Banking Board of Ecuador

RESOLUTION No. JB-2015-3464

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332 of September 12, 2014, whose text states that resolutions contained in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and the norms issued by control bodies, will remain in force insofar as they do not oppose what is provided in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling on the date of entry into force of the same, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT on February 10, 2014, Mr. Fausto Joselito Gaibor Vargas, filed an administrative claim with the Regional Intendancy of Guayaquil, against the National Development Bank (Banco Nacional de Fomento), through which he requests that the referred banking entity be ordered to return the sum of US$ 964.85 corresponding to unauthorized debits by the user, basing his claim on the fact that he did not realize that money had been stolen from his savings account until he made a deposit in his passbook and updated it;

THAT by letter No. DAYEU-ISFP-REQ-2014-361 of February 24, 2014, the Regional Intendancy of Guayaquil notified the National Development Bank of the claim filed against it, and requested various defenses and information, which would contribute to the Bank Superintendence having sufficient evidence and instruments to issue the corresponding resolution;

THAT by letter No. 04086, received at the Regional Intendancy of Guayaquil on March 31, 2014, the National Development Bank presented explanations and defenses related to the claim filed by Mr. Fausto Joselito Gaibor Vargas, basing its action mainly on the following:

"(...)

It should be noted that the National Development Bank, in order to meet the different information requests requested by that Control Body and by customer requests (videos) that have been harmed by withdrawals of money from their accounts through ATMs of other Financial Institutions, has been carrying out the pertinent management and insistence for the delivery of information; however, we do not have the collaboration of said institutions and predisposition to deliver the required information (...)

It is reported that it cannot be established in this type of claims that all cases are cloning, despite having information and videos; in reason that the Bank in similar cases has been able to verify that the claimed withdrawals are made by people from the client's environment, and in other cases have been misuse of the debit card."

THAT by letter No. DAYEU-V-R-2014-712 of June 30, 2014, the Regional Intendancy of Guayaquil, accepted the claimant's pretension, resolving to order the NATIONAL DEVELOPMENT BANK to proceed to restore US$ 964.85 dollars stolen from savings account No. 4002765688 belonging to the claimant, corresponding to the transactions made on December 12 to 15, 2013;

---

Resolution No. JB-2015-3464

Page No. 2

THAT by writing received at the Regional Intendancy of Guayaquil on July 15, 2014, the National Development Bank, filed an appeal for reconsideration of the administrative act contained in letter No. DAYEU-V-R-2014-712 of June 30, 2014;

THAT by letter No. IRG-DAYEU-V-R-2014-848 of August 5, 2014, the Regional Intendancy of Guayaquil resolved to REJECT the pretension contained in the appeal for reconsideration filed; and, consequently, CONFIRM the administrative act contained in letter No. DAYEU-V-R-2014-712 of June 30, 2014, for the motivation stated therein;

THAT by writing entered in the Regional Intendancy of Guayaquil on August 18, 2014, the Mgs. Ángela Mercedes Aviléz Gómez, Commercial Manager of the National Development Bank-Guayaquil, filed before the Banking Board an appeal for review of the administrative act contained in letter No. IRG-DAYEU-V-R-2014-848 of August 5, 2014; arguing:

• That "(...) the client FAUSTO JOSELITO GAIBOR VARGAS is the sole and exclusive responsible for the handling and care of the card and for compliance with the terms of the agreement and in particular for any correct use, which results in the claim made lacking legal and moral basis, therefore there is also no support for ordering the reimbursement of values."

• That "The evidence provided by the National Development Bank has not been considered by the Regional Intendant of Guayaquil when issuing his resolution in the present administrative process, filed by Mr. FAUSTO JOSELITO GAIBOR VARGAS, rather he rejects the appeal for reconsideration filed by the banking institution he represents and confirms the administrative act contained in letter No. IRG-DAYEU-V-R-2014-712(sic), of June 30, 2014."

THAT the appeal for review was accepted for processing by the lawyer Pablo Cobo Luna, Secretary of the Banking Board, by letter No. JB-2014-2285 of August 26, 2014;

THAT from the review of the documents constituting the file of the administrative claim presented by Mr. Fausto Joselito Gaibor Vargas, on February 10, 2014, against the National Development Bank, through which he requested that the referred banking entity be ordered to return the sum of US$ 964.85 charged to his savings account No. 4002765688, it is evident that the debits allegedly unauthorized by the user were made in "(...) ATMs of the financial institutions: Pacifico Bank, National Police Coop., National Development Bank, Guayaquil Bank, International Bank, Pichincha Bank." although it is also demonstrated that from the review of "(...) the notifications from the BANRED Security Committee there are no matches of compromise in ATMs used by our client before the claimed transactions, whose transactions were carried out normally and it was not possible to determine irregularities. It should be indicated that prior to the claimed transactions, the client used ATMs of other Financial Institutions, which potentially could have been exposed to third-party manipulation."

