Resolution No. JB-2015-3387 of the Banking Board of Ecuador

RESOLUTION No. JB-2015-3387

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332, of September 12, 2014, whose text states that resolutions contained in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by control bodies, will maintain their validity in all that does not oppose what is provided in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was hearing as of the date of validity of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board, which grants this control body competence to hear and resolve the present review appeal;

THAT through a communication entered into the Superintendence of Banks on November 28, 2013, Mrs. Marisela Melania Castro Arguello, brought to the knowledge of this control body that a value of USD $5,000.00 was stolen from her savings account No. 0-65032061-0, which the client maintains at the National Development Bank, through withdrawals at automated teller machines (ATMs);

THAT through letters Nos. DNAE-SAU-2013-07070, and DNAE-SAU-2013-07071, both dated December 2, 2013, the then Under-Director of User Attention admitted the claim mentioned in the preceding paragraph for processing, requested the referred financial institution to provide substantiated and documented information with respective physical backups regarding the aforementioned claim, and informed the claimant about the matter;

THAT through letter No. 03134, dated February 24, 2014, entered into the control body on the same day, month, and year, Mr. Marco Ruales Valverde, Director of the Customer Attention Unit of the National Development Bank, responded to the control body's letter, and attached several documents related to the claim;

THAT through letter No. DNAU-SAU-2014-1972, dated March 31, 2014, Ms. María Verónica Cevallos, then Under-Director of Customer Attention, resolved the claim in question, in the following terms:

"(...)

3. CONCLUSION

After the analysis exposed, it can be concluded as follows:

• That National Development Bank has not evidenced that Mrs. Marisela Melania Castro Arguello has given improper use to the

*

debit card issued in her favor, nor that she has neglected her obligations to safeguard said card with utmost diligence or to keep her PIN confidential.

• That the client was a victim of alleged cloning, as the pattern of withdrawals fits the pattern used by criminals. When a card is cloned, there is no lack of custody of the card and confidentiality of the PIN, as the information is taken through skimming devices placed in ATMs.

The claimed transactions do not correspond to the usual behavior and transactional habit of the client, mainly the places where she made the withdrawals.

• That National Development Bank has as a responsibility the adequate administration of risks. It corresponds to financial institutions to provide security in the services they offer, which not only lie in the use of the secret key, but also in the expected inviolability of the magnetic card delivered, as well as the software used, since all of this constitutes the system made available to the client and must therefore provide sufficient confidence for its use to be accepted.

For the foregoing, based on what is provided in the General Law of Financial System Institutions, Articles 1 and 180 Letters b) and o), in concordance with Article 5, Section I, Chapter IV, Title XX, Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, it is resolved:

• That National Development Bank, within a period of sixty-two hours, proceed to refund USD 2,914.00 (two thousand nine hundred and fourteen United States dollars) to the savings account No. 0650320610 of Mrs. Marisela Melania Castro Arguello.

• Evidence of the actions taken must be sent within the non-extendable deadline of 48 hours.

(...).";

THAT through a communication entered into the Superintendence of Banks and Insurance on April 21, 2014, Mr. Fredy Alfonso Monge Muñoz, General Manager and Legal Representative of National Development Bank, filed an appeal for reconsideration against the administrative act contained in letter No. DNAE-SAU-2014-1972, dated March 31, 2014, which was rejected through letter No. DNAE-SAU-2014-3422, dated May 30, 2014, in which Dr. Mirian Muñoz Solano, then Acting Under-Director of User Attention, ratified the appealed administrative act;

*

THAT through a document received in the Superintendence of Banks and Insurance on June 16, 2014, Mr. José Andrade López, General Manager and Legal Representative of National Development Bank, with the professional sponsorship of Drs. Fabián Zapata Ozano, Fredy Baños Morejón, and Fabián Gómez Vizuete, filed a review appeal against letter No. DNAE-SAU-2014-3422, dated May 30, 2014;

THAT the arguments raised by the appellant are limited to the following:

• That Mrs. Marisela Melania Castro Arguello did not apply basic security recommendations for handling the debit card, which were provided through various media instructing clients on the security measures they must take into account, being the user's responsibility to comply with the security flex, ATM messaging, transaction receipts, circulars, etc.;

• That the financial entity is permanently carrying out efforts so that the requested information is delivered by the private financial entities responsible for the ATMs where the irregular withdrawals were made, and in this way attend to the requirements of the control body, since the ATMs used by the claimant do not belong to the financial institution;

• That the bank fully complied with its responsibility to present the information requested by the control body, in faithful compliance with what the law establishes, so the constitutional principle of innocence enjoyed by the financial institution has been violated, given that the mere complaint filed by Mrs. Marisela Melania Castro Arguello does not constitute any proof; in addition, National Development Bank has been the only one required and, in its defect, has fully complied with the requirements formulated by the control body, delivering all the documentation requested, which was not valued as supporting grounds for defense by the indicated administrative authority;

• That the control body cannot and should not attend to the claimant's request, as the same, according to the Constitution of the Republic, corresponds to be attended to by the judicial function or the prosecutor's office, as it is a criminal act.

THAT through letter No. JB-2014-1562, dated June 19, 2014, the Secretary of the Banking Board accepted the referred review appeal for processing;

THAT Article 52 of the Constitution of the Republic establishes that people have the right to dispose of goods and services of optimal quality and to choose them freely, as well as to precise and non-misleading information about their content and characteristics, for which the law will establish quality control mechanisms and procedures for the defense of consumers, and

*

consumers, and the sanctions for violation of these rights, in addition to contemplating repair and indemnification for deficiencies, damages, or poor quality of goods and services;

THAT Article 1 of the Organic Law of Financial System Institutions determines that the Superintendence of Banks is the administrative entity in charge of supervising and controlling the financial system, in all matters regarding the protection of public interests, as well as ensuring the stability, solidity, and correct functioning of institutions subject to its control; monitoring that they comply with the legal norms that govern them; and at the same time, requiring that said institutions present and adopt the corresponding corrective measures when necessary;

THAT Article 5, Chapter IV.- Procedure for the attention of claims against financial system institutions, Title XX.- Of the Superintendence of Banks and Insurance, Book I.- General Norms for the application of the General Law of Financial System Institutions of the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, states:

"ARTICLE 5.- If the result of the analysis carried out by the Superintendence determines the need for the controlled institution to introduce corrective measures that regularize the situation that motivated the claim, the Superintendent of Banks and Insurance or the official who has the delegation of said authority will issue the corresponding disposition.

If the situation that motivated the claim referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of Article 180 of the General Law of Financial System Institutions, granting the legal representative of the entity a period that cannot exceed fifteen (15) days from the notification to send, under the legal warnings, the proof of compliance with the order issued.

For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client maintains their account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM due to whose defects or lack of security measures the fraud occurred."

THAT from the transcribed legal norms it is inferred that the State guarantees citizens the right to dispose of goods and services of optimal quality and that the Superintendence of Banks and Insurance, as the competent authority, has the function and attribution to ensure the stability, solidity, and correct functioning

*

of institutions subject to its control; monitor that they comply with the norms that govern them; and, require that said institutions present and adopt the corresponding corrective measures when necessary, likewise, if the Superintendence of Banks and Insurance determines incorrect procedures on the part of the controlled financial institutions, which caused harm to a claimant, it must act as ordered for those effects;

THAT the Superintendence of Banks can determine incorrect procedures on the part of controlled financial institutions, which caused harm to a claimant, so it must act as ordered for those effects, in which, from the documentation that forms part of the file formed around this review appeal, and from the administrative acts issued by the National Directorate of Attention and User Education, it is appreciated that the transactions carried out in ATMs in the month of September in the savings account No. 0650320610, of Mrs. Marisela Melania Castro Arguello, were carried out with a frequency of 3 transactions per ATM per day in several BANRED ATMs in the city of Quito,

THAT after the analysis carried out by this collegiate body, it is necessary to mention that, by transferring the responsibility of the disputed transactions to the user of the financial institution, simply because National Development Bank issued a card to access ATM services, although these would constitute part of the conditions that support a written agreement between the parties regarding deposits, fund withdrawals, credits, debits, and any other transaction allowed in accounts or monetary deposits, made through electronic or electromechanical means, it is no less true that the bank, upon receiving public funds, also has the obligation to safeguard the funds delivered to its custody, in order to return to the depositor the monetary equivalent deposited when it is requested, from which it follows that the client's responsibility for the transactions they carry out through ATMs must be surrounded in parallel with physical and IT security measures;

THAT National Development Bank agreed with the client, under its responsibility, the use of ATMs of other financial institutions, which were equipped with an interconnection system among themselves, such as BANRED, or other electronic channels to return the funds entrusted to its custody, therefore, said bank had to evaluate and require that the ATMs enabled to dispense money from the ATM cards of its savings or checking accounts delivered to its clients, have the appropriate security measures in order to be able to comply with its obligations as a custodian of the monies that its users have entrusted to it;

THAT regarding the bank's argument, in which it mentions that the information sent by the financial institution has not been taken into account, this Office agrees with what was stated in the technical report contained in memorandum No. DNAE-SAU-2014-0837, dated July 30, 2014, through which the Under-Directorship of User Attention pointed out the following:

*

"(...)

