Banking Board of Ecuador

RESOLUTION No. JB-2015-3485

THE BANKING BOARD

CONSIDERING:

THAT this appeal is resolved in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332 of September 12, 2014, whose text states that resolutions contained in the Codification of Resolutions of the Superintendence of Banks and Insurance and the Banking Board, and norms issued by control bodies, will remain in effect insofar as they do not conflict with the provisions of the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what is appropriate, depending on the case; and with the second paragraph of the Third Transitional Provision, which states that the Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures it was handling on the date of entry into force of said Code, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT from the aforementioned provisions, it is established that the Banking Board is competent to resolve the present review appeal;

THAT through a communication entered into the Superintendence of Banks and Insurance on January 7, 2014, Mr. Richard Edison Marshall Díaz filed a complaint against Banco de Guayaquil, regarding withdrawals made from ATMs of various financial institutions on December 13 and 14, 2013, and in which he requested in the pertinent part that "it be investigated and that the Bank Return [sic] my stolen money which is the Value of $260 US Dollars,[sic] also I have not taken out my Debit Card for anything, I have kept it in good safekeeping, nor have I made Balance inquiries, I have only worked with the Banco Control card." [sic];

THAT through Official Letter No. DAYEU-ISFP-REQ-2014-133 of January 15, 2014, the Director of User Attention of the Guayaquil Intendancy requested from Banco de Guayaquil S.A. substantiated and documented information with respective physical backups regarding the aforementioned complaint; a request that was attended to with Official Letter No. UAC-SBS-2014-123 of January 30, 2014, signed by the General Manager of the referred banking institution;

THAT through Official Letter No. IDG-DAYEU-V-R-2014-604 of June 12, 2014, the Intendant of Guayaquil resolved:

"1. ACCEPT the complaint presented by Mr. Richard Edison Marshall Díaz, with citizenship ID No. 090910045-5, against the controlled financial institution BANCO DE GUAYAQUIL S.A., on the grounds that it has not been evidenced that the claimant has given improper use to the debit card issued in his favor by the controlled institution. Furthermore, as the videos of the ATMs where the transactions were made were not sent, the lack of one of the security measures required by the regulations was evidenced."

---

Resolution No. JB-2015-3485

Page No. 2

2. ORDER the controlled financial institution Banco de Guayaquil S.A. to proceed to restore to Mr. RICHARD EDISON MARSHALL DÍAZ the sum of US$ 162.00 (ONE HUNDRED AND SIXTY 00/100 DOLLARS CURRENT OF THE UNITED STATES OF AMERICA), debited from checking account No. 23803607, on December 14, 2013, being able to exercise his right of recourse against the institution owning the ATM where the challenged withdrawals were made, and send to this Office, within eight days, counted from the receipt of this letter, the documentation that accredits the compliance with this resolution.

(...);

THAT through a document entered into the Superintendence of Banks and Insurance on June 23, 2014, Banco de Guayaquil filed an appeal for reconsideration of the administrative act contained in Official Letter No. DAYEU-V-R-2014-604 of June 12, 2014; and, through Official Letter No. IRG-DAYEU-V-R-2014-214 of July 29, 2014, the Intendant of Guayaquil resolved to reject the appeal for reconsideration filed and consequently, confirmed Official Letter No. IRG-DAYEU-V-R-2014-604 of June 12, 2014;

THAT through a document received in the Superintendence of Banks and Insurance on August 12, 2014, the General Manager of Banco de Guayaquil S.A., with the professional sponsorship of lawyer Rosa Tobar Reina, filed a review appeal against Official Letter No. IRG-DAYEU-V-R-2014-214 of July 29, 2014, with the following arguments: that the bank, after respective reviews and analyses, established the customer's complaint regarding transactions made on December 14, 2013, as inadmissible, on the grounds that the mentioned transaction did not show a fraud behavior, since the customer's account maintained available balance and the withdrawals were made for amounts lower than the daily limits; that the system successfully validated the transaction because keys known only by the client were used; that the control entity resolved to accept the complaint of Mr. Richard Edison Marshall Díaz, originated by debits made by the bank against his debit card, resulting from withdrawals in the ATMs of Banco de Machala, for which it ordered Banco de Guayaquil S.A. to restore to the customer's account the value of US$160.00; that the client has always transacted with the same plastic card granted to the client on June 4, 2013, "therefore, CARD CLONATION HAS NOT BEEN EVIDENCED, which EVIDENCES FEHACIENTLY that Mr. RICHARD EDISON MARSHALL has been making withdrawals without problems"; that "it is a case of failure to exercise due custody of the debit card by the client and not due to cloning, and we make this affirmation, since cloning has as characteristics: i) that withdrawals are made in several ATMs, ii) in a single day, and iii) only up to the maximum amount of each ATM, characteristics that were not present in this case."; that it is not the bank's obligation to demonstrate whether a client properly or improperly safeguards their personal keys, what must be verified is that transactions are made with those personal keys, as these constitute the undisputed identification of the client in electronic transactions; that in an analogous case, the control entity issued the criterion on the present issue and set aside the payment order on the customer's complaint; that the bank, conscious of the risk of computer fraud under the "skimming" modality, constantly works in the development of new mechanisms that

---

Banking Board of Ecuador

Resolution No. JB-2015-3485

Page No. 3

grant the client greater security when making their transactions, it is for this reason that it implemented as an additional security measure the service of immediate notification via SMS and/or email of transactions that are made through ATMs and Maestro purchases; that the observations referred to the non-delivery of the security video, do not constitute a fact that generated the incorrect use of the card, since the bank's system registered said transactions as successful, because they were made with the debit card and the client's key; that the presentation of the videos does not correspond to Banco de Guayaquil S.A. but to the banks owning the ATMs where these transactions were made, that is, Banco de Machala S.A.; that regarding Official Letter IRG-DAYEU-V-R-2014-214, it is not the bank's responsibility or faculty to certify whether the ATMs of the network of other entities have or do not have protections; that in this sense, the bank has indicated that according to the report of the Fraud Prevention Unit, the client made transactions in other ATMs that do not belong to Banco de Guayaquil, without this implying a judgment of value on third parties; that the only cause for which the authority can order the reimbursement of claimed values is when the controlled institution commits an incorrect procedure, which has not happened in the present case;

THAT with Official Letter No. JB-2014-2223 of August 19, 2014, the Secretary of the Banking Board, accepted the referred review appeal for processing and with Official Letter No. JB-2014-2224, of the same date, made known the particular to Mr. Richard Edison Marshall Díaz;

THAT this appeal is analyzed in accordance with the First Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332 of September 12, 2014, which says: "(...) resolutions that appear in the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, (...) and the norms issued by the control bodies, will maintain their validity in everything that does not oppose what is established in the Organic Monetary and Financial Code, until the Monetary and Financial Policy and Regulation Board resolves what corresponds, according to the case"; and with the second paragraph of the Third Transitional Provision, which expresses: "The Banking Board will continue to act until it resolves all claims, appeals, and other administrative procedures that it was handling on the date of entry into force of this Code, within a period of one hundred and eighty (180) days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board"; therefore, these provisions establish the competence of the Banking Board to resolve the present review appeal.";

THAT Article 1, in concordance with Article 180, letters b) and o) of the General Law of Institutions of the Financial System, in force on the date of the complaint, disposed the Superintendence of Banks and Insurance, within the orbit of its competence, the supervision and control of the financial system, taking into account the protection of the interests of the public, as well as requiring that controlled institutions present and adopt the corresponding corrective measures;

THAT in merit of the referred legal norm, the Banking Board, with the purpose of achieving effective compliance with the provisions emanating from both the control body and the collegiate body, integrated into Chapter IV, Title XX, Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the

---

Banking Board of Ecuador

Resolution No. JB-2015-3485

Page No. 4

Banking Board, the procedure for the attention of complaints against institutions of the financial system, always attentive to the protection of the interests of the public as mandated by law, whose Article 5 establishes that if the result of the analysis carried out by the Superintendence determines the need for the controlled institution to introduce corrective measures that regularize the situation that motivated the complaint, the Superintendent of Banks and Insurance or his delegate will impart the corresponding disposition. Likewise, if the situation that motivated the complaint referred to in the previous paragraph, originated in an incorrect procedure of the controlled institution, which had caused harm to the claimant, the Superintendence of Banks can order the return of the claimed values, granting the legal representative of the entity a period that cannot exceed fifteen (15) days from the notification to send, under the precautions of law, the proof of compliance with the order imparted;

THAT the sole article of Resolution No. JB-2013-2611 of September 3, 2013, integrated into Chapter IV, of Title XX, Book I of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, says: "For complaints of unauthorized withdrawals due to evidence of attempts or frauds produced in ATMs, the Superintendence of Banks and Insurance will order the return of the claimed values to the institution issuing the credit card or where the client maintains his account, if said withdrawals originated in an incorrect procedure of the controlled institution, which may repeat against the institution owning or operating the ATM by whose defects or lack of security measures the fraud occurred.";

THAT the complaint to Banco de Guayaquil S.A. was for the value of US$ 260, for three transactions not assumed by Mr. Marshall Díaz; against which the bank, through Official Letter UAC-SBS-2014-123 of January 30, 2014, informed the control body that in this case, "it was determined that the return of the first transaction at Banco Pichincha was appropriate, since in the audit tapes of the transaction of December 13, 2013, an error is presented; on February 5, 2014, the bank proceeded to make a credit note for the value of US$100.50, in the savings account No. 3243171, of Mr. Marshall Díaz, (...)". Attached to said letter, Report No. FR-I-2013-0468 of December 23, 2013, from the Fraud Prevention area of Banco de Guayaquil S.A. regarding the complaint in closings, which states that the withdrawals were processed through ATM 19 of Banco de Machala S.A., located in Triunfo, on December 14, 2013, at 08:28:12 and 08:28:41, for US$ 60.50 and 100.50, respectively, within the client's daily limit, which at that moment amounted to US$ 310.00; therefore, it concluded that the complaint was inadmissible, taking into account the following: "The client maintained sufficient balance in his account, on the day of the claimed transactions, in addition, the value of the transactions is lower than the maximum daily withdrawal amount. (...) the client did not observe security measures such as immediately requesting the blocking of his card, nor did he change the PIN out of precaution";

THAT the appellant centered his arguments on the fact that the claimed transactions were made with the card assigned to the client to make said transactions and the key that only the client knows, which were under his custody and responsibility, so the system validated them and the transactions in question were correctly processed, without requiring any additional verification, an argument that contradicts the contractual obligation undertaken by the bank, based on the legal norms previously detailed, in order to safeguard that banking transactions are carried out under parameters of total security, conscious of the risk of computer fraud under the "skimming" modality, as the bank pointed out, since security does not reside only in the use of the secret key but also in the inviolability of the magnetic card delivered by the bank to its clients, in such a way that the patrimony entrusted to its custody, returns to its owner, at his request, through the electronic channels placed by the bank at the disposal of the account holder in the account opening contract, that is, those belonging to it or to other financial institutions, and whose monitoring must be fulfilled to prevent transactions from being susceptible to appropriation by unauthorized third parties; for the aforementioned reason, it becomes inadmissible for the appellant to disclaim the bank's responsibility for the fact of having assigned the referred debit card to the claimant and the fact that the withdrawals questioned by the client had occurred in ATMs that were not his property;

THAT Banco de Guayaquil S.A. insisted on its argument in the sense that in the questioned transactions, card cloning has not been evidenced, as they do not contain the proper characteristics; in this regard, it is necessary to point out the circumstance that the client maintained sufficient balance in his account on the day of the questioned withdrawals and they did not exceed the maximum daily withdrawal amount, this version does not disprove the fact that on December 13 and 14, 2013, three questioned transactions were executed, one of them, the one from December 13, according to the bank's statement, was processed with "error", for which it accepted to reintegrate the value of USD$100.50 to the claimant's account on February 5, 2014; not so the transactions from December 14, 2013, whose process could not be verified by the control body, as it did not contemplate in the present file the log or historical detail of the transactions; or the bank being able to disprove, through the corresponding videos of the questioned withdrawals, the correct use of the assigned card and the responsibility of Mr. Richard Edison Marshall Díaz in said transactions;

THAT in line with the above and in relation to the bank's argument that it is not its responsibility or faculty to certify whether the ATMs of the network of other entities where the challenged transactions were made have or do not have protections, it does not disclaim its contractual responsibility as custodian of depositors' funds, the obligation to demand from other entities with which it contracts the use of various channels such as ATMs, the compliance with security measures, more so as it mentions the risk related to the "skimming" modality, in order to deliver a service of optimal quality to its clients, as determined by the Constitution of the Republic and the Organic Law for the Defense of the Consumer;

THAT it has been evidenced in the present case that Banco de Guayaquil S.A. is subject to Article 5 of Chapter IV "Procedure for the attention of complaints against institutions of the financial system", Title XX "Of the Superintendence of Banks and Insurance", Book I "General Norms for the application of the General Law of Institutions of the Financial System" of the Codification of Resolutions of the Superintendence of Banks and Insurance and of the Banking Board, since the situation that motivated the complaint, was originated in an incorrect procedure, by not monitoring the client's funds, and

---

Banking Board of Ecuador

Resolution No. JB-2015-3485

Page No. 6

providing the respective securities through the ATMs placed at its service, without the bank having evidenced the client's responsibility in said transactions;

THAT the National Legal Intendancy, through memorandum INJ-DNJ-SAL-2015-0196 of March 9, 2015, recommended to the Banking Board to reject the claim contained in the appeal filed by the General Manager of Banco de Guayaquil S.A.; and,

IN exercise of its legal attributes,

RESOLVES:

SINGLE ARTICLE.- REJECT the claim contained in the review appeal filed by Mr. Víctor Hugo Alcívar Álava, General Manager of Banco de Guayaquil S.A.; and, consequently, CONFIRM Official Letter No. IRG-DAYEU-V-R-2014-214 of July 29, 2014, which rejected the appeal for reconsideration and confirmed Official Letter No. IRG-DAYEU-V-R-2014-604 of June 12, 2014, by which the Intendant of Guayaquil resolved to accept the complaint presented by Mr. Richard Edison Marshall Díaz, and ordered Banco de Guayaquil S.A. "to proceed to restore to Mr. RICHARD EDISON MARSHALL DÍAZ the sum of US$ 162.00 (ONE HUNDRED AND SIXTY 00/100 DOLLARS OF THE UNITED STATES OF AMERICA), debited from checking account No. 23803607, on December 14, 2013, being able to exercise his right of recourse against the institution owning the ATM where the challenged withdrawals were made, and send to this Office, within eight days, counted from the receipt of this letter, the documentation that accredits the compliance with this resolution".

NOTIFY.- Given at the Superintendence of Banks and Insurance, in Quito, Metropolitan District, on the seventeenth of June of two thousand fifteen.

---

Econ./Rodrigo Landeta Parra
GENERAL INTENDANT (S)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on the seventeenth of June of two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD