Remote Deposit Capture: Regulated by Contract or by Regulation CC?
Over the years, NAFCU's Compliance team has been asked if Regulation CC's funds availability schedule applies to checks deposited through remote deposit capture (RDC). The process of remotely depositing checks is not new; it has been around since the passing of the 21st Century Act (Check 21) in 2003. Check 21 facilitates the check collection process by permitting a member to scan a check and simply transmit the electronic images and data from the check to the credit union in order to deposit funds. While this technology eliminated the need to provide the original check to the credit union, it also left many credit unions wondering if they had to follow Regulation CC funds availability requirements.
Regulation CC defines a check as a “negotiable demand draft drawn on or payable through or at an office of a bank.” See, 12 C.F.R. § 229.2(k)(1). While checks must originate in paper form, the model Uniform Commercial Code provides that the term “item” or “check” includes transmission of an image pursuant to agreement. See, model U.C.C. § 4-110(a), (c). So it would appear that checks converted to images and remotely deposited may fit the definition. However, these "checks" are not deposited by traditional means like at a branch or an ATM. Rather, the ability of a member to deposit a check through RDC usually resides in the credit union's mobile banking app. The issue with RDC deposits is that a mobile app deposit does not fit within the strict reading of Regulation CC's definitions of a "check deposit" referenced throughout the rule. See, 12 C.F.R. § 229.10(c).
So who has the authority to interpret Regulation CC? Before the CFPB was created, the Federal Reserve Bank (FRB) had authority over Regulation CC. After Dodd-Frank, jurisdiction over Regulation CC was split down the middle. The CFPB gained authority over Subpart A (funds availability) and Subpart B (disclosure requirements); while the FRB retained authority over Subpart C (operational and payment systems) and Subpart D (Check 21). As of today, neither the FRB nor the CFPB have addressed whether an image of a check deposited through a smartphone or other mobile device is considered a check deposited in a financial institution's branch or ATM. As a side note, the CFPB and FRB did attempt to work together in 2011 to pass a joint rule to overhaul Regulation CC and even requested comments from the industry on this proposal. The proposal slightly touches on RDC and only went as far as to state that checks deposited through RDC were not considered deposited thorough a credit union's ATM. See, 76 Fed. Reg. 16867.
This has left the door open for other regulators and interested parties to weigh in. For example, the Office of the Comptroller of the Currency (OCC) released an interpretive letter on RDC in 2005. The letter determined that deposits made through RDC are not considered transactions conducted at a “branch” of a depository institution so do not fall within the funds availability requirements of Regulation CC. While not binding on credit unions, the letter is still a persuasive argument that Regulation CC does not apply to RDC deposits.
The OCC's interpretation was somewhat contradicted by an article written by the FRB of Minneapolis in 2015 that suggested Regulation CC applied to checks deposited through RDC. After receiving numerous comments, the article was redacted and all references pertaining to Regulation CC were removed because according to the author, "regulatory guidance in this area is still evolving." The change in guidance captured the sentiment that technology has evolved faster than some regulations and has left certain electronic services to be regulated contractually.
NCUA and the FFIEC have also released regulatory guidance pertaining to RDC, but their guidance is mostly about risk management. For example, NCUA issued letter 09-CU-01 regarding risk management considerations when implementing an RDC program and a second letter 09-CU-07 with a questionnaire that is used by examiners.
In addition, the FFIEC issued guidance on RDC risk management in its Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual as well as in a separate document: Risk Management of Remote Deposit Capture. The BSA/AML Examination Manual makes the overarching point that RDC programs will differ from institution to institution based on the risk assessment and provides guidance as to what risks to consider when crafting such programs. The guidance identifies contract drafting as one of the key components in a successful RDC program.
Contracts and RDC agreements are important in this case because until regulators or the courts establish whether RDC is or is not governed by Regulation CC, the credit union’s contract will govern the relationship. Of course, if a credit union's RDC agreement indicates the credit union will follow Regulation CC's funds availability schedule, it would be contractually bound to follow Regulation CC.
One thing to consider, however, is that Regulation CC does not preempt state laws regarding funds availability that do not conflict with the basic requirements of the rule. See, 12 C.F.R. § 229.20. So, it is possible that even though this issue is somewhat ambiguous as a matter of federal law, state funds availability law may requires a credit union's RDC program to adhere to state availability or notice requirements. As a result, the credit union may want to consult with local counsel to determine whether there are any specific state funds availability laws that may impact its obligations to members depositing checks through RDC.
***