THAT regarding literal a) of the appellant's arguments; the National Development Bank states that the client did not apply basic security recommendations and although it is true that the client is the custodian of the card issued by the bank and solely responsible for its use, it is necessary to state that in the case at hand it is not evident that Mr. Fausto Joselito Gaibor Vargas has compromised at any time the security of his debit card, granted by the controlled entity. Likewise, it should be indicated that if the claiming user used BANRED ATMs, it is because it is a service that the bank made available to its clients;

---

Resolution No. JB-2015-3464

Page No. 3

THAT literal a) of article 51 of the General Law of Institutions of the Financial System, states that banks are authorized to "Receive public resources in demand deposits. Demand deposits are banking obligations, comprising monetary deposits through the presentation of checks or other payment and registration mechanisms; savings deposits payable upon presentation of savings passbooks or other payment and registration mechanisms";

THAT the above is reinforced by what is determined in the Constitution of the Republic of Ecuador in its article 308 which says "(...) Financial activities are a public order service, and may be exercised, with prior authorization of the State, in accordance with the law; they will have the fundamental purpose of preserving deposits and meeting financing requirements for the achievement of the country's development objectives. (...)";

THAT from the cited regulatory framework, it is determined that the National Development Bank assumes the obligation to keep or safeguard the deposited values and satisfactorily attend all types of operations, with diligence and professional care, as well as being responsible for the other services offered to its clients, it is obliged to evaluate and demand the security measures in case to be able to fulfill its obligations as a depository of the money that its clients have entrusted to it;

THAT in this regard it is necessary to specify that the use of ATMs of other institutions by any client of the bank, as in the case of the claimant, arises from the service offered by the National Development Bank; in that sense, the banking institution cannot transfer the responsibility to its client for the inadequate service that may be provided by another institution's ATM, even though such use arises from the contract that for this effect have been signed by the bank and other financial institutions with BANRED. The client, by virtue of the contract signed with the bank for the use of the products and services that it offers, maintains a direct relationship with that institution which is the custodian of the money, hence the responsibility of the institution regarding events such as the one that motivated the challenged resolution;

THAT likewise it is worth mentioning article 3 of Book I "General Norms for the application of the General Law of Institutions of the Financial System", title X "On risk management and administration", chapter I "On integral risk management and control" of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, which refers to the fact that integral risk management is one of the responsibilities attributed to institutions that are part of the Financial System, by virtue of that, they must have formal processes of integral risk management that allow identifying, measuring, controlling, mitigating and monitoring the risk exposures they are assuming;

THAT the above is reinforced by sub-number 4.3.8.20 of article 4 of chapter V "On Operational Risk Management", title X "On risk management and administration", of Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board in which it indicates that "Institutions of the financial system must offer clients online sending through mobile messaging, email or other mechanism, the confirmation of access to electronic banking, as well as of the transactions carried out through any of the available electronic channels, or by means of cards", notification which in the present case is not evidenced, resulting in that the user only realizes what happened when he updated his savings passbook;

THAT additionally the National Development Bank states that it is carrying out management in order for the requested information to be delivered to the control body by private financial institutions and in this way attend the requirements of the control entity since without access to these files they are

---

Resolution No. JB-2015-3464

Page No. 4

subject to the fact that some entities have less predisposition than others, which has caused the information to be delivered partially;

THAT regarding such statement made by the Bank, it should be indicated that the contracts celebrated between the institutions of the financial system with service providers, with the aim of providing their clients with a wider coverage of ATMs, are the exclusive responsibility of such entities, not being able to transfer the operational risk of said service to the users, since this is offered on behalf and as part of the facilities given by the banking entities to their clients, being thus the obligation of the controlled institution to take all precautions and security measures;

THAT article 3 of chapter II, title XVI of book I of the Codification of Resolutions of the Superintendence of Banks and Insurance establishes that: "the appeal for reconsideration must be based only on the existence of elements of fact or law not known by the Superintendence of Banks and Insurance or the Banking Board at the time of issuing the resolution, whose record, if it had existed, could have decisively influenced the sense of the resolution", norm that the National Development Bank did not consider. Nevertheless, the control body considered the information sent as well as all that rests in the file and the arguments of fact and law raised in the appeal, and rejected it by virtue of its analysis;

THAT article 5, of chapter IV "Procedure for the attention of claims against Institutions of the Financial System", title XX "On the Superintendence of Banks and Insurance", book I "General norms for the application of the General Law of Institutions of the Financial System", of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, empowers the control body to order the return of the values claimed by the controlled institutions, in exercise of the functions and attributions that both the constitutional and legal norms establish, since it disposes that: "(...) If the situation that motivated the claim referred to in the previous paragraph, originated in an incorrect procedure of the controlled institution, which has caused harm to the claimant, the Superintendence of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributions contemplated in letters b) and o) of article 180 of the General Law of Institutions of the Financial System, granting the legal representative of the entity a period that cannot exceed fifteen (15) days from the notification to send, under the legal warnings, the record of compliance with the order issued.

