Banking Board of Ecuador

RESOLUTION No. JB-2015-3331

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332, on September 12, 2014, whose text states that resolutions contained in the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and norms issued by control bodies, will maintain their validity in all that does not oppose what is established in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that were known as of the date of validity of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT through a complaint form dated January 3, 2014, Mr. Ángel Ramón López Sánchez filed a complaint against Banco Pichincha C.A. at the Regional Intendancy of Guayaquil, regarding the unauthorized withdrawal of USD $200.00 from his savings account No. 2200339527 on October 21, 2013;

THAT the Regional Intendancy of Guayaquil, through letter No. DAYEU-ISFP-REQ-2014-101 of January 13, 2014, accepted the complaint for processing and requested explanations and defenses from Banco Pichincha C.A. regarding the aforementioned complaint;

THAT through letter No. BP-ACEC-2014-0086, received by this control body on January 27, 2014; Banco Pichincha C.A. presented the explanations and defenses related to Mr. Ángel Ramón López Sánchez's complaint, stating that:

"(...)
Once the corresponding verifications were made in our ATM files, it was established that the transaction subject of the complaint was carried out on savings account No. 2200339527 with debit card No. 4381082093215803 issued in the name of Mr. ÁNGEL RAMÓN LÓPEZ SÁNCHEZ, holder of the aforementioned account,...

Card 4381082093215803 was cancelled by the client on 10/22/2013 at 08:43:51, that is, after the transaction had already been carried out.

The debit card and personal key generated by Mr. ÁNGEL RAMÓN LÓPEZ SÁNCHEZ constitute the only mechanism to access ATM services, so the strict custody and care taken with the card, as well as keeping the

---

Resolution No. JB-2015-3331

Page 2

personal key secret, are specific responsibilities of the client. It is important to indicate that Banco Pichincha is technologically prevented from knowing the client's key.

For the reasons stated and taking into account the client's responsibility regarding transactions carried out through ATMs and other electronic means, the Bank, in no way, can be held responsible for the transaction carried out with the client's card and personal key.

(...);"

THAT through letter No. IRG-DAYEU-V-R-2014-300 of April 17, 2014, the administrative resolution regarding the complaint filed by Mr. Ángel Ramón López Sánchez was issued, where the Regional Intendancy of Guayaquil accepted the claimant's request, resolving to order Banco Pichincha C.A. to proceed to return the sum of USD $200.00, corresponding to the withdrawal challenged by the user, carried out on October 21, 2013, debited from his savings account No. 2200339527, which he holds in the aforementioned bank,

THAT through communication received at the Regional Intendancy of Guayaquil on April 30, 2014, the lawyer María Elena Franco San Lucas, Judicial Attorney of Banco Pichincha C.A., filed an appeal for reconsideration against the administrative act contained in letter No. IRG-DAYEU-V-R-2014-300 of April 17, 2014;

THAT through letter No. IRG-DAYEU-V-R-2014-719, of June 27, 2014, the Regional Intendancy of Guayaquil, after analyzing the arguments presented by the financial institution, resolved to reject the appeal for reconsideration filed and ratified the administrative act contained in letter No. IRG-DAYEU-V-R-2014-300 of April 17, 2014;

THAT through communication entered in this Superintendence on July 16, 2014, Mr. Antonio Acosta Espinosa, Deputy President of Banco Pichincha C.A., filed an appeal for review before the Banking Board against the administrative act contained in letter No. IRG-DAYEU-V-R-2014-719, of June 27, 2014, which was accepted for processing by Lic. Pablo Cobo Luna, Secretary of the Banking Board, through letter No. JB-2014-1922, of July 22, 2014;

THAT Mr. Antonio Acosta Espinosa, Deputy President of Banco Pichincha C.A., bases his appeal for review on the following:

• That the debit card of Mr. Ángel Ramón López Sánchez constitutes the main mechanism to access ATM services, as well as payment by debit in different commercial establishments, so the strict custody and care taken with said card constitutes a specific responsibility of the client.

• That all financial institutions have reiterated the need for users to properly safeguard their personal debit cards and

---

Resolution No. JB-2015-3331

Page 3

non-transferable keys, since the lack of proper custody allows persons unrelated to the cardholder to commit acts that harm the holder himself.

• That the control body, for the resolution of this case, has overlooked the important means of proof that my represented party sent at the time, such as videos, movements, withdrawal limits, audit tapes, ATM control mechanism, etc.;

THAT the first paragraph of Article 52 of the Constitution of the Republic of Ecuador, in conjunction with paragraph 4 of Article 4 of the Organic Law for the Defense of the Consumer, establish that people have the right to dispose of goods and services of optimal quality, as well as precise and non-misleading information, adequate, truthful, clear, timely, as well as their prices, characteristics, quality conditions of contracting, including the risks that may arise, movements, withdrawal limits, audit tapes, ATM control mechanism, etc.;

THAT Article 180 of the General Law of Institutions of the Financial System in letters b) and o) establishes as functions and attributions of the Superintendent the following:

b) To ensure the stability, solidity, and correct functioning of institutions subject to its control and, in general, that they comply with the norms governing their functioning, through permanent extra-situ supervision and in-situ inspection visits, in accordance with best international practices, without any restriction and that allow determining the economic and financial situation of the entity, the management of business, evaluate the quality and control of risk management, and verify the truthfulness of the information generated;

(...)

o) Require that controlled institutions present and adopt the corresponding corrective and remedial measures in cases that so require.

(...);"

THAT from the norms previously stated, it follows that the State guarantees citizens the right to dispose of goods and services of optimal quality and that the Superintendence of Banks and Insurance, as the competent authority, has the function and attribution to ensure the stability, solidity, and correct functioning of institutions subject to its control; to monitor that they comply with the norms that govern them; and, to require that said institutions present and adopt the corresponding corrective measures when necessary, likewise, if the Superintendence of Banks and Insurance determines incorrect procedures on the part of the controlled financial institutions, which have caused harm to a claimant, it must act as ordered for those effects;

---

Resolution No. JB-2015-3331

Page 4

THAT it is determined that financial institutions, when offering their financial products to their clients, are obliged to put at their service policies of dissemination of the conditions surrounding said products, including the security measures implemented and their possible risks when accessing mentioned services through electronic channels other than their own;

THAT the main argument exposed by the claimant is that he did not carry out the challenged withdrawal, for this reason it was requested to the controlled entity to send the security video of the ATM where said transaction was carried out;

THAT the images collected by the video do not allow identifying the person who carried out the withdrawal, due to the poor placement of the security cameras which does not allow determining in which ATM the transaction is being executed, since the images show several ATMs in a row and in all of them users appear occupying them, so the financial entity has not been able to demonstrate that the user failed to fulfill his obligation to safeguard the debit card and keep the key secret;

THAT paragraphs 37.2 and 37.3 of Article 37, section VIII "On security measures", chapter I, title II, book I of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, dispose among other security measures the following:

"Article 37.- With regard to video surveillance systems (cameras), it must be considered that:

(...) 37.2 fixed location cameras, at a minimum, must adequately cover the places of access to the public and staff of the financial institution and the customer service counters; and,

37.3 Image recording and storage systems must guarantee the archive of at least three (3) months of recording, through tapes, digital video discs (DVD) or any other system (...);";

THAT the norm stated refers to the video and security systems that financial institutions must have and that are applicable to ATMs, from which it follows, that if Banco Pichincha C.A. offers the ATM service through BANRED, it must ensure that the security measures required by the regulations are implemented, in order to reduce to a minimum expression this type of fraudulent thefts (robberies) for the benefit of the user and also of the financial entity;

THAT the appellant intends to transfer the responsibility of the transactions to the client, by the fact of having granted him a debit card and the key being of his own authorship to access ATM services, although it is true that this would constitute part of the conditions that support a written agreement between the parties regarding deposits, withdrawals, etc. and any other transaction allowed or deposit made through electronic means, it is no less true that Banco Pichincha C.A. has the obligation to safeguard the funds delivered, in order to return to the depositor the monetary equivalent at the moment that it is requested, but at no time is there evidence of a

---

Resolution No. JB-2015-3331

Page 5

correct conduct on the part of the bank that allows it to disprove the accusations, in this way it is evident that there is responsibility of the banking entity, since it has not provided the necessary technological security for its clients; and in that context it can hardly assert without basis that the transactions were executed with the card delivered to the client;

THAT it is necessary to point out that, in similar cases, the Banking Board has already resolved different appeals for review accepting the analyses carried out by this Office, in the same sense as the current one, ordering financial institutions to return the claimed values to the users. It is appropriate to cite as an example resolution No. JB-2013-2646 of September 26, 2013, which was based on memorandum No. INJ-DNJ-SAL-2013-0277 of April 19, 2013, whose case had similar characteristics to the one treated in the present appeal for review;

THAT the third paragraph of Article 5 of chapter IV, title XX, book I, of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, states the following:

"Article 5.- If the result of the analysis carried out by the Superintendence determines the need for the controlled institution to introduce corrective measures to regularize the situation that motivated the complaint, the Superintendent of Banks and Insurance or the official who has the delegation of said authority, will issue the corresponding order.

For complaints of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client holds his account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred";

THAT it has been evidenced in the present case that Banco Pichincha C.A. is subject to the cited provision of the Compilation of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, by virtue of the transactions carried out on the account belonging to Mr. Ángel Ramón López Sánchez, causing him economic harm originated by an incorrect procedure of the controlled institution, by not monitoring nor implementing alerts on the movements that occurred in the account entrusted to its custody, allowing the security controls of the credit card delivered by the bank to be violated;

THAT based on what has been stated, it is concluded that the bank, when offering its products and services, must implement computer and technological security measures, so that the transactions carried out both in its own ATMs and in those of BANRED have the necessary security to avoid frauds, which in the case analyzed has not happened;

---

Resolution No. JB-2015-3331

Page 6

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0076 of January 28, 2015, recommended to the Banking Board to reject the claim contained in the appeal for review filed;

IN exercise of its legal attributions,

RESOLVES:

SINGLE ARTICLE.- REJECT the claim contained in the appeal for review filed by Mr. Antonio Acosta Espinosa, Deputy President of BANCO PICHINCHA C.A.; and, consequently, CONFIRM letter No. IRG-DAYEU-V-R-2014-719 of June 27, 2014, with which Dr. Faddul Mosquera Karam, Regional Intendant of Guayaquil (S), on that date, resolved to confirm the administrative act contained in letter No. IDG-DAYEU-V-R-2014-300 of April 17, 2014, in which said authority ordered Banco Pichincha C.A. to proceed to return to Mr. Ángel Ramón López Sánchez the sum of USD $200.00, value corresponding to the withdrawal challenged by the user debited from savings account No. 2200339527, which he holds in the aforementioned bank.

NOTIFY.- Given at the Superintendence of Banks, in Quito, Metropolitan District, on April 1, two thousand fifteen.

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT, S
PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on April 1, two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD