Banking Board of Ecuador

RESOLUTION No. JB-2015-3427

THE BANKING BOARD

CONSIDERING:

THAT through a communication received by the Regional Intendancy of Portoviejo of this Superintendency on March 10, 2014, Mrs. Mayra Juliana García Murillo filed an administrative complaint against the National Bank for Development (Banco Nacional de Fomento);

THAT through Official Letter No. IRP-SAC-2014-186 dated March 17, 2014, the content of the complaint filed against said bank was forwarded to the aforementioned bank, granting it a term of 5 days to present relevant explanations and defenses; in response to said request, through Official Letter No. 04257 dated April 7, 2014, received by the Regional Intendancy of Portoviejo on April 9 of the same year, the financial entity presented the explanations and defenses related to the claim presented by Mrs. Mayra Juliana García Murillo;

THAT through Official Letter No. IRP-SAC-2014-276 of April 22, 2014, the administrative resolution regarding the claim presented by Mrs. MAYRA JULIANA GARCÍA MURILLO was issued, where the Regional Intendancy of Portoviejo accepted the claimant's petition, resolving to order BANCO NACIONAL DE FOMENTO to proceed to restore the sum of US$ 6,486.35 corresponding to cash withdrawals made from her savings account No. 4001873917 from December 23, 2013, to January 15, 2014;

THAT through a communication received by this control body on May 6, 2014, BANCO NACIONAL DE FOMENTO filed a motion for reconsideration against the administrative act contained in Official Letter No. IRP-SAC-2014-276 of April 22, 2014; through Official Letter No. IRP-SAC-2014-437 of July 8, 2014, the Regional Intendancy of Portoviejo rejected the motion for reconsideration filed;

THAT through a communication received by the Regional Intendancy of Portoviejo on July 22, 2014, the economist Carlos Manuel Lucas Falcones, Commercial Manager of the Portoviejo Branch of the National Bank for Development, with the professional sponsorship of lawyer Jacinto Giler Intriago, filed before the Banking Board a review appeal against the administrative act contained in Official Letter No. IRP-SAC-2014-437 of July 8, 2014, arguing mainly:

"(...) the client MAYRA JULIANA GARCÍA MURILLO did not pay attention and therefore did not apply the basic security recommendations provided by BNF for the handling of debit card No. 6031600141000426, which is informed permanently through various media, visual, printed, videos, etc., in which clients are instructed on the security measures they must take into account for the use of ATMs.

(...)

Once the text containing the resolution I challenge is reviewed, it can be established that there is no structural analysis of the abundant documentation and, what is worse, an evaluation of the evidence provided by BNF (...)";

---

Resolution No. JB-2015-3427

Page 2

THAT through Official Letter No. JB-2014-1982 of July 28, 2014, the Secretary of the Banking Board accepted the review appeal filed for processing; and, with Official Letter No. JB-2014-1983 of the same date, notified Mrs. Mayra Juliana García Murillo regarding the acceptance of said appeal;

THAT through Official Letters No. SAL-2014-00191 and SAL-2014-00200, dated August 8 and 18, 2014, respectively, the Subdirectorate of Legal Advice of the National Legal Directorate of this Intendancy requested the technical criterion of the Regional Intendancy of Portoviejo, regarding the grounds of the review appeal filed against the administrative act contained in Official Letter No. IRP-SAC-2014-437 of July 8, 2014;

THAT through Official Letter No. IRP-2014-4248 of November 17, 2014, the Regional Intendancy of Portoviejo sent Technical Report No. IRP-DASCP-2014-34 of November 11 of the same year, indicating that the challenged administrative act was based both on the constitutional regulatory framework and the legal framework in force at the date of its issuance, and ratified Official Letter No. IRP-SAC-2014-437 of July 8, 2014;