For claims of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client maintains his account, if said withdrawals originated in an incorrect procedure of the controlled institution, this one being able to repeat against the institution owning or operating the ATM by whose defects or lack of security measures the fraud occurred.";

THAT the National Development Bank, entity depositary and custodian of its clients' money, by placing the banred ATM service at the disposal of its users, has the legal obligation that the ATM channel, whether its own or third-party, provides its clients with all the security that the case merits, which do not reside only in the use of the secret key but also in the expected inviolability of the magnetic card delivered and, of the ATMs (own or third-party) with adequate mechanisms; so that in the present case, the banking institution incurred in an incorrect procedure by which the security measures were violated, without in the present case having evidenced or discharged documents that determine that the cardholder carried out the transactions or that there was carelessness or mishandling of the debit card by the claimant;

---

Resolution No. JB-2015-3464

Page No. 5

THAT from the Report of Claims by clients for transactions not made in ATMs, dated February 27, 2014, it is appreciated that "(...) there are no matches of compromise in ATMs used by our client before the claimed transactions, whose transactions were carried out normally and it was not possible to determine irregularities. It should be indicated that prior to the claimed transactions, the client used ATMs of other Financial Institutions, which potentially could have been exposed to third-party manipulation.";

THAT from annex 2 sent by National Development Bank, the emails sent to the Banks: International, Guayaquil, Pacifico, Pichincha and to the National Police Cooperative, are visible, in order to obtain information on the transactions that originated the claim by Mr. Fausto Joselito Gaibor Vargas; being these last two the only ones to send the videos belonging to the withdrawals made on December 12 and 13, 2013, respectively; in which it is observed the same subject carrying out the claimed transactions, with a card that does not belong to those issued by the controlled financial entity National Development Bank, so that in the present case we would be facing a possible card cloning;

THAT from the documentation sent by the bank, it is recorded that the transactions subject of the claim were made on December 12 to 15, 2013; and are detailed below:

ATM	TRANS	FECHA	HORA	MONTO	ADQUIRIENTE	CUENTA
8152	RETAH	15/12/2013	20:23:54	90,5	GUAYAQUIL	4002765688
8152	RETAH	15/12/2013	20:23:10	100,5	GUAYAQUIL	4002765688
405	RETAH	15/12/2013	20:17:38	100,5	INTERNACIONAL	4002765688
413	RETAH	14/12/2013	20:13:22	90,5	INTERNACIONAL	4002765688
165	RETAH	14/12/2013	13:58:57	100,5	PICHINCHA	4002765688
165	RETAH	14/12/2013	13:58:16	100,5	PICHINCHA	4002765688
1662	RETAH	13/12/2013	7:01:16	90,5	PICHINCHA	4002765688
1660	RETAH	13/12/2013	7:00:41	100,5	PICHINCHA	4002765688
1662	RETAH	13/12/2013	7:00:07	100,5	PICHINCHA	4002765688
6	RETAH	12/12/2013	19:24:57	90,45	C. POLICIA NACIONAL	4002765688
6	RETAH	12/12/2013	19:24:23	100,45	C. POLICIA NACIONAL	4002765688
6	RETAH	12/12/2013	19:23:49	100,45	C. POLICIA NACIONAL	4002765688
				1165,85

THAT the National Legal Intendancy, by memorandum INJ-DNJ-SAL-2015-0083 of February 2, 2015, recommended to the Banking Board to reject the pretension contained in the appeal filed by the Commercial Manager of the National Development Bank-Guayaquil; and,

IN exercise of its legal attributions,

RESOLVES:

SINGLE ARTICLE.- REJECT the pretension contained in the appeal for review filed by the Mgs. Ángela Mercedes Aviléz Gómez, Commercial Manager of the National Development Bank-Guayaquil; and, CONFIRM letter No. IRG-DAYEU-V-R-2014-848 of August 5, 2014, which ratified letter No. DAYEU-V-R-2014-712 of June 30, 2014, through which the Regional Intendancy of Guayaquil, ordered NATIONAL DEVELOPMENT BANK to proceed to reintegrate US$ 964.85, value debited without authorization from savings account No. 4002765688, belonging to Mr. FAUSTO JOSELITO GAIBOR VARGAS; the banking institution being able to repeat against the institution owning or operating the ATMs by whose defects or lack of security measures the fraud occurred.

---

Resolution No. JB-2015-3464

Page No. 6

NOTIFY.- Given at the Superintendence of Banks and Insurance, in Quito, Metropolitan District, on the fourth of June of two thousand fifteen.

Econ. Rodrigo Bandeta Parra
GENERAL INTENDANT (S)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on the fourth of June of two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD