II. Consumer Compliance Examinations — SOURCE Violation Codes
Total Page:16
File Type:pdf, Size:1020Kb
II. Consumer Compliance Examinations — SOURCE Violation Codes Violation Code Description Consumer Compliance Examinations Violation Codes Advertisement of Membership ADV-MEM 328.2(a) The Federal Deposit Insurance Act (12 U.S.C. §§ 1818(a), 1819(a)(Tenth), and 1828(a)), as implemented by the Advertisement of Membership rule, 12 C.F.R. § 328.2(a), requires a financial institution to display the official sign continuously at each station or window where insured deposits are usually and normally received in the institution’s principal place of business and in all its branches, except as permitted in § 328.2(a)(1)(ii), (a)(2), and (a)(3). ADV-MEM 328.3(b)-(c) The Federal Deposit Insurance Act (12 U.S.C. §§ 1818(a), 1819(a)(Tenth), and 1828(a)), as implemented by the Advertisement of Membership rule, 12 C.F.R. § 328.3(b) and (c), requires a financial institution to use the official advertising statement, as defined in § 328.3(b), which shall be of such size and print to be clearly legible. The official advertising statement shall be used, in all advertisements that either promote deposit products and services or promote non-specific banking products and services offered by the institution, except as provided in § 328.3(d). ADV-MEM 328.3(e) The Federal Deposit Insurance Act (12 U.S.C. §§ 1818(a), 1819(a)(Tenth), and 1828(a)), as implemented by the Advertisement of Membership rule, 12 C.F.R. § 328.3(e), prohibits a financial institution from including the official advertising statement, or any other statement or symbol implying or suggesting the existence of Federal deposit insurance, in any advertisement relating solely to non-deposit products and hybrid products. In mixed advertisements, a financial institution must clearly segregate the official advertising statement as provided in § 328.3(e)(4). ADV-MEM 328.4 The Federal Deposit Insurance Act (12 U.S.C. §§ 1818(a), 1819(a)(Tenth), and 1828(a)), as implemented by the Advertisement of Membership rule, 12 C.F.R. § 328.4, prohibits a financial institution from receiving deposits at any teller station or window where a noninsured institution receives deposits or similar liabilities, except for deposits received at a Remote Service Facility. Branch Closing BR-CLOSING 42(No Subsection) Section 42 of the Federal Deposit Insurance Act of 1950 (12 U.S.C. § 1831r-1) requires that all insured depository institutions adopt written policies for branch closings. Financial institutions are also required to give notice to the appropriate federal agency and customers no later than 90 days before they close a branch. The notice provided to the appropriate Federal banking agency must include a detailed statement of the reasons for the decision to close the branch and statistical or other information in support of such reasons. The notice provided to customers must be included in a regular account statement or a separate mailing, and in the case of an interstate bank that proposes to close a branch in a low- or moderate-income area, the notice must include the mailing address of the FDIC and a statement that comments on the FDIC Consumer Compliance Examination Manual — April 2021 II-14.1 II. Consumer Compliance Examinations — SOURCE Violation Codes Violation Code Description proposed closing may be mailed to the FDIC. Further, this section requires institutions to post a notice in a conspicuous manner on the premises of the branch proposed to be closed not less than 30 days before the proposed closing. Children's Online Privacy Protection COPPA 312.4(a) The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.4(a), requires an operator to provide a notice and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children. The notice must be clearly and understandably written, complete, and must not contain unrelated, confusing, or contradictory materials. COPPA 312.4(b)-(d) The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.4(b) through (d), requires an operator: to make reasonable efforts to ensure that a parent of a child receives direct notice of the practices with regard to the collection, use, or disclosure of personal information from children, including notice of any material change in the collection, use, or disclosure practices to which the parent has previously consented as provided in § 312.4(b); to provide a direct notice to the parent that meets the content requirements of § 312.4(c); and to post a prominent and clearly labeled link to an online notice of its information practices with regard to children, on the home or landing page or screen of its Web site or online service, and at each area of the Web site or online service where personal information is collected from children as prescribed by § 312.4(d). As set out in § 312.3, actual knowledge of a violation of this provision is considered an unfair and deceptive act or practice under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45(a)). COPPA 312.5 The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.5, requires an operator to obtain verifiable parental consent, as prescribed by § 312.5(b), before any collection, use, or disclosure of personal information from children, and give the parent the option to consent to the collection and use of the child’s personal information without consenting to disclosure of his or her personal information to third parties. As set out in § 312.3, actual knowledge of a violation of this provision is considered an unfair and deceptive act or practice under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45(a)). COPPA 312.6 The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.6, requires an operator to provide, upon request of a parent whose child has provided personal information to a Web site or online service, a description of specific types or categories of personal information collected; the opportunity, at any time, to refuse to permit the operator’s further use or future online collection of information from that child and to direct the operator to delete the child’s information; and a means of reviewing any personal information collected II-14.2 FDIC Consumer Compliance Examination Manual — April 2021 II. Consumer Compliance Examinations — SOURCE Violation Codes Violation Code Description from the child that is not unduly burdensome to the parent. The means employed by the operator must ensure that the requester is a parent of the child, taking into account available technology. As set out in § 312.3, actual knowledge of a violation of this provision is considered an unfair and deceptive act or practice under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45(a)). COPPA 312.7 The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.7, prohibits an operator from conditioning a child’s participation in a game, the offering of a prize, or another activity on the child’s disclosing more personal information than is reasonably necessary to participate in such activity. As set out in § 312.3, actual knowledge of a violation of this provision is considered an unfair and deceptive act or practice under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45(a)). COPPA 312.8 The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.8, requires an operator to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. In addition, the operator must take reasonable steps to release children’s personal information only to service providers and third parties who are capable of maintaining the confidentiality, security, and integrity of such information, and who provide assurances that they will maintain the information in such a manner. As set out in § 312.3, actual knowledge of a violation of this provision is considered an unfair and deceptive act or practice under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45(a)). COPPA 312.10 The Children’s Online Privacy Protection Act of 1998 (15 U.S.C. § 6501 et seq.), as implemented by the Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.10, requires an operator to retain personal information collected online from a child for only as long as is reasonably necessary to fulfill the purpose for which the information was collected, and to delete such information using reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion. Community Reinvestment Act CRA 345.41 The Community Reinvestment Act (12 U.S.C. § 2901 et seq.), as implemented by the FDIC Rules and Regulations, 12 C.F.R. § 345.41, requires a financial institution to delineate one or more assessment areas within which the FDIC evaluates the bank's record of helping to meet the credit needs of its community, in accordance with the requirements of § 345.41(a) through (g), as applicable.