THAT this challenge is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332 of September 12, 2014, whose text states that the resolutions contained in the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, and the norms issued by the control bodies, will maintain their validity in everything that does not oppose what is provided in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was hearing on the date of entry into force of the same, within a term of one hundred eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT the Superintendency of Banks, as the competent body, in accordance with articles 1 and 180, letter b) of the General Law of Financial System Institutions, as well as what is provided in article 5 of chapter IV regarding the "Procedure for the attention of claims against Financial System Institutions", title XX "Of the Superintendency of Banks and Insurance", book I "General norms for the application of the General Law of Financial System Institutions" of the Codification of Resolutions of the Superintendency of Banks and Banking Board, has the function and attribution to ensure the stability, solidity, and correct functioning of institutions subject to its control; to supervise that they comply with the norms that govern them; and to require that said institutions present and adopt the corresponding corrective measures when necessary; under this context, based on the referred legal and regulatory provisions, it is inferred that this control body has the legal and normative faculty to hear the claims of financial users, and in case of determining an incorrect procedure by the entities, to order the restitution of values to them, therefore the administrative acts it issues to resolve them arise from the control and supervision attributions, in whose activity, the protection of public interests must be kept in mind;

---

Banking Board of Ecuador

Resolution No. JB-2015-3427

Page 3

THAT according to the arguments exposed in the review appeal filed by the National Bank for Development, it attempts to shift responsibility solely to the user; however, the bank has not proven in any way that its client was negligent in the handling of her card and/or security key, as it limits its response to the mere custody of the debit card, but does not refer to the levels or standards of compliance and security related to the clarity, validation, and security that establishments must provide to their users, especially when the bank has not faithfully complied with the monitoring controls and alert signals parameterized to evaluate its client's transactions;

THAT letter a) of article 51 of the General Law of Financial System Institutions, in force at the date of presentation of this challenge, states that banks are authorized to "Receive public resources in demand deposits. Demand deposits are banking obligations, comprising monetary deposits payable upon presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings books or other payment and registration mechanisms";

THAT the foregoing is reinforced by what is determined in the Constitution of the Republic of Ecuador in its article 308, which says "(...) Financial activities are a public order service, and may be exercised, with prior authorization of the State, in accordance with the law; their fundamental purpose will be to preserve deposits and meet financing requirements for the achievement of the country's development objectives (...)";

THAT from the cited regulatory framework, it is determined that the bank assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for the other services offered to its clients; it is obligated to evaluate and demand the necessary security measures in order to fulfill its obligations as a depositary of the money its clients have entrusted to it;

THAT in concordance with the aforementioned, the Codification of Resolutions of the Superintendency of Banks and of the Banking Board, in its book I "General Norms for the application of the General Law of Financial System Institutions", title X "Of risk management and administration", chapter I "Of integral risk management and control" article third states:

"ARTICLE 3.- Financial system institutions have the responsibility to manage their risks, to which effect they must have formal processes of integral risk management that allow identifying, measuring, controlling/mitigating, and monitoring the risk exposures they are assuming";

THAT in this regard, it is important to remember that all entities of the financial system are obligated to establish control procedures and mechanisms that allow recording the profile of each client regarding their transactional habits in the use of electronic channels and cards and define procedures to monitor online and allow or reject in a timely manner the execution of transactions that do not adjust to the client's frequency, which must be immediately notified to the same via mobile messaging, email, or another mechanism. The aforementioned is established in chapter V "Of Operational Risk Management", title X "Of Risk Management and

---

Resolution No. JB-2015-3427

Page 4

Risk Administration", book I, section II "Factors of Operational Risk", article 4, numerals 4.3.5.13 and 4.3.5.23;

THAT it is important to mention that from the same documentation submitted by the bank, the following was evidenced: according to the transaction log attached by the bank as proof, it is observed that before the claimed transactions, that is, from September 2 to December 19, 2013, the user had only made two withdrawals at ATMs located in Portoviejo and that all the claimed transactions were made in the city of Quito; and, it is evidenced that on December 20 there are transactions already denied by the bank which did not generate an alert to the bank nor was it notified to Mrs. Mayra Juliana García Murillo;

THAT from the report prepared by the Subdirectorate of Operational Risk of the same bank, it communicates: "the habitual withdrawal, the amounts, place and times of their realization. It can be concluded that although the transactions claimed by the client present an atypical pattern, it was not possible to determine a compromise point of the client's card". (the highlighted part corresponds to me). Therefore, upon evidencing an atypical case, it should have generated alerts to the bank and communicated with the client;

