Resolution No. JB-2015-3443 of the Banking Board of Ecuador

Banking Board of Ecuador

RESOLUTION No. JB-2015-3443

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332, on September 12, 2014, whose text states that resolutions contained in the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by control bodies, will remain in force in all that does not oppose what is provided in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling on the date of entry into force of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board, which grants this control body competence to hear and resolve the present review appeal;

THAT through a communication entered into this control body on October 10, 2013, Mr. Simón Ernesto Vivas Bazurto, filed a complaint against the Banco Nacional de Fomento, stating that: "(...) I have been the victim of theft through electronic hacking of my checking account No. 055003074-6 at the Banco del Fomento, from which part of the cash money that was in this account has been taken, which was withdrawn at different ATMs of different banks in different places, from which the amount of $5,100 plus 56 transactions of 50 cents, totaling $28, has been stolen; adding the two values gives the amount of 5,128 US dollars..." (sic);

THAT through Official Letter No. DAyEU-ISFP-REQ-2013-1333, dated October 28, 2013, the Attention and User Education Directorate of the Regional Intendancy of Guayaquil, accepted the complaint for processing and requested explanations and defenses from the Banco Nacional de Fomento. In response, through a communication dated November 20, 2013, entered into this control body on the 22nd of the same month and year, the financial institution attached the required information and stated that it had made requests to the other involved institutions, to which only certain banks sent the required information;

THAT through Official Letter No. IRG-DAyEU-V-R-2014-298, dated April 10, 2014, the Regional Intendancy of Guayaquil, after the analysis conducted regarding the complaint filed, pointed out and resolved the following:

"(...)

d) From the review of the CDs sent by Banco Pichincha C.A. and Cooperativa 29 de octubre, which contain recordings of the moments when the transactions challenged in the aforementioned table were made, it is not possible to observe if a card with the logo of the Banco Nacional de Fomento was used, due to the poor positioning of the video cameras.

e) Regarding the video recordings of the challenged transactions on September 5, 6, 11, and 18, 2013, which were sent by the Banco Nacional de Fomento through Official Letter No. 006-2014 on January 16, 2014, it is observed that the recordings have different times than the times the bank stated the challenged transactions occurred, so they were not considered in this complaint.

f) Regarding the challenged transactions on September 3, 4, 7, 8, 11, 12, 13, 14, 15, 16, 17, and 18, 2013, the financial entity did not send the recordings of them.

(...)

In merit of the above, and in exercise of the powers delegated by the Superintendent of Banks and Insurance through Resolution No. ADM-2013-11454, dated April 2, 2013, this Office resolves:

1. ACCEPT the complaint presented by Mr. SIMÓN ERNESTO VIVAS BAZURTO, with citizenship ID No. 1202787642, against the controlled financial institution BANCO NACIONAL DE FOMENTO for the reasons stated in the sixth section of this letter.

2. ORDER the controlled financial institution BANCO NACIONAL DE FOMENTO to proceed to restore to Mr. SIMÓN ERNESTO VIVAS BAZURTO the sum of US$ 4,544.50 (FOUR THOUSAND FIVE HUNDRED FORTY-FOUR WITH 50/100 DOLLARS OF THE UNITED STATES OF AMERICA), debited from his checking account No. 0550030746 that he holds in the aforementioned Bank, on September 3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14, 15, 16, 17, and 18, 2013, being able to exercise his right of recourse against the institutions owning the ATMs where the challenged withdrawals occurred, and send to this Office, within a term of eight days, counted from the receipt of this letter, the documentation that accredits the compliance with this resolution.

(...).";

THAT through a document entered into this Superintendence of Banks on April 25, 2014, Engineer Paula Isabel Ponce Quiroz, Acting Commercial Manager of the Banco Nacional de Fomento, El Empalme Branch, with the professional sponsorship of lawyers M. Angélica Pazmiño Muñoz, and Licenia Rizzo Zambrano, filed an appeal for reconsideration against the administrative act contained in Official Letter No. IRG-DAyEU-V-R-2014-298, dated April 10, 2014;

THAT through Official Letter No. IRG-DAyEU-V-R-2014-779, dated July 15, 2014, the Regional Intendancy of Guayaquil, after analyzing the appeal for reconsideration filed, resolved to ratify Official Letter No. IRG-DAyEU-V-R-2014-298, dated April 10, 2014, and consequently reject the referred appeal;

