Resolution No. JB-2015-3466 of the Banking Board of Ecuador

Banking Board of Ecuador

RESOLUTION No. JB-2015-3466

THE BANKING BOARD

CONSIDERING:

THAT Mrs. María Belén Santacruz Shinin filed an administrative complaint against Banco Nacional de Fomento on October 23, 2013, requesting that the Superintendency of Banks order the aforementioned financial institution to return the values corresponding to cash withdrawals that were not made by her;

THAT through letter No. DAYEU-ISFP-REQ-2013-1447 of November 13, 2013, the full content of the complaint filed against the aforementioned bank was forwarded to it, granting it a term of 5 days to present relevant explanations and defenses; in response to said requirement, through letter s/n of November 20, 2013, and letter No. 041-2013-GZG-BNF of December 10, 2013, received by the control body on December 12 of the same year, the financial entity presented the explanations and defenses related to the claim presented by Mrs. María Belén Santacruz Shinin;

THAT through letter No. IRG-DAyEU-V-R-2014-524 of May 29, 2014, the administrative resolution regarding the complaint presented by Mrs. MARIA BELÉN SANTACRUZ SHININ was issued, where the Regional Intendancy of Guayaquil accepted the claimant's petition, resolving to order BANCO NACIONAL DE FOMENTO to proceed to restore the sum of USD $1,114.50 corresponding to cash withdrawals not made with her debit card No. 6031600031007136;

THAT through communication s/n, received by this control body on June 17, 2014, BANCO NACIONAL DE FOMENTO filed a request for reconsideration against the administrative act contained in letter No. IRG-DAyEU-V-R-2014-524 of May 29, 2014;

THAT through letter No. IRG-DAyEU-V-R-2014-894 of August 15, 2014, the Regional Intendancy of Guayaquil rejected the request for reconsideration filed by the financial entity on June 17, 2014, and resolved to confirm the content of letter No. IRG-DAyEU-V-R-2014-524 of May 29, 2014;

THAT through communication and addendum entered into this Superintendency on September 1 and 17, 2014, respectively, engineer Jamil Cevallos Defranc, Acting Commercial Manager of Banco Nacional de Fomento, with the professional sponsorship of lawyer María Angélica Pazmiño Muñoz, filed before the Banking Board a request for review against the administrative act contained in letter No. IRG-DAyEU-V-R-2014-894 of August 15, 2014, arguing mainly:

"(...) 1.- Banco Nacional de Fomento has fully complied with the requirements formulated by the Subdirector of User Attention of the Superintendency of Banks and Insurance, delivering all the documentation requested, which I insist has not been considered in any way by the indicated Administrative Authority.

---

Banking Board of Ecuador

Resolution No. JB-2015-3466 Page 2

2.- That in the Resolution issued by the Subdirector of User Attention of the Superintendency of Banks and Insurance, the constitutional principle of motivation has been evidently violated, by not giving a sense of justice to the legal norms invoked in the resolution; in this sense, it is worth indicating that justice and motivation are concepts that undoubtedly must be observed obligatorily by the Administrative Authority in the case at hand (...)."

"(..) 3.- The sanctions imposed by the Superintendency of Banks and Insurance will be within the scope of its administrative competence, so it is estimated that it does not correspond to that Control Body to order the refund of the value of US$ 1,114.50 dollars, all the more so since the Superintendencies by constitutional principle are: TECHNICAL ORGANISMS OF SURVEILLANCE, AUDIT, INTERVENTION AND CONTROL.

The client, Mrs. MARÍA BELÉN SANTACRUZ SHININ, as I have been able to prove in this administrative proceeding, is the sole and exclusive responsible party for the handling, care, and/or custody of the debit card and for compliance with the terms of the agreement and, in particular, for any correct use thereof, which results in the claim made lacking legal and moral foundation and therefore there is also no basis to order the refund of values (...)"

Within the petitions in point 3, it indicates and requests:

"IN REASON THAT IN YOUR RESOLUTION IT DETERMINES THAT IT IS A CLONATION OF THE DEBIT CARD, WHICH IMPLIES THE PRESUMPTION OF EXISTENCE OF SAID CRIME, CONSEQUENTLY YOU MUST FORWARD TO THE COMPETENT BODY, SO THAT THE ATTORNEY GENERAL'S OFFICE OF THE STATE, WHO WILL BE IN CHARGE OF PROCESSING THE CASE AND DETERMINE THE AUTHORS, ACCOMPLICES, AND CONCEALERS OF THE PRESUMPTIVELY MALICIOUS FACT DENOUNCED":

THAT through letter No. JB-2014-2562 of September 22, 2014, the Secretary of the Banking Board accepted the request for review filed; and, with letter No. JB-2014-2563 of the same date, notified Mrs. María Belén Santacruz Shinin regarding the acceptance of said request;

THAT through memorandum No. SAL-2014-00257 of September 26, 2014, the Subdirection of Legal Advice of the National Legal Directorate of this Intendancy requested the technical criterion of the Regional Intendancy of Guayaquil, regarding the foundations of the request for review filed against the administrative act contained in letter No. IRG-DAyEU-V-R-2014-894 of August 15, 2014;

THAT through letter No. IRG-DAYEU-2014-346 of October 30, 2014, the Regional Intendancy of Guayaquil sent the requested report, indicating that the challenged administrative act was based both on the constitutional regulatory framework and the legal framework in force at the date of its issuance, and ratified letter No. IRG-DAyEU-V-R-2014-894 of August 15, 2014, and in its core part stated that:

"(...) it is determined that Banco Nacional de Fomento assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for the other services offered to its clients; it is obliged to evaluate and demand the necessary security measures in order to be able to fulfill its obligations as a depositary of the money that its clients have entrusted to it.

Likewise, it is worth mentioning that comprehensive risk management is one of the responsibilities attributed to institutions that are part of the Financial System, by virtue of which, the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, in Book I, Title X "On the management and administration of risks", Chapter I "On comprehensive management and control of risks" establishes in its third article the following: (...);"

THAT this challenge is resolved in accordance with the First Transitional Provision of the Organic Code of Monetary and Financial Law, published in the Official Register Second Supplement No. 332 of September 12, 2014, whose text states that the resolutions contained in the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, and the norms issued by the control bodies, will remain in force in all that does not oppose what is provided in the Organic Code of Monetary and Financial Law, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all complaints, appeals, and other administrative procedures that it was hearing on the date of entry into force of the same, within a term of one hundred eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT the Superintendency of Banks, as the competent body, in accordance with articles 1 and 180, letter b) of the General Law of Financial System Institutions, as well as what is provided in article 5 of Chapter IV regarding the "Procedure for the attention of complaints against Financial System Institutions", Title XX "On the attention of Banks and Insurance", Book I "General norms for the application of the General Law of Financial System Institutions" of the Codification of Resolutions of the Superintendency of Banks and Banking Board, has the function and attribution to ensure the stability, solidity, and correct functioning of institutions subject to its control; to supervise that they comply with the norms that govern them; and to require that said institutions present and adopt the corresponding corrective measures when necessary; under this context, based on the referred legal and regulatory provisions, it is inferred that the control body has the legal and normative faculty to hear the complaints of financial users, and in case of determining an incorrect procedure by the entities, to order the restitution of values to them, therefore the administrative acts issued to resolve them arise from the attributions of control and supervision, in whose activity, the protection of the public's interests must be taken into account;

THAT reference is made in the request for review filed by the Bank that, by virtue of the Resolution issued by the Superintendency of Banks dealing with a donation of the debit card, which constitutes a criminal offense whose responsibility must be determined by the competent body, it should be forwarded to the Attorney General's Office of the State, who will be in charge of processing the case and determine the authors, accomplices, and concealers of the presumptively malicious fact denounced. It is worth mentioning that the

---

Banking Board of Ecuador

Resolution No. JB-2015-3466 Page 4

control body was based on the same proofs sent by the bank to determine the presumption of cloning in the debit card;

THAT from the documentation sent by the bank, it is determined that the transactions subject of the present complaint were carried out between July 28 and September 3, 2013, in automated teller machines belonging to the following financial entities: Banco de Machala S.A., Banco de Pichincha C.A., Banco de Guayaquil S.A., Banco Internacional S.A., Cooperativa de Ahorros y Crédito Juventud Ecuatoriana Progresista, and Banco Bolivariano C.A.;

THAT the following assertions are in the file, which corroborate that the claimant's card was compromised: From the Review Report related to customer complaints regarding transactions not made in automated teller machines, which contains the review of the complaint of Mrs. María Belén Santacruz Shinin, signed by engineer Roberto Silva, Submanager of Operational Risk, it is mainly stated as follows:

"According to the review carried out on the security incidents presented in automated teller machines and reported by the Institutions members of the BANRED Security Committee, a possible coincidence with an ATM used by the client has been observed:

1. On August 16, 2013, the BANRED Security Committee reports ATM 19 of Banco de Machala as a possible point of compromise on the dates of 14/07/2013 to 10/08/2013, upon notification by Banco Bolivariano and the Cooperativa Juventud Ecuatoriana Progresista; who indicate that cardholders filed complaints for unusual withdrawals and that they transacted in the previously indicated period (...)."

"(...) However, the client accessed automated teller machines of other Banks where there could have been a possible compromise of the information of his debit card (...)."

THAT additionally, the reports made by Banco Bolivariano C.A. and Banco del Austro to the BANRED Security Committee regarding possible security compromises of ATM No. 19 located at Av. 8 de abril 527 and Morzal Safadi in the canton of El Triunfo, belonging to Banco de Machala S.A., are evident, on the dates of July 14 to August 08, 2013. Likewise, there is a communication sent by the BANRED Security Committee which also points out as possible compromised ATMs No. 12 and No. 26 of the aforementioned financial institution;

THAT finally, as another proof, the videos sent by Banco Nacional de Fomento of the two withdrawals made at Banco de Guayaquil S.A. at 11:13:05 am and 11:13:55 am on September 2, 2013, show irregularities such as the use of a blue debit or credit card that does not have the logo of Banco Nacional de Fomento and that it is carried out by a man with a suspicious attitude, hiding the card he uses with a white paper;

THAT from the review of the documentation sent by the bank, it is observed that Mrs. María Belén Santacruz Shinin constantly made automatic withdrawals at ATM No. 19 of Banco de Machala S.A., and in the case at hand, she made withdrawals at the aforementioned

---

Banking Board of Ecuador

Resolution No. JB-2015-3466 Page 5

ATM since July 8, 2013, a date on which the ATM, according to what is stated in the previous point, was used while it was reported as a compromised ATM;

THAT regarding the bank's argument, related to the fact that the client's personal key has the character of secret and non-transferable, that is, that it should only be known and handled by its holder, it is worth noting that, although it is true, the client is the custodian of the card issued by the bank and the sole responsible for its use; however, in the case at hand, it is not evidenced that Mrs. María Belén Santacruz Shinin compromised the security of her debit card, issued by the controlled entity, at any time. Likewise, it is worth indicating that if the claimant user used Banred ATMs, it is due to a service that the bank made available to its clients;

THAT letter a) of article 51 of the General Law of Financial System Institutions, in force at the date of presentation of this appeal, states that banks are authorized to "Receive public resources in demand deposits. Demand deposits are banking obligations, comprising monetary deposits payable upon presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings books or other payment and registration mechanisms". This is reinforced by what is determined in the Constitution of the Republic of Ecuador in its article 308 which says "(...) Financial activities are a public order service, and may be exercised, with prior authorization of the State, in accordance with the law; they will have the purpose of preserving deposits and attending financing requirements for the achievement of the country's development objectives. (...)" (emphasis added);

THAT from the cited regulatory framework, it is determined that the bank assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for the other services offered to its clients; it is obliged to evaluate and demand the necessary security measures in order to be able to fulfill its obligations as a depositary of the money that its clients have entrusted to it;

THAT in this regard, it is necessary to clarify that the contracts celebrated between the financial system institutions and service providers, with the aim of providing their clients with broader coverage of automated teller machines, are the exclusive responsibility of such entities, not being able to transfer the operational risk of said service to the users, since this is offered as part of the facilities given by the banking entities to their clients, being thus the obligation of the controlled institution to take all pertinent precautions and security measures;

THAT according to what is referred to, the Codification of Resolutions of the Superintendency of Banks and the Banking Board, in its Book I "General norms for the application of the General Law of Financial System Institutions", Title X "On the management and administration of risks", Chapter I "On comprehensive management and control of risks" establishes in its third article the following:

"ARTICLE 3.- The institutions of the financial system have the responsibility to manage their risks, to which effect they must have formal processes of comprehensive risk management that allow identifying, measuring, controlling/mitigating, and monitoring the risk exposures they are assuming";

---

Banking Board of Ecuador

Resolution No. JB-2015-3466 Page 6

THAT Banco Nacional de Fomento intends to transfer to the financial user the risks inherent to the organization and execution of the automated teller machine service offered by the institution, by holding her responsible for the withdrawals made from them, for having compromised the custody and keys of her debit card, facts of which there is no record in the file of the case at hand;

THAT it is necessary to cite article 5, of Chapter IV "Procedure for the attention of complaints against Financial System Institutions", Title XX "On the Superintendency of Banks and Insurance", Book I "General norms for the application of the General Law of Financial System Institutions", of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, which empowers this Control Body to order the return of the values claimed by the controlled institutions, in exercise of the functions and attributions that both the constitutional and legal norms establish, since it provides that:

"(...) If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendency of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of article 180 of the General Law of Financial System Institutions, granting the legal representative of the entity a term that may not exceed fifteen (15) days from the notification to send, under the legal warnings, the proof of compliance with the order issued.

For complaints of unauthorized withdrawals due to evidence of attempts or frauds produced in automated teller machines, the Superintendency of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client maintains their account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the automated teller machine due to whose defects or lack of security measures the fraud occurred."

THAT it is worth indicating that neither in the request for reconsideration nor in the request for review filed by the bank were new proofs presented, as established in article 3 of Chapter II, Title XVI of Book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, which establishes: "the request for reconsideration must be based only on the existence of elements of fact or law not known to the Superintendency of Banks and Insurance or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution", a norm that the Bank did not consider. Notwithstanding this blatant non-observance by the appellant, for the processing of the request for reconsideration raised, this control body considered the information sent as well as all that rests in the file and the arguments of fact and law raised in the request, and rejected it by virtue of its analysis;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0162 of February 18, 2015, recommended to the Banking Board to reject the petition contained in the request filed by the Acting Commercial Manager of Banco Nacional de Fomento; and,

---

Banking Board of Ecuador

Resolution No. JB-2015-3466 Page 7

IN exercise of its legal attributions,

RESOLVES:

SINGLE ARTICLE.- REJECT the petition contained in the request for review presented by engineer Jamil Cevallos Defranc, Acting Commercial Manager of Banco Nacional de Fomento; and, consequently CONFIRM the administrative act contained in letter No. IRG-DAyEU-V-R-2014-894 of August 15, 2014, through which the Regional Intendancy of Guayaquil rejected the request for reconsideration filed, and resolved to ratify the administrative act contained in letter No. IRG-DAyEU-V-R-2014-524 of May 29, 2014, in which it was resolved "2. ORDER the controlled financial institution BANCO NACIONAL DE FOMENTO to proceed to restore to Mrs. MARÍA BELÉN SANTACRUZ SHININ the sum of US$ 1,114.50 (ONE THOUSAND ONE HUNDRED FOURTEEN AND 50/100 DOLLARS OF THE UNITED STATES OF AMERICA), debited from the checking account (sic) No. 084001820-1 on the days of July 28, 2013 to September 03, 2013, being able to exercise its right of recourse against the institutions owning the automated teller machines where the contested withdrawals occurred, and send to this Office, within a term of eight days, counted from the receipt of this letter, the documentation that accredits the compliance with this resolution."

NOTIFY.- Given at the Superintendency of Banks and Insurance, in Quito, Metropolitan District, on June 4, 2015.

(Signature) Econ. Rodrigo Landeta Parra GENERAL INTENDANT (S) PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on June 4, 2015.

(Signature) Lcdo. Pablo Cobo Luna SECRETARY OF THE BANKING BOARD