Banking Board of Ecuador

RESOLUTION No. JB-2015-3435

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332, of September 12, 2014, whose text states that resolutions contained in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by the control bodies, will remain in effect insofar as they do not oppose what is provided in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling on the date of entry into force of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT by Resolution No. 054-2015-F, of March 5, 2015, the Monetary and Financial Policy and Regulation Board resolved to extend by an additional one hundred and eighty days the period for the Banking Board to continue acting and resolve all claims, appeals, and other administrative procedures within its competence;

THAT on November 18, 2013, Mr. Manuel Andrés Vera Muñoz filed an administrative complaint against the Banco Nacional de Fomento before the control body, regarding withdrawals at automated teller machines (ATMs) not performed by him;

THAT by Letter No. IRP-SAC-2013-455, of December 4, 2013, the Portoviejo Regional Intendancy notified the Banco Nacional de Fomento of the complaint filed against it and requested various defenses and information, which would contribute to this Superintendence having sufficient evidence and instruments to issue the corresponding resolution, obtaining a response from the Banco Nacional de Fomento by Letter No. 00227 entered at the Portoviejo Regional Intendancy on January 14, 2014;

THAT by Letter No. IRP-SAC-2014-051, of January 28, 2014, the Portoviejo Regional Intendancy accepted the claimant's request, resolving to order the Banco Nacional de Fomento to proceed to restore US$ 2,784.50 for the value debited without authorization from checking account No. 3001-03373-4, which he holds in the aforementioned bank;

THAT by communication entered with the control body on February 11, 2014, the Commercial Manager of the Portoviejo Branch of the Banco Nacional de Fomento filed an appeal for reconsideration against the administrative act contained in Letter No. IRP-SAC-2014-051, of January 28, 2014; and by Letter No. IRP-SAC-2014-271, of April 22, 2014, the Portoviejo Regional Intendancy resolved to reject the request contained in the filed appeal; and,

---

Resolution No. JB-2015-3435

Page 2

consequently, confirming the administrative act contained in Letter No. IRP-SAC-2014-051, of January 28, 2014;

THAT by document entered at the Portoviejo Regional Intendancy on May 6, 2014, the economist Carlos Manuel Lucas Falcones, Commercial Manager of the Portoviejo Branch of the Banco Nacional de Fomento, with the professional sponsorship of lawyer Jacinto Giler Intriago, filed before the Banking Board an appeal for review against the administrative act contained in Letter No. IRP-SAC-2014-271, of April 22, 2014;

THAT the appellant argues in his writing as follows:

a) That Mr. Manuel Andrés Vera Muñoz did not apply basic security recommendations for his card.

b) That the abundant evidence provided by the Banco Nacional de Fomento was not considered by the Regional Intendant of Portoviejo when issuing his resolution in the administrative process, affecting the right to due process, so that ultimately the resolution contained in Letter No. IRP-SAC-2014-271, of April 22, 2014, is "null."

c) That the Banco Nacional de Fomento is not responsible for failures originating in ATMs that are not its property; and that its representative made efforts to obtain the videos of the disputed transactions, which were never delivered;

THAT the appeal for review was accepted for processing by Licentiate Pablo Cobo Luna, Secretary of the Banking Board, by Letter No. JB-2014-1306 of May 26, 2014;

THAT in the present case, from the detail of the ATM historical log of transactions made at ATMs in the three months prior to the claimed withdrawals from checking account No. 3001-03373-4 of Mr. Manuel Andrés Vera Muñoz; it was verified that the client only used ATMs in the province of Manabí in the cities of Portoviejo, Chone, and Tosagua, and the withdrawals subject of the present complaint occurred in the cities of Quito, Machachi, and Mejía. Likewise, it should be indicated that, if the gentleman used Banred ATMs, it is because it is a service that the bank made available to its clients. In light of this, the financial institution was obligated to apply Article 12 of Chapter IV.- Norms for Institutions of the Financial System on Prevention of Money Laundering, Terrorism Financing, and Other Crimes, Title XIII.- Internal Control, Book I.- Norms for the application of the General Law of Financial System Institutions, of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, which states:

"ARTICLE 12.- Financial system institutions are obligated to apply due diligence procedures, which imply:

---

Resolution No. JB-2015-3435

Page 3

(...) 12.3 Establish the behavior profile considering all those specific and usual characteristics of the subject of analysis, associated with general information, mode of use of the institution's services and products, among others;

12.4 Permanently carry out monitoring processes on all transactions, in such a way that it is determined whether the client's transactionality adjusts to the established transactional and behavior profiles; (...)".

THAT compensating for the damage suffered by the client, in this case, arises from the obligation acquired by the bank within the commercial relationship and the services offered by it, such as the use of ATMs of other financial institutions. Therefore, the resolution issued by the Superintendence of Banks does not intend, in any case, that Banco Nacional de Fomento provide security in third-party ATMs, but rather that it adequately inform its clients about the risks inherent in their use, whether their own or third-party, and about the security procedures that the client must adopt in the use of these devices;

THAT regarding literal b) with respect to the appellant's arguments, it is determined that this assertion lacks all legal basis, since the information to which the appellant refers is the same that the entity submitted to this Control Body at the time to process the complaint filed by Mr. Manuel Andrés Vera Muñoz. Regarding this, Article 3 of Chapter II, Title XVI of Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance establishes that: "the appeal for reconsideration must be based solely on the existence of elements of fact or law not known by the Superintendence of Banks and Insurance or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution"; a norm that the Banco Nacional de Fomento did not observe. Notwithstanding this blatant non-observance by the appellant, for the processing of the reconsideration appeal filed, this control body considered the information submitted as well as all that rests in the file and the arguments of fact and law raised in the appeal;

THAT the appellant's claim that merely responding to the control entity's requirements and attaching the required documentation constitutes sufficient proof to obtain a resolution in their favor from this control body is completely far from the truth, since not all information submitted by the appellant is relevant or pertinent to the case at hand;

THAT regarding the nullity of the appealed administrative act, the appellant does not consider the presumption of legality and enforceability of such acts. The presumption of legality, also called presumption of validity or juridicity, consists of presuming that the act was issued in accordance with the law, that is, that its issuance was subject to all normative prescriptions. By the presumption of legitimacy, the State does not need to declare that its activity is legitimate and that the issued act enjoys legality. To disprove this

---

Resolution No. JB-2015-3435

Page 4

presumption, it must be requested, either before the same administration or before the justice system. The administrative subject must request the declaration of illegitimacy or nullity of the act, while behaving as if the act were valid. In this case, the appellant fails to substantiate the nullity of the administrative act, as well as to request it. It is emphasized that the appellant has not submitted documentary evidence supporting the assertion that due process guarantees were not observed;

THAT literal a) of Article 51 of the then in force General Law of Financial System Institutions stated that banks are authorized to "Receive public resources in demand deposits. Demand deposits are banking obligations, comprising monetary deposits payable upon presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings books or other payment and registration mechanisms"; from the foregoing it is inferred that when a client delivers money to a financial institution, they have the option to withdraw it, partially or totally, as required; the depositary entity, in turn, has the obligation to keep or safeguard the deposited values and satisfactorily attend all withdrawal operations requested by the holder, with diligence and professionalism;

THAT likewise, it is worth mentioning Article 3 of Chapter I "On comprehensive risk management and control", Title X "On risk management and administration", of Book I of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, which refers to the fact that comprehensive risk management is one of the responsibilities attributed to institutions that are part of the Financial System, by virtue of which, they must have formal comprehensive risk management processes that allow identifying, measuring, controlling, mitigating, and monitoring the risk exposures they are assuming;

THAT in the present case, it was determined that the bank does not have all the necessary security measures, such as the responsibility to manage risks inherent in the use of ATMs using means to alert users, as determined by sub-paragraph 4.3.8.20 of Article 4, of Chapter V "On Operational Risk Management", Title X "On risk management and administration", of Book I of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, which indicates: "Financial system institutions must offer clients online sending through mobile messaging, email, or other mechanism, the confirmation of access to electronic banking, as well as of transactions made through any of the available electronic channels, or by means of cards";

THAT Article 5, of Chapter IV "Procedure for handling complaints against Financial System Institutions", Title XX "On the Superintendence of Banks and Insurance", Book I "General norms for the application of the General Law of Financial System Institutions", of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, empowers this Control Body to order the return of the values claimed by the controlled institutions, in exercise of the functions and attributes that both constitutional and legal

---

Resolution No. JB-2015-3435

Page 5

establish, since it provides that: "(...) If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributes contemplated in letters b) and o) of Article 180 of the General Law of Financial System Institutions, granting the legal representative of the entity a period that may not exceed fifteen (15) days from notification to send, under the precautions of Law, the proof of compliance with the order issued. For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the issuing institution of the credit card or where the client holds their account, if such withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred.";

THAT paragraphs 37.2 and 37.3 of Article 37, Chapter I, Title II, Book I of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, provide that, among other security measures, financial entities must have the following:

"ARTICLE 37.- With regard to video surveillance systems (cameras) it shall be considered that:

(...) 37.2 Fixed location cameras, at a minimum, must adequately cover the places of access to the public and staff of the financial institution and the public service counters; and,

37.3 Recording and image storage systems must guarantee the archive of at least three (3) months of recording, through tapes, digital video discs (DVD), or any other system (...)";

THAT the foregoing is reinforced by what is expressed in paragraph 39.12, of Article 39, Chapter I, Title II, Book I of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, which establishes the following:

"ARTICLE 39.- ATMs of financial institutions must comply with the following security measures:

(...) 39.12 Image recording or archive system. - Financial institutions must maintain an archive of tapes, digital video discs (DVD), or any other recording system or their equivalents in photographic cameras that covers at least ninety (90) days of image archive (...)";

THAT Banco Nacional de Fomento should have requested the videos from the financial institutions owning the ATMs where the disputed transactions were made during the month of October 2013, not as it

---

Resolution No. JB-2015-3435

Page 6

did in the month of December 2013, when the 90 days provided for in the regulations had already passed;

THAT the order to restore the claimed values does not constitute a sanction, but the faculty derived from the transcribed Article 5, Chapter IV, Title XX, Book I of the Codification of Resolutions of the Superintendence of Banks and the Banking Board, since the financial institution incurred in an incorrect procedure by not applying all the regulations regarding security for ATMs;

THAT furthermore, shifting the responsibility for the disputed transactions to the client, as the appellant bank did, by virtue of having issued a debit card and that the key thereof be generated by its own authorship to access ATM services, while it would constitute part of the conditions that support a written agreement between the parties on deposits, fund withdrawals, credits, debits, and any other transaction allowed in accounts or monetary deposits, effected through electronic or electromechanical means, it is no less true that Banco Nacional de Fomento, upon receiving public resources, also has the obligation to safeguard them, in order to return to the depositor the monetary equivalent deposited when requested; hence, the client's responsibility for transactions they carry out through ATMs must be surrounded in parallel with physical and computer security. Therefore, whenever in the complaint the bank admitted that the card may have been compromised in some BANRED ATM, what was said leads to the conclusion that the compromise occurred due to lack of security that the bank was required to adopt, since by recognizing such a situation, the appellant entity could hardly assert without basis that the user did not apply basic security recommendations for handling the debit card;

THAT furthermore, Banco Nacional de Fomento agreed with the client, under its responsibility, the use of BANRED ATMs as electronic channels to return funds entrusted to its custody. Therefore, said bank had to evaluate and demand that the ATMs enabled to dispense money from the debit cards of the savings or checking accounts delivered to its clients, have the necessary security measures in order to comply with its obligations as custodian of the monies that its users have entrusted to it;

THAT in similar cases, the Banking Board has already resolved different review appeals in the same sense as the present one, ordering financial institutions and particularly Banco Nacional de Fomento to return to users the claimed values. It is worth citing as example Resolution No. JB-2013-2646, of September 26, 2013, and Resolutions Nos. JB-2015-3262 and JB-2015-3264, both of February 11, 2015, whose cases had similar characteristics to those treated in the present review appeal;

THAT the National Legal Intendancy, by memorandum INJ-DNJ-SAL-2015-0327 of April 16, 2015, recommended the Banking Board to reject the request contained in the filed review appeal; and,

---

Resolution No. JB-2015-3435

Page 7

IN exercise of its legal attributes,

RESOLVES:

SINGLE ARTICLE.- REJECT the request contained in the review appeal filed by economist Carlos Manuel Lucas Falcones, Commercial Manager of the Portoviejo Branch of Banco Nacional de Fomento; and consequently, CONFIRM Letter No. IRP-SAC-2014-271, of April 22, 2014, which ratified Letter No. IRP-SAC-2014-051, of January 28, 2014, with which the Portoviejo Regional Intendancy ordered Banco Nacional de Fomento to proceed to reintegrate the sum of US$ 2,784.50, value debited without authorization from checking account No. 3001-03373-4, belonging to Mr. Manuel Andrés Vera Muñoz.

NOTIFY.- Given at the Superintendence of Banks, in Quito, Metropolitan District, on the twenty-seventh of May of two thousand fifteen.

Econ. Rodrigo Landeta Parra GENERAL INTENDANT, S PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on the twenty-seventh of May of two thousand fifteen.

Lic. Pablo Cobo Luna SECRETARY OF THE BANKING BOARD

---

Banking Board of Ecuador