THAT through a document entered into this control body on July 30, 2014, Master Ángela Mercedes Avilés Gómez, in her capacity as Commercial Manager of the Banco Nacional de Fomento, Guayaquil Branch, with the professional sponsorship of lawyer Nicolás Rodríguez Campos, files before the Banking Board a review appeal against the administrative act contained in Official Letter No. IRG-DAyEU-V-R-2014-779, dated July 15, 2014;

THAT the appellant based the review appeal on the following arguments:

• That the financial user did not apply the basic security recommendations for the handling of the debit card, which were formally made known to him through various media instructing users to observe the security strip, the ATM messaging, transaction receipts, circulars, etc., in which case the financial institution identified the different withdrawals allegedly made from the debit card of Mr. Simón Ernesto Vivas Bazurto, being able to identify that with said card withdrawals not made by the affected person had been registered;

• That the Banco Nacional de Fomento is permanently carrying out management actions in order for the information requested by the control body to be delivered by the financial institutions owning the ATMs, for which reason the information is subject to predispositions of third parties; even more so when the withdrawals subject of the complaint used ATMs that do not belong to the Banco Nacional de Fomento;

• That the abundant documentary evidence provided by the financial institution was never considered when issuing resolutions by the control body, notwithstanding the Banco Nacional de Fomento has been the only one to collaborate with the control authority, as well as having executed all pertinent actions demonstrating categorically that the elements provided must change the resolutions issued.

THAT through Official Letter No. JB-2014-2110, dated August 7, 2014, Lawyer Pablo Cobo Luna, Secretary of the Banking Board, accepted the review appeal filed for processing; and, through Official Letter No. JB-2014-2111, of the same date as the first cited letter, Mr. Simón Ernesto Vivas Bazurto was notified with the appeal filed by the financial institution;

THAT Article 52 of the Constitution of the Republic establishes that people have the right to dispose of goods and services of optimal quality and to choose them freely, as well as to precise and non-misleading information about their content and characteristics, for which the law will establish mechanisms for quality control and procedures for the defense of consumers, and sanctions for violation of these rights, in addition to contemplating repair and indemnification for deficiencies, damages, or poor quality of goods and services;

THAT Article 1 of the Organic Law of Institutions of the Financial System determines that the Superintendence of Banks is the administrative entity in charge of supervising and controlling the financial system, in all matters regarding the protection of the public's interests, as well as ensuring the stability, solidity, and correct functioning of institutions subject to its control; monitoring that they comply with the legal norms governing them; and at the same time, requiring that said institutions present and adopt the corresponding corrective measures when necessary;

THAT Article 5, Chapter IV.- Procedure for the attention of complaints against financial system institutions, Title XX.- Of the Superintendence of Banks and Insurance, Book I.- General Norms for the application of the General Law of Institutions of the Financial System of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, states:

"ARTICLE 5.- If the result of the analysis carried out by the Superintendence determines the need for the controlled institution to introduce corrective measures that regularize the situation that motivated the complaint, the Superintendent of Banks and Insurance or the official who has the delegation of said authority will issue the corresponding disposition.

If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the complainant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and powers contemplated in letters b) and o) of Article 180 of the General Law of Institutions of the Financial System, granting the legal representative of the entity a term that may not exceed fifteen (15) days from notification to send, under the warnings of Law, the proof of compliance with the order issued.

For complaints of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client maintains his account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred";

THAT from the transcribed legal norms it is inferred that the Superintendence of Banks, when determining incorrect procedures by controlled financial institutions that may have caused harm to a complainant, must act as ordered for those effects, in which case, from the documentation that forms part of the file constituted around this review appeal, and from the administrative acts issued by the Regional Intendancy of Guayaquil, it is appreciated that the transactions made at ATMs in the month of September in the checking account No. 0550030746 of Mr. Simón Ernesto Vivas Bazurto, were carried out with a frequency of 3 transactions per ATM per day in several BANRED ATMs in the city of Quito;

THAT after the analysis carried out by this Office, it is necessary to mention that, by transferring the responsibility for the disputed transactions to the user of the financial institution, due to the fact that the Banco Nacional de Fomento issued a card to access ATM services, although they would constitute part of the conditions that support a written agreement between the parties on deposits, fund withdrawals, credits, debits, and any other transaction allowed in accounts or monetary deposits, made through electronic or electromechanical means, it is no less true that the bank, upon receiving resources from the public, also has the obligation to safeguard the funds delivered to its custody, in order to return to the depositor the monetary equivalent deposited when it is requested, from which it follows that the responsibility of the client regarding the transactions they carry out through ATMs must be surrounded in parallel with physical and IT security measures;