THAT it should be indicated that the contracts celebrated between financial system institutions and service providers, with the aim of providing their clients with broader ATM coverage, are the exclusive responsibility of such entities, not being able to transfer the operational risk of said service to the users, since this is offered on behalf of and as part of the facilities provided by banking entities to their clients, being thus the obligation of the controlled institution to take all pertinent precautions and security measures;

THAT it is the responsibility of each financial entity owning ATMs that, through the installation of anti-skimming devices and other security measures for the case, can prevent the information contained in users' debit cards from being susceptible to appropriation by third parties; nevertheless, at the moment the bank allows its clients access to transact through the ATM network with the subscription of the electronic service provision contract, it tacitly assumes the responsibilities that derive from the facts that occur to the detriment of those clients who used the service that the banking institution made available to them;

THAT according to what was repeatedly manifested by the bank in the filed appeal: "Once the text containing the resolution I challenge is reviewed, it can be established that there is no structural analysis of the abundant documentation and, what is worse, an evaluation of the evidence provided by BNF", it must be pointed out that the analysis of the complaint is based on the documentation presented and attached by the bank, as mentioned in point 4.4 of this report;

THAT it is necessary to cite article 5, of chapter IV "Procedure for the attention of claims against Financial System Institutions", title XX "Of the Superintendency of Banks and Insurance", book I "General norms for the application of the General Law of Financial System Institutions", of the Codification of Resolutions of the Superintendency of Banks and Insurance and of the Banking Board, which empowers this Control Body to order the return of the values claimed by

---

Banking Board of Ecuador

Resolution No. JB-2015-3427

Page 5

controlled institutions, in exercise of the functions and attributions that both constitutional and legal norms establish, since it provides:

"(...) If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendency of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of article 180 of the General Law of Financial System Institutions, granting the legal representative of the entity a term that cannot exceed fifteen (15) days from notification to send, under the legal warnings, the proof of compliance with the order issued.

For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendency of Banks and Insurance will order the return of the claimed values to the credit card issuing institution or where the client maintains their account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred.";

THAT the arguments mentioned in this memorandum demonstrate that the claimed transactions are atypical to the transactional profile of Mrs. Mayra García Murillo, by virtue of which the Bank's system should have generated the respective alerts and notified the client to avoid the execution of the transactions, so it was the bank that incurred in incorrect internal procedures;

THAT finally, it should be indicated that neither in the motion for reconsideration nor in the review appeal filed by the bank were new evidence presented, as established in article 3 of chapter II, title XVI of book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and of the Banking Board which establishes: "the motion for reconsideration must be based solely on the existence of elements of fact or law not known by the Superintendency of Banks and Insurance or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution", a norm that the Bank did not consider. Notwithstanding this blatant non-observance by the appellant, for the processing of the motion for reconsideration raised, this control body considered the information sent as well as all that rests in the file and the arguments of fact and law raised in the appeal;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0167 of February 18, 2015, recommended to the Banking Board to reject the petition contained in the appeal filed by the Commercial Manager of the Portoviejo Branch of the National Bank for Development.; and,

IN exercise of its legal attributions,

---

Resolution No. JB-2015-3427

Page 6

RESOLVES:

SINGLE ARTICLE.- REJECT the petition contained in the review appeal presented by the economist Carlos Manuel Lucas Falcones, Commercial Manager of the Portoviejo Branch of the National Bank for Development; and, consequently CONFIRM the administrative act contained in Official Letter No. IRP-SAC-2014-437 of July 8, 2014, through which the Regional Intendancy of Portoviejo rejected the motion for reconsideration filed, and resolved to ratify the administrative act contained in Official Letter No. IRP-SAC-2014-276 of April 22, 2014, in which it was resolved: "that Banco Nacional de Fomento within the term of seventy-two hours proceed to the refund of US$ 6,486.35, claimed by Miss Mayra Juliana García Murillo".

NOTIFY.- Given at the Superintendency of Banks and Insurance, in Quito, Metropolitan District, on the twentieth of May of two thousand fifteen.

---

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT (S)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on the twentieth of May of two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD