one that does not interface with Adobe Acrobat or interfaces with some other PDF reader thru an add-on that can't actually read the PDFs that you are sending as it doesn't support the fonts that you use in the document? IMHO - You can't go through one system for consent then deliver through another process.

Although there's nothing in ESIGN that says this directly, it's the only reasonable way to interpret the "test drive" requirement.

I hoped that there was 100% redundancy...and therefore one e-delivery method would be fully tested. The other method could be viewed as a courtesy copy. If the "pull" version lacks some of the necessary Reg E/DD content, then this method meets the "in writing" delivery requirement, but violates the specific content requirements. If consent for the "push" method lacked a test of the customer's email service, then this method fails to comply with ESIGN (and therefore fails to meet the Reg E/DD "in writing" requirement.)

The test we did was for the ability to open the PDF and not the email service. An enrollment email is sent after customer signs up. We need to get with our provider on how to accomplish this step.

Thank you all.

Now that I'm in a panic about not complying with E-SIGN regarding statements, I want to run the only other time that we have to comply with E-SIGN to see if our process is right.

For the REG E-Foreign Remittance Transfer rule, we send the disclosures to the customer by email. But first, we send a consent agreement for electronic delivery of the disclosure for signature by email. If they receive the email and open the attachment, customer will sign and email back the consent agreement. This is our test that customer will be able to receive the disclosures. Are we in compliance with E-SIGN?

Thanks,

Thanks,

I just found out that the statement available on our on-line system is the same one e-statement customers receive by e-mail including the error resolution page. The one I made reference to is a simple statement that all customers can view.

This means that we don't have to test the customer's email service since we also have the "pull" method and we are okay with E-SIGN, correct?

Depends on what your agreement says as to how do they view the statements? You previously stated " it describes the whole process from when they receive the email with the pdf attached to how to open it securely.". If you aren't telling them to log onto the on-line banking system, I still don't think you are covered.

We state on the agreement that 12 months of statements are available on our on-line banking system. We are going to revise it to be more detailed, include that they have to "log-on" to the system to get a copy if unable to retrieve it from the email.

Thank You.

Knowing that the "pull" copies of the statements are complete, you have a stronger argument that you're in compliance with the periodic disclosure requirements of Regs. E, DD, and Z. It's still a good idea to add an email service test to your ESIGN consent exercise. With the right wording in the consent agreement, that would prop the door open for e-delivery of "written" items other than statements.