• Regarding the resolution issued violating legal security and going against due process, that the information sent by National Development Bank has not been taken into consideration, I must indicate that the administrative acts through which the disposition was issued that National Development Bank proceed to refund USD 2,914.00... were elaborated in accordance with the information sent by the financial entity and by the user in the claim presented. It should be mentioned that in compliance with what is established in the Constitution and in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, regarding guaranteeing due process and the rights of the parties, the financial entity was notified of the claim presented by the user, while information was requested from it; therefore, its argument that the information sent by National Development Bank has not been taken into consideration does not hold, nor has due process and the consequent legal security been violated.

(...).";

THAT it is necessary to mention that, within the controls and security measures that National Development Bank must take into account when offering services through electronic channels, is the issuing of timely alerts to avoid the possible commission of cybercrimes, therefore, financial institutions are obligated to put at the service of users policies on the dissemination of the conditions surrounding the use of said services, including the implemented security measures and their possible risks when accessing said services, in this sense, the cited bank cannot disclaim its responsibility for the integral control that minimizes the risk of exposure of its clients, nor the co-responsibility in the service offered by companies associated with the interbank payment network "BANRED";

THAT regarding the argument that Mrs. Marisela Melania Castro Arguello did not apply basic security recommendations when using the electronic service, it must be emphasized that in the process of cloning a debit card, information from financial users is taken through devices placed in the ATMs of different financial institutions that provide this service, which do not have the appropriate anti-skimming security measures, so the financial user is not the one called to prove the proper functioning of the ATMs, since National Development Bank is the one providing this transactional service, therefore, the financial institution cannot disclaim its responsibility for the service offered;

THAT regarding the argument in which it mentions that the control body is not competent to pronounce itself on this type of case, considering it a criminal act, the Superintendence of Banks from the administrative scope is the competent body, since according to what is stipulated in Article 5 of

*

Chapter IV, Title XX, Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, by virtue of the transactions carried out on the client's account causing her economic harm, originated by an incorrect procedure of the controlled institution for not monitoring or implementing alerts on the movements occurring in the account entrusted to its custody, so National Development Bank allowed the security controls of the debit card delivered to be violated;

THAT regarding the disposition issued by the National Directorate of Attention and User Education, ordering the restitution of USD $2,914.00, and not USD $5,000.00, claimed by Mrs. Marisela Melania Castro Arguello, it is necessary to transcribe part of technical report No. DNAE-SAU-2014-01185, dated October 30, 2014, in which it mentions:

"(...)

Reviewed the transactions carried out with debit card No. 6031600043061884, whose holder is Mrs. Marisela Melania Castro Arguello, in the period indicated by the claimant, 57 records were obtained reaching a value of USD 4,721.15. These transactions were carried out in the cities of Quito and Lago Agrio, using the ATMs of the following financial entities: National Development Bank, Guayaquil S.A., Internacional S.A., Pichincha C.A., Pacifico S.A., Bolivariano S.A. and Police National Cooperative. It is observed that certain withdrawals were indeed made by the claimant, especially in the city of Lago Agrio. Under this criterion, the claimant could have determined in advance that anomalies were occurring in her savings account, possibly avoiding that the harm be of greater magnitude, for this reason, only the transactions carried out from September 17 to 30, 2013, which amount to USD 2,914.00, were considered, which was ordered to be returned to the financial entity and not the total claimed by Mrs. Marisela Melania Castro Arguello.

(...). (sic);

THAT from the review and analysis carried out, it emerges that National Development Bank transferred the responsibility of the facts to Mrs. Marisela Melania Castro Arguello for being the person who safeguards the card and keys, without considering that the bank has the obligation not only to safeguard the deposited monies, but also to provide security in the channels of the services offered;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0060 of January 26, 2015, recommended to the Banking Board to reject the claim contained in the review appeal filed;

AND, in exercise of its legal attributions,

*

RESOLVES:

SINGLE ARTICLE.- REJECT the claim contained in the review appeal presented by Mr. José Andrade López, General Manager and Legal Representative of National Development Bank; and, consequently CONFIRM the administrative act contained in letter No. DNAE-SAU-2014-3422, dated May 30, 2014, which ratifies letter No. DNAE-SAU-2014-1972, dated March 31, 2014, through which Ms. María Verónica Cevallos, then Under-Director of User Attention, ordered National Development Bank to refund Mrs. Marisela Melania Castro Arguello the amount of USD $2,914.00.

NOTIFY.- Given at the Superintendence of Banks, in Quito, Metropolitan District, on the thirtieth of April of two thousand fifteen.

(Signature)
Econ. Rodrigo Landeta Parra
GENERAL INTENDANT, S
PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on the thirtieth of April of two thousand fifteen.

(Signature)
Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD