Banking Board of Ecuador

RESOLUTION No. JB-2015-3370

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitory Provision of the Organic Monetary and Financial Code, published in the Official Registry Second Supplement No. 332 of September 12, 2014, whose text states that resolutions contained in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by control bodies, will maintain their validity in all that does not oppose what is established in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and, with the second paragraph of the Third Transitory Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling as of the date of entry into force of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT Mrs. Sirlendy Isabel Mieles Moreira, through communication received by the control body on October 4, 2013, filed a complaint against Banco Pichincha C.A., through which she requests the Superintendence of Banks to order the aforementioned bank to return the sum of USD $303.36 corresponding to cash advances from her MasterCard Práctica credit card from Banco Pichincha C.A. No. 5189230001719462, basing her complaint on the following facts: a) That for more than a year she has been the holder of the MasterCard Práctica card from Banco Pichincha C.A., blocked since May 14, 2013, with a balance of US$ 54.81; b) That on April 15, 2013, she received her statement showing a cash advance of US$ 80.00 made on March 30, 2013, at the Centro branch, plus the value of $ 5.00 which she never withdrew; c) That she has not requested the PIN to make cash withdrawals with her credit card; d) That on the same day she contacted the entity's customer service to report this irregularity and also sent a complaint email; e) That in the following month's statement, it appeared that she had made two advances for the amounts of US$ 20.00 and US$ 60.00 at the Riocentro Sur branch, and she was charged US$ 10.00 for the withdrawals; f) That immediately she went to a branch of the institution where they indicated that on May 7, 2013, a third advance was made for the amounts of US$ 20.00 and US$ 60.00 with two additional fees totaling US$ 10.00 which she did not make; g) That she proceeded to block her credit card; h) That they showed her the videos of the moment when the contested advances were made to review if she or any of her acquaintances had made them, and they gave her a transaction report of her card, where it is appreciated that on March 30, 2013, the PIN was activated; i) That she did not make the objected advances, and that in fact these were made even after blocking on May 14, 2013, the card she had in her possession, which would demonstrate that she was a victim of cloning; j) That in the response to her complaint, the bank informed her that her complaint was not valid since it is her responsibility to handle and care correctly for her card; k) That despite multiple payment requests, she only paid on September 4, 2013, the amount of US$ 60.00 for the debt of US$ 54.81 that she had before these transactions occurred; l) That according to information she received, the current debt for unauthorized advances amounts to US$ 303.36;

THAT through letter No. DAyEU-ISFP-REQ-2013-1360 of November 1, 2013, the full content of the complaint filed against the aforementioned bank was forwarded to it, granting a term of 5 days to present the pertinent explanations and defenses; in response to said requirement, with letter N° BP-ACEC-2013-0958, received by the control body on December 2, 2013, the financial entity presented the explanations and defenses related to the claim presented by Mrs. Sirlendy Isabel Mieles Moreira, basing its action, mainly, on the following:

---

Resolution No. JB-2015-3370

Page 2

"(...) The credit card and personal PIN of Mrs. SIRLENDY ISABEL MIELES MOREIRA constitute the only mechanism to access the cash advance service through an ATM, so the strict custody and care taken with the card, as well as keeping the personal PIN secret, are exclusive responsibilities of the CARDHOLDER.

For the reasons stated, the Bank, in no way, can be held responsible for transactions made with the card or personal PIN of the CARDHOLDER. (...)";

THAT through letter No. IRG-DAYEU-V-R-2014-191 of March 19, 2014, the administrative resolution regarding the complaint presented by Mrs. SIRLENDY ISABEL MIELES MOREIRA was issued, where the Regional Intendancy of Guayaquil accepted the claimant's request, resolving to order BANCO PICHINCHA C.A. to proceed to return the sum of USD $240.00 corresponding to the unauthorized advances made with her credit card No. 5189230002609399; and, through communication received by this control body on April 1, 2014, the bank filed an appeal for reconsideration against the administrative act, which was rejected through letter No. IRG-DAYEU-V-R-2014-760 of June 14, 2014;

