Banking Board of Ecuador

RESOLUTION No. JB-2015-3413

THE BANKING BOARD

CONSIDERING:

THAT the second paragraph of the Third Transitional Provision of the Organic Monetary and Financial Code determines that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was hearing as of the date of entry into force of this Code, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT through Resolution No. 054-2015-F, dated March 5, 2015, published in the Official Register No. 467, dated March 27, 2015, the aforementioned period has been extended by an additional one hundred and eighty days;

THAT through a communication dated September 9, 2013, Mr. Freddy Pío Contreras Salvatierra filed a claim against the National Development Bank (Banco Nacional de Fomento) with the aim that the regulatory body order the aforementioned financial institution to return the sum of "1,366.00" for unauthorized withdrawals made through ATMs. The claimant maintains that between August 31 and September 3, 2013, withdrawals were made from his account through ATMs without his authorization;

THAT with regard to the aforementioned claim, the Regional Intendancy of Guayaquil, through Letter No. SBS-IRG-DAYEU-V-R-2014-154, dated March 10, 2014, resolved as follows:

"(...) 2. ORDER the NATIONAL DEVELOPMENT BANK to proceed to return to Mr. FREDDY PÍO CONTRERAS SALVATIERRA the sum of... (US$1,165.00)... debited from savings account No. 0060121262...";

THAT through a communication entered into the Superintendency of Banks on March 26, 2014, the National Development Bank filed an appeal for reconsideration against Letter No. IRG-DAYEU-V-R-2014-154, dated March 10, 2014. Through Letter No. IRG-DAYEU-V-R-2014-671, dated June 24, 2014, the Regional Intendancy of Guayaquil rejected the claims contained in the aforementioned appeal for reconsideration and ratified the content of Letter No. IRG-DAYEU-V-R-2014-154, dated March 10, 2014;

THAT through a communication entered into the Superintendency of Banks on July 8, 2014, Mr. Mario Benites Morán, Commercial Manager of the National Development Bank Milagro Branch, filed before the Banking Board an appeal for review against Letter No. IRG-DAYEU-V-R-2014-671, dated June 24, 2014;

THAT the customer delivers money to a financial institution with the option to withdraw it, in part or in full, at the time he requires it, while the depositary entity assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all those withdrawal operations required by the holder, with diligence and professional care;

---

Resolution No. JB-2015-3413

Page 2

THAT the comprehensive risk management is one of the responsibilities attributed to institutions that are part of the Financial System, in such virtue, the Codification of Resolutions of the Superintendency of Banks and the Banking Board, in its articles 2 and 3 of chapter I, of title X, of book I, provides as follows:

"Article 2.- For the purposes of the application of this chapter, the following definitions are determined:

2.1 Risk.- It is the possibility that an event generating losses that affect the economic value of institutions occurs;

2.2 Risk Management.- It is the process through which financial system institutions identify, measure, control/mitigate, and monitor the risks inherent to the business, with the objective of defining the risk profile, the degree of exposure that the institution is willing to assume in the development of the business, and the hedging mechanisms, to protect its own resources and those of third parties that are under its control and administration;

(...)

2.9 Operational Risk.- It is the possibility that losses occur due to events originating from failures or insufficiency of processes, people, internal systems, technology, and in the presence of unforeseen external events. It includes legal risk but excludes systemic and reputation risks.

It groups a variety of risks related to internal control deficiencies; inadequate systems, processes, and procedures; human errors and frauds; failures in computer systems; occurrence of adverse external or internal events, that is, those that affect the institution's ability to respond to its commitments in a timely manner, or compromise its interests;

ARTICLE 3.- Institutions of the financial system have the responsibility to manage their risks, to which effect they must have formal comprehensive risk management processes that allow identifying, measuring, controlling/mitigating, and monitoring the risk exposures they are assuming.

(...)

THAT within the file is the review report of the customer's claim regarding transactions made through ATMs, signed by Mr. Roberto Silva, Submanager of Operational Risk of the National Development Bank, from which the following is derived:

"(...) According to security incidents in ATMs of vandalism, skimming, or malware evidenced and reported by the

---

Resolution No. JB-2015-3413

Page 3

member institutions of the BANRED Security Committee, and received by our institution since the beginning of the review period, a possible coincidence with an ATM used by the customer (...) has been evidenced;"

THAT from the transcribed report it is inferred that in the present case there was likely cloning of Mr. Freddy Pío Contreras Salvatierra's debit card and that the decision of the National Development Bank to deny the return of the withdrawals challenged by the claimant is based on the fact that, according to the entity, the situation presented occurred because the user would have compromised his card information when he made transactions in ATMs of other financial institutions associated with BANRED. From what is stated, it is derived that, in the present case, the National Development Bank would be assimilating the breach of the duty to safeguard the debit card and keep the PIN confidential to the use of BANRED ATMs;

THAT it is also not appropriate to hold Mr. Freddy Pío Contreras Salvatierra responsible for the possible cloning of the debit card, based solely on the fact that the claimant used the card at ATMs of banks associated with BANRED, that is, in the manner he was contractually authorized to do so; this situation, by itself, does not constitute non-observance of the obligation to care for the card and keep the PIN confidential, nor does it exonerate the banking entity from its obligation to be a guarantor and custodian of the money deposited with it, nor does it transfer to the user the risks inherent to the organization and execution of the ATM service;

THAT it is worth highlighting that the contracts celebrated between the institutions of the financial system with BANRED, among other service providers, with the aim of providing their customers with broader ATM coverage, are the exclusive responsibility of such entities, not being able to transfer the operational risk of said service to the users, since this is offered on behalf of and as part of the facilities granted by the banking entities to their customers;

THAT the use by Mr. Freddy Pío Contreras Salvatierra of BANRED ATMs cannot be assimilated as error, misuse, negligence, or breach, on the part of the claimant, to the obligations to safeguard the debit card with utmost diligence and to keep the respective PIN confidential, nor did it transfer to him the risks inherent to the organization and execution of the service supplied by the National Development Bank, nor does it exonerate the banking entity from its obligation to be a guarantor and custodian of the money deposited with it;

THAT it is appropriate to highlight that the National Development Bank is the custodian of its customers' money and that operating through BANRED does not absolve it of the responsibility to care for deposits and be responsible for the services provided;

---

Resolution No. JB-2015-3413

Page 4

THAT through a communication entered into the Superintendency of Banks on August 8, 2014, Mr. Freddy Pío Contreras Salvatierra maintains that Letter No. IRG-DAYEU-V-R-2014-671, dated June 24, 2014, which confirms Letter No. IRG-DAYEU-V-R-2014-154, dated March 10, 2014, orders the National Development Bank to return USD 1,165.00; however, the total value of the damage caused, according to his latest version, reaches the sum of USD 1,366.00. He supports his assertion with an illegible copy of his savings book. Regarding this, it is necessary to refer to the claim letter signed by Mr. Freddy Pío Contreras Salvatierra, entered into the regulatory body on September 9, 2013, in which a specific complaint is evidenced regarding twelve debits from account No. 0060121262 reaching the sum of USD 1,165.00, between August 31 and September 3, 2013; therefore, that is the definitive value that the National Development Bank must return to the claimant;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0081 of February 2, 2015, recommended to the Banking Board to reject the claim contained in the appeal for review filed;

AND, in exercise of its legal powers,

RESOLVES:

SINGLE ARTICLE.- REJECT the petition contained in the appeal for review filed; and, consequently, RATIFY Letter No. IRG-DAYEU-V-R-2014-671, dated June 24, 2014, with which the content of Letter No. IRG-DAYEU-V-R-2014-154, dated March 10, 2014, was confirmed.

NOTIFY.- Given at the Superintendency of Banks, in Quito, Metropolitan District, on the thirteenth of May of two thousand fifteen.

---

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT, S
PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on the thirteenth of May of two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD