Banking Board of Ecuador

RESOLUTION No. JB-2015-3408

THE BANKING BOARD

CONSIDERING:

THAT the second paragraph of the Third Transitory Provision of the Organic Code of Monetary and Financial Affairs determines that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling on the date this Code entered into force, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT through Resolution No. 054-2015-F, dated March 5, 2015, published in the Official Register No. 467, dated March 27, 2015, the aforementioned Board extended the deadline by an additional one hundred and eighty days for the Banking Board to continue acting and resolve all claims, appeals, and other administrative procedures within its competence;

THAT through a communication received by this Superintendency on December 17, 2013, Mr. David Fernando Rodríguez Calvo filed an administrative claim, requesting the Superintendency to order the National Bank of Development (Banco Nacional de Fomento) to return the sum of US$ 1,754.50, which was debited from his account without his authorization, through transactions made at automated teller machines (ATMs) linked to his savings account No. 1110000394 held at said bank;

THAT the Regional Intendancy of Guayaquil, through letter No. DAyEU-ISFP-REQ-2014-026 dated January 6, 2014, forwarded the aforementioned claim to the bank, requesting that it provide relevant explanations and documentary defenses, while simultaneously notifying Mr. David Fernando Rodríguez Calvo of the matter;

THAT through letter No. 017-2014 received by the Regional Intendancy of Guayaquil on January 30, 2014, the National Bank of Development submitted information regarding the customer's claim;

THAT the Regional Intendancy of Guayaquil, based on the content of the claim and the review of the information submitted by the entity, through letter No. IRG-DAyEU-V-R-2014-451 dated May 15, 2014, ordered the National Bank of Development as follows:

"(...) proceed to restore to Mr. ..., the sum of US$ 1,754.50 (...) debited from his savings account ..., which he holds at the aforementioned bank ..., being able to exercise his right of recourse against the (sic) institutions owning the automated teller machines where the disputed withdrawals occurred, ..." (sic);

THAT through a communication received by the Regional Intendancy of Guayaquil on May 30, 2014, the National Bank of Development filed an appeal for reconsideration (recurso de reposición) against the administrative act contained in letter No. IRG-DAyEU-V-R-2014-451 dated May 15, 2014;

Page No. 2

THAT through letter No. IRG-DAyEU-V-R-2014-632 dated June 19, 2014, the Regional Intendancy of Guayaquil resolved to reject the claim contained in the appeal for reconsideration filed by the aforementioned bank, and confirmed letter No. IRG-DAyEU-V-R-2014-451 dated May 15, 2014;

THAT through writings received by the Superintendency on July 8 and 18, 2014, Ms. Erika Palma Portilla, Commercial Manager of the National Bank of Development, Guayaquil Branch, with the professional sponsorship of attorneys María Angélica Pazmiño M. and Licencia Rizzo Zambrano, filed an appeal for review (recurso de revisión) before the Banking Board against letter No. IRG-DAyEU-V-R-2014-632 dated June 19, 2014, arguing the following: that the claimant did not apply basic security recommendations for the handling of the debit card, which were formally communicated to him through various media; that the bank permanently undertakes efforts to ensure that the requested information is delivered to this control body by private financial institutions, some of which are less predisposed than others to attend to such requests, which has resulted in the information being delivered partially; that the abundant new information provided by the bank was not considered by the Regional Intendant of Guayaquil when issuing his resolution, noting that the bank is the only one that has collaborated with the Superintendency by presenting all the required documentation; that a review of the text of the challenged resolution reveals "...that in its analysis, there are no expository, considerative, and resolutive conclusions that allow us to verify and confirm that (sic) the administrative act contained in letter No. IRG-DAyEU-V-R-451..."; and, that what has been provoked by the issuance of these letters is the nullity of the actions taken by the Regional Intendant, resulting in the non-compliance with due process guarantees and creating legal insecurity;

THAT through letter No. JB-2014-1952 dated July 24, 2014, the Secretary of the Banking Board accepted the appeal for review filed for processing, and through letter No. JB-2014-1953 of the same date, sent a photocopy of the acceptance letter and the writing through which the bank filed the appeal for review to Mr. David Fernando Rodríguez Calvo;

THAT according to Articles 52 and 66, numeral 25 of the Constitution of the Republic, which guarantee persons the right to dispose of goods and services of optimal quality and to access timely and adequate information about their content and characteristics, the National Bank of Development, a financial entity controlled by this Superintendency, offering various services to its customers, including fund withdrawals via ATM's, is obligated to evaluate and demand the necessary security measures in order to provide an optimal and efficient service to its customers, thereby guaranteeing their rights as financial users, since the bank is the custodian of the monies entrusted to it;

THAT regarding the argument that the claimant did not apply basic security recommendations for the handling of his card, which were communicated to him through various media, it is specified that there are no documentary grounds within the case file that demonstrate that the

Page No. 3

client has ever compromised the security of his card; however, the bank does not refer to the levels or standards of compliance and security related to quality, validation, and review of its own ATMs and the network within its different stages of the procedure until the transaction is qualified as successful, which it is obligated to comply with based on the responsibility it assumed to keep with utmost diligence and professional care the values deposited by the client under its custody, and to satisfactorily attend to all withdrawal operations requested by him, in the manner agreed upon in the corresponding legal document, and implemented under the authority of Article 51 of the General Law of Institutions of the Financial System;

THAT consequently, in order to provide a secure and quality service to customers, it corresponds to request information from other financial entities in order to resolve diligently the claims raised by financial users, as well as to present relevant documentary defenses in a complete and not partial manner, to exempt itself from liability, if applicable, by virtue of the agreements it enters into with service providers of the network; therefore, it is not appropriate to transfer the operational risk of the ATM service, whether its own or third-party, to the customers, since it is offered on behalf of and as part of the banking entities to their customers, constituting their obligation to take the pertinent precautions and security measures, observing therefore a failure to comply with what is stipulated in numeral 4.3.6., Article 4, Chapter V.- On operational risk management, Title X, Book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, which refers that in order to guarantee security in transactions made through automated teller machines, financial system institutions must comply with the provisions of Article 40, Chapter I, Title II, Book I of the aforementioned codification, which provides:

"40.2 Protection against card cloning.- Have electronic devices and/or physical elements that effectively prevent and detect the placement of false card readers, in order to avoid the cloning of debit or credit cards, in addition to the corresponding online monitoring mechanisms of the alarms generated by the electronic devices in case of unusual events;"

THAT the appellant's argument, that the claim was resolved without considering the abundant new information sent by the bank, which changes the circumstances of the claim; is not valid, since the Regional Intendancy of Guayaquil, after analyzing and validating the information submitted by the parties, issued the resolution of letter No. IRG-DAyEU-V-R-2014-451 dated May 15, 2014, specifying the non-compliance with the regulations in force at the time of the events, in which the bank incurred, related to security measures in ATMs that controlled entities must have, determining from the documentation in the file that poor placement of video cameras could be observed, which did not allow establishing the person who made the withdrawal and whether a card with the bank's logo was used, also referring to the system recording time and images that had to be maintained and the pertinent procedures and

Page No. 4

control mechanisms it had to comply with to protect the information contained in the different storage media; as well as, to register the customer's profile regarding their transactional habits in the use of the ATM electronic channel.

Subsequently, through letter No. IRG-DAyEU-V-R-2014-632 dated June 19, 2014, it rejected the appeal for reconsideration filed by the bank, referring to Article 3, Section I.- "On Reconsideration", Chapter II.- "Norms for the application of appeals for reconsideration and review in matters related to the financial system and the social security system; and of appeal in private insurance matters", regarding administrative acts of the Superintendency of Banks and Insurance, Title XVI.- "On sanctions and appeals in the administrative sphere", Book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, according to which, the appeal for reconsideration must be based solely on the existence of factual or legal elements not known to the Superintendency or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution, determining that the appellant did not provide documentary evidence or new information on the merits of the subject matter of the administrative claim, which would change the circumstances by which the letter resolving the claim filed by Mr. David Fernando Rodríguez Calvo was issued.

In this line, what is affirmed by the appellant to the effect that in the expository, considerative, and resolutive part of the challenged letter there is no analysis that allows verifying and confirming the administrative act of letter No. IRG-DAyEU-V-R-451; lacks foundation;

THAT this control body, in accordance with the procedure for handling claims contained in the Codification of Resolutions of the Superintendency of Banks and Insurance, within the different stages of both the claim and the appeal for reconsideration, addressed and analyzed the arguments of the parties and defenses of the documentation submitted that is part of the file, and resolved it, strictly within the scope of its administrative competence, and in compliance and observance of due process constitutionally enshrined, resulting in the allegations by the appellant that the resolution of letter No. IRG-DAyEU-V-R-451 is null, and that the challenged letter confirming it affects said right; to be inadmissible;

THAT the responsibility then falls on the National Bank of Development, a controlled entity to which it corresponds to adequately manage risks related to transactions via ATMs, whether or not of the same entity, in compliance with what is stipulated in Article 5, Section III, Chapter V.- On risk management and administration, Title X, Book I, of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board;

THAT from the preceding analysis, it is derived that the National Bank of Development incurred an incorrect procedure determined in the preceding considerations, by not adopting the pertinent security measures as demanded by the aforementioned regulations, in order to avoid and/or minimize this type

Page No. 5

of events that inherently carry risks in transactions made via ATMs, in the account delivered under its custody, a situation that subsequently caused the security controls of the debit card issued by the bank to the user to be violated, causing economic harm to the same; therefore, in this case, having complied with what is stipulated in Article 5 of Chapter IV.- Procedure for handling claims against Institutions of the Financial System, Title XX, Book I "General norms for the application of the General Law of Institutions of the Financial System" of the aforementioned codification, it was appropriate for this control body to order the return of the values claimed by Mr. David Fernando Rodríguez Calvo;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0147 dated February 9, 2015, recommended the Banking Board to reject the claim contained in the appeal for review filed;

AND, in exercise of its legal attributes,

RESOLVES:

SINGLE ARTICLE.- REJECT the claim contained in the appeal for review filed by the National Bank of Development against letter No. IRG-DAyEU-V-R-2014-632, dated June 19, 2014; and, consequently, CONFIRM the administrative act contained in letter No. IRG-DAyEU-V-R-2014-451 dated May 15, 2014, with which the Regional Intendancy of Guayaquil ordered the bank to reimburse the transactions claimed by the sum of US$ 1,754.50 to Mr. David Fernando Rodríguez Calvo.

NOTIFY.- Given at the Superintendency of Banks, in Quito, Metropolitan District, on the thirteenth of May of two thousand fifteen.

Signature

Econ. Rodrigo Landeta Parra
GENERAL INTENDANT, S
PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on the thirteenth of May of two thousand fifteen.

Signature

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD

Page No. 6

Banking Board of Ecuador