Banking Board of Ecuador

RESOLUTION No. JB-2015-3454

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Code of Monetary and Financial Affairs, published in the Official Register Second Supplement No. 332, of September 12, 2014, whose text states that resolutions contained in the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by the control bodies, will remain in force in everything that does not oppose what is provided in the Organic Code of Monetary and Financial Affairs, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was hearing on the date of its entry into force, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT on October 21, 2013, Mr. Manuel Mesías Castillo Calva, filed an administrative claim before the control body, against the National Development Bank (Banco Nacional de Fomento), through which he requests that it order the aforementioned banking entity to return the sum of US$ 491.50 corresponding to unauthorized debits by the user, charged to his savings account No. 4003803578, basing his claim on "That on September 18 and 19, 2013, I found the novelty that approximately $500.00 dollars had been withdrawn from my savings account through some Banred ATMs of private banking, therefore I request that through your authority order whoever corresponds the immediate return of my money (...)";

THAT through Office No. DAyEU-ISFP-REQ-2013-1434 of November 12, 2013, the Regional Intendancy of Guayaquil notified the National Development Bank of the claim filed against it, and requested several defenses and information, which would contribute to this Superintendence to have sufficient evidence and instruments to issue the corresponding resolution; and with Office No. 043-2013GZGBNF of December 12, 2013, received at the Superintendence of Banks on December 16, 2013, the National Development Bank presented the explanations and defenses related to the claim filed, basing its action, mainly, on the following:

"Annex 3. Attached:

Email, through which the management is carried out with the contact of Bolivarian Bank and Guayaquil Bank requesting the audit tapes, however, to the present date we have not had a response regarding this, once we have this information we will be sending it immediately.

4 List of account movements of the client, of the last three months prior to the claimed transactions Annex 4

5 Copy, in DVD format, of the videos of the automatic teller machines in which the claimed withdrawals were made, with the data of the recording system itself

---

Resolution No. JB-2015-3454

Page No. 2

indicating date, time, and location. If the videos are not possessed, evidence of the requests made to the entities owning the ATMs in which the withdrawals were made, in order to obtain the copy of the videos and the follow-up on said orders until their attention

Annex 5. Attached

CD sent by Guayaquil Bank with the requested images. Email, through which the management is carried out with the contact of Bolivarian Bank requesting the videos of the claimed transactions, however, to the present date we have not had a response regarding this, once we have this information we will be sending it immediately. Annex 3

6 Report if the automatic teller machines used by your client in the month of the refuted transactions, had anti-skimming programs and/or devices (whether their own or from other entities or networks to which the entity gave access).

Attached

Email, through which the management is carried out with the contact of Bolivarian Bank and Guayaquil Bank requesting if they have anti-skimming programs and/or devices; however, to the present date we have not had a response regarding this, once we have this information we will be sending it immediately Annex 3

7 Report of the transactions carried out in automatic teller machines in the month in which the claimed debits occurred, with detail of number and physical location of the ATM (full address), entity owning the ATM, date and time of the transaction, date of registration or charge to the client's account, amount and result of the transaction (successful or failed) Annex 6.

(...)

It is worth informing that it cannot be established in this type of claims that all cases are cloning, despite having information and videos, because the Bank in similar cases has been able to verify that the claimed withdrawals are made by people from the client's environment, and in other cases they have been misuse of the debit card."

THAT with Office No. IRG-DAyEU-V-R-2014-361 of April 30, 2014, the Regional Intendancy of Guayaquil accepted the claimant's petition, resolving to order the NATIONAL DEVELOPMENT BANK to proceed to restore US$ 491.50 dollars for the concept of value debited without authorization from the savings account No. 4003803578, which the claimant maintains in the aforementioned bank, being able to exercise its right of recourse against the institutions owning the automatic teller machines in which the challenged withdrawals occurred (...)" and through a document received at the control body on May 15, 2014, the Bank filed an appeal for reconsideration against the aforementioned office;

---

Resolution No. JB-2015-3454

Page No. 3

THAT through Office No. IRG-DAyEU-V-R-2014-786 of July 16, 2014, the Regional Intendancy of Guayaquil resolved to REJECT the petition contained in the appeal for reconsideration filed; and, consequently, CONFIRM the administrative act contained in Office No. IRG-DAyEU-V-R-2014-361 of April 30, 2014, for the motivation contained therein; and, through a document entered into this Superintendence on July 31, 2014, the engineer Roberto Enrique Arce Icaza, Head Commercial Manager of the El Triunfo Branch of the National Development Bank, filed before the Banking Board an appeal for review against the administrative act contained in Office No. IRG-DAyEU-V-R-2014-786 of July 16, 2014; which was accepted for processing by lawyer Juan Francisco Simone Lasso, Secretary of the Banking Board (s), through Office No. JB-2014-2128 of August 11, 2014;

