Compliance Blog

Written by Stephanie Lyon, Regulatory Compliance Counsel

Greetings, fellow compliance aficionados! My name is Stephanie Lyon and I recently joined NAFCU as a Regulatory Compliance Counsel. Prior to NAFCU, I worked as a compliance officer in a small credit union and also interned at a large credit union during law school. I am thrilled to join the Regulatory Compliance Team and I look forward to working with all of you!

Now let's all have a moment of silence for the hundreds of thousands of dollars credit unions have paid to members whose pin numbers were written on the back of their cards when lost or to members who went online shopping at www.fraudsters.com and had their card information stolen. Stories like these are not uncommon in the financial industry and each narrative seems to be more outrageous and expensive than the last. Unfortunately, some regulations are very member friendly and may make a credit union pay for losses, even if the member was negligent.

The federal Electronic Funds Transfer Act and Regulation E were enacted to protect consumers from electronic fund transfer errors and prevent financial institutions from unduly delaying the investigation and crediting of funds when errors are detected. The generous consumer protections built into Reg E, specifically section 1005.11 and its relevant staff commentary, may cause some credit unions to consider implementing procedures for members reporting unauthorized electronic fund transfers. These procedures require members to take steps in order to get their money back, with the goal of preventing unreasonable losses to the credit union. Credit unions often ask NAFCU's compliance team if the credit union can require members who report unauthorized use of their debit card to provide documentation like police reports, affidavits, and signed written statements. While it is understandable that credit unions may want documentation from their members, the rule is very member friendly, mechanical and allows for minimal procedural variances in the error resolution process.

The rule states that a financial institution may require a member to give written confirmation of an error within 10 business days of an oral notice provided that the credit union tells the member of this requirement. See, 12 C.F.R. 1005.11(b)(2). For credit unions that require a written confirmation, the error resolution process may look something like this:

1. Member notices an unauthorized charge on their account and calls the credit union.

2. The credit union asks the member to provide a written confirmation while it investigates the dispute per section 1005.11(b)(2).

3. The member fails to send a written confirmation of the error and the credit union takes longer than 10 business days to make a final determination.

4. The credit union has to make a decision of whether or not to provisionally credit the member's account per section 1005.11(c)(2)(i).

5. The credit union makes the final determination of the error, makes the provisional credit final (if provided) and notifies the member per section 1005.11(c)(1).

There is extensive debate among compliance officers on whether section 1005.11(b)(2) and its relevant commentary allow credit unions to require members to provide affidavits and police reports. Unfortunately for credit unions, the rule is written narrowly and only gives credit unions the discretion to require written confirmation and withhold provisional credit in specific circumstances. The relevant sections of the rule that talk about written confirmation and provisional credits are sections 1005.11(b)(2) and 1005.11(c)(2)(i)(A), respectively.

First, let's discuss what must be in the written confirmation. According to Reg E, the required contents of the member's error notice are few; it must (a) enable the institution to identify the member (account number, member number, social security number or other personal identifier); and (b) indicate why the member believes an error exists along with the type of error, date, and amount of the error. See, 12 C.F.R. 1005.11(b)(1)(ii)-(iii). The contents of the error notice can be given by the member orally or in writing. The rule does allow credit unions to require a signed written confirmation after receiving an oral notice of error. Is a signed written statement an affidavit? While affidavit requirements vary by jurisdiction, the Merriam-Webster dictionary defines an affidavit as a sworn statement in writing made especially under oath or on affirmation before an authorized magistrate or officer. Reg E's written confirmation requirement is not nearly that formal.

Next, let's discuss how the ability of the credit union to require a written confirmation impacts investigation responsibilities under Reg E. The main responsibilities of credit unions are to investigate an EFT error and to come to a resolution. Credit unions argue that without written confirmation, the credit union does not have anything to investigate and hence it should not have to pay for the unauthorized use of the member's card. Even though the credit union may take into account the lack of documentation as a factor for its investigation, it must begin investigating promptly upon receipt of an oral notice. The rule clearly states that the credit union must follow all of the steps outlined in the regulation, even if the member only gives oral notice of the error. See, 12 C.F.R. 1005.11(b)(1). Comment 1005.11(b)(1) 2 states:

2. Investigation pending receipt of information. While a financial institution may request a written, signed statement from the consumer relating to a notice of error, it may not delay initiating or completing an investigation pending receipt of the statement. 

(emphasis added).

In cases when the credit union is unable to conclude its investigation in 10 business days, it may take up to 45 calendar days from receipt of a notice of error to investigate and determine whether an error occurred. If the credit union chooses to use the additional time, it must provisionally credit the member's account in the amount of the alleged error, unless the institution requires but does not receive written confirmation within 10 business days of an oral notice of error. See, 12 C.F.R. 1005.11(c)(2)(i)(A). Hence a credit union can make the choice to withhold provisional funds if the member fails to provide the written confirmation of the error so long as the credit union does not delay commencing an error investigation because the member has not provided an affidavit, police report or other signed written documentation.

The bottom line is, Reg E does not permit altering the member's rights or the investigation process by requiring additional documentation, whether they are police reports, affidavits, or otherwise. If the credit union requires a written confirmation and the member fails to provide it within 10 business days, the credit union does not have to provisionally credit the member's account. So, while the credit union can request a written confirmation of the error, it cannot close an investigation merely because the credit union did not receive it. Credit unions requiring affidavits and police reports during its EFT error investigations may want to review their procedures with counsel, or risk giving its members reasons to complain to the NCUA.