THAT the Banco Nacional de Fomento agreed with the client, under its responsibility, the use of ATMs of other financial institutions, which were provided with an interconnection system between themselves, such as BANRED, or other electronic channels to return the funds entrusted to its custody. Therefore, said bank had to evaluate and require that the ATMs enabled to deliver money from the debit cards of its savings or checking accounts delivered to its clients, have the appropriate security measures in order to be able to comply with its obligations as a custodian of the money that its users have entrusted to it;

THAT among the controls and security measures that the Banco Nacional de Fomento must take into account when offering services through electronic channels, is issuing timely alerts to avoid the possible commission of cybercrimes, therefore, financial institutions are obligated to put at the service of users policies for the dissemination of the conditions surrounding their use, including the implemented security measures and their possible risks when accessing said services, in this sense the cited bank cannot disclaim its responsibility for the integral control that minimizes the risk of exposure of its clients, nor the co-responsibility in the service offered by companies associated with the interbank payment network "BANRED";

THAT since the disputed withdrawals had a daily frequency, the Banco Nacional de Fomento should have applied what is established in numerals 12.3 and 12.4 of Article 12 of Section V.- Of due diligence and its procedures, Chapter IV.- Norms for financial system institutions on anti-money laundering prevention, Title XIII.- Of internal control, Book I.- General Norms for the application of the General Law of Institutions of the Financial System, of the Compilation of Resolutions mentioned in the preceding numeral, whose text states:

"ARTICLE 12.- Financial system institutions are obligated to apply due diligence procedures, which imply:

(...)

12.3 Establish the behavior profile considering all those own and habitual characteristics of the subject of analysis, associated with general information, mode of use of the institution's services and products, among others;

12.4 Carry out permanent monitoring processes of all transactions, in such a way that it is determined if the client's transactional behavior adjusts to the established transactional and behavior profiles;

(...)";

THAT regarding the argument that Mr. Simón Ernesto Vivas Bazurto did not apply basic security recommendations when using the electronic service, it must be emphasized that in the process of cloning a debit card, it is done by taking the information of financial users, through devices that are placed in the ATMs of the different financial institutions that provide this service, which do not have the appropriate anti-skimming security measures, so the financial user is not the one called to prove the good functioning of the ATMs, since the Banco Nacional de Fomento is the one providing this transactional service, therefore, the financial institution cannot disclaim its responsibility for the service offered;

THAT from the review and analysis carried out, it is derived that the Banco Nacional de Fomento transferred the responsibility for the facts to Mr. Simón Ernesto Vivas Bazurto for being the person who safeguards the card and passwords, without considering that the bank has the obligation not only to safeguard the deposited money, but also to provide security in the channels of the offered services. In this sense, it has been evidenced in the present case that the Banco Nacional de Fomento is incurring in Article 5 of Chapter IV, Title XX, Book I of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, in virtue that the transactions carried out on the client's account of said bank caused him economic harm, originated by an incorrect procedure of the controlled institution by not monitoring or implementing alerts on the movements that were occurring in the account entrusted to its custody, allowing the security controls of the debit card delivered by the bank to be violated;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0023 of January 14, 2015, recommended to the Banking Board to reject the claim contained in the review appeal filed;

AND IN exercise of its legal powers,

RESOLVES:

SINGLE ARTICLE.- REJECT the claim contained in the review appeal filed by Mrs. Ángela Mercedes Avilés Gómez, Commercial Manager of the Banco Nacional de Fomento, Guayaquil Branch; and, consequently, CONFIRM the administrative act contained in Official Letter No. IRG-DAyEU-V-R-2014-779, dated July 15, 2014, which ratifies Official Letter No. IRG-DAyEU-V-R-2014-298, dated April 10, 2014, through which the Regional Intendancy of Guayaquil ordered the Banco Nacional de Fomento to effect the return of the values claimed by Mr. Simón Ernesto Vivas Bazurto, whose amount amounts to USD $ 4,544.50.

NOTIFY.- Given in the Superintendence of Banks, in Quito, Metropolitan District, on May 27, 2015.

(Signature) Econ. Rodrigo Landeta Parra GENERAL INTENDANT, S/ PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on May 27, 2015.

(Signature) Lcdo. Pablo Cobo Luna SECRETARY OF THE BANKING BOARD

Banking Board of Ecuador