THAT the appellant in his writing argues:

• That "(...) the client Mr. MANUEL MESIAS CASTILLO CALVA, is the sole and exclusive responsible for the handling and care of the card and for compliance with the terms of the agreement and in particular for any correct use, which results in the claim made lacking legal and moral foundation, therefore there is also no basis to order the reimbursement of values.";

• That "The evidence provided by the National Development Bank has not been considered by the Regional Intendant of Guayaquil when issuing his resolution in the present administrative process, filed by Mr. MANUEL MESIAS CASTILLO CALVA, rather he rejects the appeal for reconsideration filed by the banking institution he represents and confirms the administrative act contained in Office No. IRG-DAyEU-V-R-2014-361, of April 30, 2014;

THAT from the review of the documents constituting the file of the administrative claim presented by Mr. Manuel Mesías Castillo Calva, on October 21, 2013, before this control body, against the National Development Bank, through which he requested that it be ordered to the aforementioned banking entity, the return of the sum of US$ 491.50 charged to his savings account No. 4003803578, it is evident that the supposedly unauthorized debits by the user were made in Banred ATMs belonging to Bolivarian Bank C.A. and Guayaquil Bank S.A. and that the challenged withdrawals are within the limits authorized by the financial entity, that is, for the value of US$ 300.00, although it is also demonstrated that from the review of security incidents presented in automatic teller machines and reported by the member institutions of the Banred Security Committee, one of the ATMs used by the claimant coincides with the one reported as a possible point of compromise signed to ATM 19 of Machala Bank, in which, according to the referred report, alleged cases of fraudulent withdrawals were made;

THAT regarding literal a) of the arguments of the appellant, related to the fact that the client did not apply basic security recommendations, it should be noted that, although it is true that the client is the custodian of the card issued by the bank and solely responsible for its use, in the case at hand, it is not evident that Mr. MANUEL MESIAS CASTILLO CALVA has compromised at any time the security of his

---

Resolution No. JB-2015-3454

Page No. 4

debit card, granted by the controlled entity. Likewise, it is worth indicating that if the claimant user uses Banred ATMs, it is because it is a service that the bank made available to its clients; regarding this, literal a) of article 51 of the General Law of Institutions of the Financial System states that banks are authorized to "Receive resources from the public in demand deposits. Demand deposits are banking obligations, comprising monetary deposits payable upon presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings books or other payment and registration mechanisms". The above is reinforced by what is determined in the Constitution of the Republic of Ecuador in its article 308 which says "(...) Financial activities are a public order service, and may be exercised, with prior authorization of the State, in accordance with the law; they will have the fundamental purpose of preserving deposits and meeting financing requirements for the achievement of the country's development objectives. (...)". From the cited regulatory framework, it is determined that the National Development Bank assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for the other services offered to its clients, it is obliged to evaluate and demand the security measures in case in order to be able to fulfill its obligations as custodian of the money that its clients have entrusted to it;

THAT in this regard it is necessary to specify that the use of automatic teller machines of other institutions by any client of the bank, as in the case of the claimant, arises from the service offered by the National Development Bank; in this sense, the banking institution cannot transfer the responsibility to its client for the inadequate service that may be provided by another institution's ATM, even though such use arises from the contract that the bank and other financial institutions have signed with BANRED for this effect. The client, by virtue of the contract signed with the bank for the use of the products and services that it offers, maintains a direct relationship with that institution that is the custodian of the money, hence the responsibility of the institution regarding events such as the one that motivated the challenged resolution;

THAT likewise, it is worth mentioning article 3 of Book I "General Norms for the application of the General Law of Institutions of the Financial System", Title X "On risk management and administration", Chapter I "On integral risk management and control" of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, which refers to the fact that integral risk management is one of the responsibilities attributed to institutions that are part of the Financial System, by virtue of that, they must have formal processes of integral risk management that allow identifying, measuring, controlling, mitigating and monitoring the risk exposures they are assuming. The above is reinforced by sub-paragraph 4.3.8.20 of article 4 of Chapter V "On Operational Risk Management", Title X "On risk management and administration", of Book I of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, which indicates that "Financial system institutions must offer clients online sending through mobile messaging, email or other mechanism, the confirmation of access to electronic banking, as well as of the transactions carried out through any of the

---

Resolution No. JB-2015-3454

Page No. 5

available electronic channels, or by means of cards", notification that in the present case is not evidenced;

THAT additionally, the National Development Bank states that it is carrying out management in order for the requested information to be delivered to the Control Body by private financial institutions and in this way attend the requirements of the control entity since, not having access to these files, they are subject to some entities having less predisposition than others, which has caused the information to be delivered partially. Regarding such affirmation made by the Bank, it is worth indicating that the contracts celebrated between the institutions of the financial system with service providers, with the purpose of providing their clients with a wider coverage of automatic teller machines, are the exclusive responsibility of such entities, not being able to transfer the operational risk of said service to the users, since this is offered on behalf of and as part of the facilities given by the banking entities to their clients, being thus the obligation of the controlled institution to take all precautions and security measures;

THAT article 3 of Chapter II, Title XVI of Book I of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board establishes that: "the appeal for reconsideration must be based only on the existence of elements of fact or law not known by the Superintendence of Banks and Insurance or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution", norm that the National Development Bank did not consider. Notwithstanding this flagrant non-observance by the appellant, for the processing of the appeal for reconsideration raised, this control body considered the information sent as well as all that rests in the file and the arguments of fact and law raised in the appeal, and rejected it by virtue of its analysis;

THAT article 5, of Chapter IV "Procedure for the attention of claims against Institutions of the Financial System", Title XX "On the Superintendence of Banks and Insurance", Book I "General norms for the application of the General Law of Institutions of the Financial System", of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, empowers the Control Body to order the return of the values claimed by the controlled institutions, in exercise of the functions and attributions that both constitutional and legal norms establish, since it provides that: "(...) If the situation that motivated the claim referred to in the previous paragraph, originated in an incorrect procedure of the controlled institution, which has caused harm to the claimant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of article 180 of the General Law of Institutions of the Financial System, granting the legal representative of the entity a period that may not exceed fifteen (15) days from the notification to send, under the warnings of Law, the record of compliance with the order imparted.

For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in automatic teller machines, the Superintendence of Banks and Insurance will order the

---

Resolution No. JB-2015-3454

Page No. 6

return of the claimed values to the institution issuing the credit card or where the client maintains his account, if said withdrawals originated in an incorrect procedure of the controlled institution, this one being able to repeat against the institution owning or operating the automatic teller machine by whose defects or lack of security measures the fraud occurred."

THAT the National Development Bank, entity depositary and custodian of its clients' money, by placing the Banred ATM service at the disposal of its users, has the legal obligation that the ATM channel, whether its own or third-party, provides its clients with all the security that the case merits, which do not reside solely in the use of the secret key but also in the inviolability of the magnetic card delivered and, of the automatic teller machines (own or third-party) with adequate mechanisms; so that in the present case, the banking institution incurred in an incorrect procedure by which the security measures were violated, without in the present case it having been evidenced or discharged documents that determine that the cardholder carried out the transactions or that there was negligence or mishandling of the debit card by the claimant, but on the contrary, from the review of the digital video material sent by the appellant, it is evident that on the day and time that some of the withdrawals were made, there is a person different from the claimant user, who has in his possession several cards and of different colors, using them consecutively, so that in the present case we would be facing a possible card cloning;

THAT in accordance with the second paragraph of the Third Transitional Provision of the Organic Code of Monetary and Financial Affairs published in the Official Register Second Supplement No. 332 of September 12, 2014, the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was hearing on the date of its entry into force, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2014-932 of November 26, 2014, recommended to the Banking Board to reject the petition contained in the appeal filed by the Head Commercial Manager of the El Triunfo Branch of the National Development Bank; and,

In exercise of its legal attributions,

RESOLVES:

SINGLE ARTICLE.- REJECT the petition contained in the appeal for review filed by engineer Roberto Enrique Arce Icaza, Head Commercial Manager of the El Triunfo Branch of the National Development Bank; and, consequently CONFIRM Office No. IRG-DAyEU-V-R-2014-786 of July 16, 2014, which ratified Office No. IRG-DAyEU-V-R-2014-361 of April 30, 2014, through which the Regional Intendancy of Guayaquil ordered "(...) to the controlled financial institution NATIONAL DEVELOPMENT BANK to proceed to restore to Mr. MANUEL MESIAS CASTILLO CALVA, the sum of US$ 491.50 (FOUR HUNDRED NINETY-ONE WITH 50/100 DOLLARS OF THE UNITED STATES OF AMERICA), debited on days 18 and 19 of

---

Resolution No. JB-2015-3454

Page No. 7

September 2013, from his savings account No. 4003803578, which he maintains in the aforementioned Bank, being able to exercise his right of recourse against the institutions owning the automatic teller machines in which the challenged withdrawals occurred (...)".

NOTIFY.- Given at the Superintendence of Banks and Insurance, in Quito, Metropolitan District, on June 4, 2015.

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT (s)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on June 4, 2015.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD

---

Banking Board of Ecuador