THAT with a document entered into the Superintendence on July 23, 2014, Mr. Antonio Acosta Espinosa, Adjunct President of Banco Pichincha C.A., with the professional sponsorship of Dr. Pablo Cadena Merlo, filed before the Banking Board an appeal for review against the administrative act contained in letter No IRG-DAYEU-V-R-2014-760 of June 14, 2014, arguing:

• Lack of motivation in the analysis of the grounds that supported the appeal for reconsideration.
• That taking into account that the client's personal PIN has the character of private, secret, and non-transferable, that is, that the PIN should only be known and handled by the holder, being the sole custodian of the debit card, and that said PIN and credit card constitute the only mechanism to access ATM services, it is clear that the institution has no responsibility regarding the cash advances subject to complaint, made through an ATM.
• That it is unnecessary for the Control Body in letter No. IRG-DAYEU-V-R-2014-191, to refer to what the client mentioned when she stated, "on the same day she contacted the entity's customer service to report this irregularity and also sent a complaint email," being the alleged irregularity a cash advance made through an ATM; Mrs. Mieles did not proceed to immediately block her credit card.
• That it is necessary to note that the client requested the blocking of her credit card on May 14, 2013, that is, more than a month after the date she filed the complaint for two consumptions made, therefore she is responsible for all and each of the transactions made with her credit card, until the moment she formally alerted the Bank, requesting the respective blocking or cancellation;

THAT through letter No. JB-2014-1962 of July 25, 2014, the Secretary of the Banking Board, accepted the appeal for review filed; and, with letter No. JB-2014-1963 of the same date, notified Mrs. Sirlendy Isabel Mieles Moreira regarding the acceptance of said appeal;

THAT the Superintendence of Banks, as the competent body, as established by articles 1 and 180, letter b) of the General Law of Institutions of the Financial System, as well as provided in article 5 of chapter IV regarding the "Procedure for the attention of

---

Resolution No. JB-2015-3370

Page 3

claims against Institutions of the Financial System", title XX "Of the Superintendence of Banks and Insurance", book I "General norms for the application of the General Law of Institutions of the Financial System" of the Codification of Resolutions of the Superintendence of Banks and Banking Board, has the function and attribution to ensure the stability, solidity, and correct functioning of institutions subject to its control; to supervise that they comply with the norms that govern them; and, to require that said institutions present and adopt the corresponding corrective measures when necessary; under this context, based on the referred legal and regulatory provisions, it is inferred that this control body has the legal and normative faculty to hear financial user claims, and in case of determining an incorrect procedure by the entities, to order the restitution of values to them, therefore the administrative acts it issues to resolve them, arise from the control and supervision attributions, in whose activity, the protection of public interests must be taken into account;

THAT from the documentation sent by the bank and by the claimant, it is appreciated that the transactions subject of the complaint were made according to the following detail:

Accounting Date:	2013/04/01	Transaction Date:	2013/03/30
Time:	161804	Sequence:	6207
ATM:	I922 CNTR.CENTRO 3	Card:	5189230002609399
Account:	0002609399	Transaction:	WITHDRAWAL
Requested:	80.00	Completed:	80.00
Bank:	00024	Terminal:	02060
Result:	SUCCESSFUL

Accounting Date:	2013/04/19	Transaction Date:	2013/04/18
Time:	151136	Sequence:	6173
ATM:	I036 RIO CENT. SUR-4	Card:	5189230002609399
Account:	0002609399	Transaction:	WITHDRAWAL
Requested:	60.00	Completed:	60.00
Bank:	00024	Terminal:	02060
Result:	SUCCESSFUL

Accounting Date:	2013/04/19	Transaction Date:	2013/04/18
Time:	151209	Sequence:	6174
ATM:	I036 RIO CENT. SUR-4	Card:	5189230002609399
Account:	0002609399	Transaction:	WITHDRAWAL
Requested:	20.00	Completed:	20.00
Bank:	00024	Terminal:	02060
Result:	SUCCESSFUL

Accounting Date:	2013/05/08	Transaction Date:	2013/05/07

---

Resolution No. JB-2015-3370

Page 4

Time:	113955	Sequence:	8844
ATM:	1249 AERO-GYQ-2	Card:	5189230002609399
Account:	0002609399	Transaction:	WITHDRAWAL
Requested:	60.00	Completed:	60.00
Bank:	00024	Terminal:	02060
Result:	SUCCESSFUL

Accounting Date:	2013/05/08	Transaction Date:	2013/05/07
Time:	114308	Sequence:	8848
ATM:	1249 AERO-GYQ-2	Card:	5189230002609399
Account:	0002609399	Transaction:	WITHDRAWAL
Requested:	20.00	Completed:	20.00
Bank:	00024	Terminal:	02060
Result:	SUCCESSFUL

THAT regarding the argument about the lack of motivation, it must be pointed out that letter IRG-DAYEU-V-R-2014-760 of June 14, 2014, contemplates the legal and regulatory provisions that support the resolution, consequently the alleged lack of motivation does not apply;

THAT in reference to the argument that the client's personal PIN has the character of private, secret, and non-transferable, that is, that the PIN should only be known and handled by the holder, being the sole custodian of the debit card; the user in her complaint stated that "(...) she had never activated a PIN at an ATM to withdraw cash from that credit card (...)" regarding this, the controlled institution has not disproven this assertion, as it has not attached to the file the PIN request or the contract for electronic services and products signed by the claimant;

THAT it is necessary to refer to integral risk management, which is one of the responsibilities attributed to institutions that are part of the Financial System, by virtue of which, article 3 of chapter I "Of integral management and risk control", title X "Of risk management and administration", book I "General Norms for Institutions of the Financial System", establishes the following:

"ARTICLE 3.- Financial system institutions have the responsibility to manage their risks, to which effect they must have formal integral risk management processes that allow identifying, measuring, controlling / mitigating, and monitoring the risk exposures they are assuming.";

THAT in line with what is referred to, although the client is the custodian of the card issued by the bank and the only responsible for its use, in the case at hand, it is not evident that Mrs. Sirlendy Isabel Mieles Moreira has compromised the security of her debit card, issued by the controlled entity, at any time;

THAT literal a) of article 51 of the General Law of Institutions of the Financial System, in force at the date of presentation of this appeal, stated that banks are authorized to "Receive public resources in demand deposits. Demand deposits are banking obligations, comprising monetary deposits payable upon presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings books or other payment and registration mechanisms".

---

Resolution No. JB-2015-3370

Page 5

THAT the above is reinforced by what is determined in the Constitution of the Republic of Ecuador in its article 308 which says "(...) Financial activities are a public order service, and may be exercised, with prior authorization of the State, in accordance with the law; they will have the fundamental purpose of preserving deposits and meeting financing requirements for the achievement of the country's development objectives. (...)";

THAT from the cited regulatory framework, it is determined that the bank assumes the obligation to satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for other services offered to its clients, it is obliged to evaluate and demand the necessary securities in order to fulfill its obligations as a custodian of the money that its clients have entrusted to it. Regarding this, it is necessary to specify that the use of ATMs arises from the contract that the bank and the client have signed for this effect, hence the responsibility of the financial institution regarding events such as the one that motivated the appealed resolution;

THAT Banco Pichincha C.A. intends to transfer to the financial user the risks inherent to the organization and execution of the ATM service offered by the institution, by holding her responsible for the withdrawals made from them, for having compromised the custody and keys of her debit card, facts of which there is no record in the case file at hand;

THAT the main foundation exposed by the claimant is that the card was always under her custody, for this reason she did not report it as stolen, because she always had it in her possession, however on May 14, 2013, she proceeded to block the card since cash advances continued to appear charged to her statement. It has not been demonstrated that the user failed to fulfill her obligations to custody the credit card and keep the PIN secret, nor has the good faith employed by the financial user when using the services offered by the controlled entity been considered;

THAT it is necessary to cite paragraphs 37.2 and 37.3 of article 37, chapter I, title II, book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, which among other security measures, financial entities must have the following:

"ARTICLE 37.- Regarding video surveillance systems (cameras), it must be considered that:

(...) 37.2 Fixed location cameras, at a minimum, must adequately cover the places of access to the public and staff of the financial institution and the customer service counters; and,

37.3 Image recording and storage systems must guarantee the archive of at least three (3) months of recording, through tapes, digital video discs (DVD) or any other system (...)";

THAT the above is reinforced by what is expressed in paragraph 39.12, of article 39, chapter I, title II, book I of the Codification ibidem, which establishes the following:

"ARTICLE 39.- ATMs of financial institutions must comply with the following security measures:

(...) 39.12 Image recording or archive system. - Financial institutions must maintain an archive of tapes, digital video discs (DVD) or any other recording system or its equivalents in photographic cameras that covers at least ninety (90) days of image archive (...)";

---

Resolution No. JB-2015-3370

Page 6

THAT it is necessary to cite article 5, of chapter IV "Procedure for the attention of claims against Institutions of the Financial System", title XX "Of the Superintendence of Banks and Insurance", book I "General norms for the application of the General Law of Institutions of the Financial System", of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, which empowers the control body to order the return of the values claimed by the controlled institutions, in exercise of the functions and attributions that both constitutional and legal norms establish, since it provides that:

"(...) If the situation that motivated the claim referred to in the previous paragraph, originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of article 180 of the General Law of Institutions of the Financial System, granting the legal representative of the entity a term that cannot exceed fifteen (15) days from the notification to send, under the legal warnings, the proof of compliance with the order issued.

For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the credit card issuing institution or where the client maintains their account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred.";

THAT Banco Pichincha C.A., entity depositary and custodian of its clients' money, by placing various services at the disposal of its users, has the legal obligation that in this case, the ATM channel, whether its own or third-party, provides its clients with all the securities that the case requires, which do not reside only in the use of the secret PIN but also in the inviolability of the magnetic card delivered and, of the ATMs; so in this case, the banking institution incurred in an incorrect procedure by which its security measures were violated, without in this case it having been evidenced or documented that the cardholder made the transactions or that there was carelessness or mishandling of the debit card by the claimant;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0210 of March 13, 2015, recommended to the Banking Board to reject the request contained in the appeal filed by the Adjunct President of Banco Pichincha C.A.; and,

IN exercise of its legal attributions,

RESOLVES:

SINGLE ARTICLE.- REJECT the request contained in the appeal for review presented by Mr. Antonio Acosta Espinosa, Adjunct President of Banco Pichincha C.A.; and, consequently CONFIRM the administrative act contained in letter No. IRG-DAYEU-V-R-2014-760 of June 14, 2014, through which the Regional Intendancy of Guayaquil rejected the appeal for reconsideration filed, and resolved to ratify the administrative act contained in letter No. IRG-DAYEU-V-R-2014-191 of March 19, 2014, in which it was resolved "2. ORDER the financial institution BANCO PICHINCHA C.A. to proceed to return to Mrs. SIRLENDY ISABEL MIELES MOREIRA the sum of US$ 240.00 (TWO HUNDRED FORTY 00/100 DOLLARS OF THE UNITED STATES No. 5189XXXXXXXX9399), of the unauthorized advances made with her credit card, and send to this Office, within a term of eight days,

---

Resolution No. JB-2015-3370

Page 7

counted from the receipt of this letter, the documentation that accredits the compliance with this resolution."

NOTIFY.- Given at the Superintendence of Banks and Insurance, in Quito, Metropolitan District, on the twenty-second of April of the two thousand fifteen.

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT (S)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on the twenty-second of April of the two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD