[Federal Register Volume 63, Number 229 (Monday, November 30, 1998)]
[Rules and Regulations]
[Pages 65673-65683]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-31746]


-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Parts 545, 555, and 559

[No. 98-119]
RIN 1550-AB00


Electronic Operations

AGENCY: Office of Thrift Supervision, Treasury.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Office of Thrift Supervision (OTS) is issuing a final rule 
that streamlines and updates its regulations relating to electronic 
operations. Under this rule, Federal savings associations may engage in 
prudent innovation through the use of emerging technology. The rule 
permits Federal savings associations to use, or participate with others 
to use, electronic means or facilities to perform any function, or 
provide any product or service, as part of an authorized activity. The 
rule also requires each savings association (state- or federally-
chartered) to notify OTS 30 days before it establishes a transactional 
web site. Savings associations that present supervisory or compliance 
concerns may be subject to additional procedural requirements. Finally, 
the rule includes a conforming change to OTS's service corporation 
regulation, reflecting a recent statutory change.

EFFECTIVE DATE: January 1, 1999.

FOR FURTHER INFORMATION CONTACT: Richard Bennett, Counsel (Banking and 
Finance), (202) 906-7409; Karen A. Osterloh, Assistant Chief Counsel, 
(202) 906-6639; Paul D. Glenn, Special Counsel, Chief Counsel's Office, 
(202) 906-6203; Paul J. Robin, Program Analyst, Compliance Policy, 
(202) 906-6648; or Paul R. Reymann, Senior Policy Analyst, Supervision 
Policy, (202) 906-5645, Office of Thrift Supervision, 1700 G Street 
NW., Washington, DC 20552.

SUPPLEMENTARY INFORMATION:

I. Background

A. Advance Notice of Proposed Rulemaking

    On April 2, 1997, OTS published an advance notice of proposed 
rulemaking (ANPR) seeking comment on all aspects of banking affected by 
electronic operations.1 The ANPR was designed to elicit 
information to enhance OTS's understanding of new electronic banking 
technologies and the impact of these technologies on the regulation of 
Federal savings associations.2 The ANPR asked a series of 
questions concerning the types of restrictions or requirements OTS 
should impose on electronic operations, including Internet banking.
---------------------------------------------------------------------------

    \1\ 62 FR 15626 (April 2, 1997).
    \2\ See 62 FR at 15631 and 15633.
---------------------------------------------------------------------------

B. Notice of Proposed Rulemaking

    Based on the comments received on the ANPR, on October 3, 1997, OTS 
published a notice of proposed rulemaking (NPR) to streamline and 
update its regulations relating to electronic operations.3 
The NPR proposed to amend OTS's electronic-related regulations to 
address advances in technology and to permit prudent innovation through 
the use of emerging technology by Federal savings associations. In 
crafting the proposed rule, OTS was guided by two broad principles 
suggested by commenters on the ANPR:
---------------------------------------------------------------------------

    \3\ 62 FR 51817 (October 3, 1997). The NPR contains a summary of 
the comments received on the ANPR.
---------------------------------------------------------------------------

     The public and insured depository institutions will be 
best served if statutory and regulatory restrictions are kept to a 
minimum. The premature imposition of restrictive operational standards 
could impede the development of improved financial services.
     Federal savings associations should be permitted to 
compete effectively with other regulated financial institutions and 
unregulated firms offering financial and related services.
    Consistent with these principles, OTS proposed a broad enabling 
regulation designed to allow Federal savings associations to engage in 
any activity through electronic means that they may conduct through 
more traditional delivery mechanisms. OTS proposed to eliminate three 
existing regulations: Sec. 545.138 (Data-Processing Services), 
Sec. 545.141 (Remote Services Units), and Sec. 545.142 (Home Banking 
Services). The elimination of these sections would not take away the 
authority to engage in any activities described in these sections.
    OTS made the proposal to enhance the ability of Federal savings 
associations to serve as financial intermediaries and to permit Federal 
savings associations to utilize fully their capacities and by-products 
generated in providing financial services. The proposal was consistent 
with the principles established in the Administration's electronic 
commerce policy statement.4 The NPR noted, however, that OTS 
would continue to gain additional experience with electronic technology 
and might issue more specific guidance regulating particular elements 
of electronic operations.5
---------------------------------------------------------------------------

    \4\ See ``Framework for Global Electronic Commerce'' (July 1, 
1997).
    \5\ 62 FR at 51820.
---------------------------------------------------------------------------

C. Comments on NPR--General Discussion

    The comment period on the NPR closed on December 2, 1997. OTS 
received nine comment letters on the NPR from five Federal savings 
associations, two trade associations, and two technology firms.
    All of the commenters recognized the need for the agency to revise 
or remove its existing regulations in this area. Seven commenters 
supported the proposal's overall flexible regulatory approach, while 
suggesting modifications or clarifications to particular aspects of the 
rule. Two commenters argued that for even greater flexibility the 
agency should not issue any new electronic banking regulations. These 
two commenters suggested the agency rely entirely on flexible 
guidelines and advisories as technology evolves. OTS has addressed 
specific comments on the NPR below.

D. Supplemental Notice of Proposed Rulemaking

    One commenter on the NPR argued that OTS should establish a 
procedure to review and approve new products or services, in order to 
protect the safety and soundness of the industry. Another urged OTS not 
to require a Federal savings association to obtain OTS's prior approval 
before adopting new technologies ``unless absolutely necessary to 
ensure industry-wide safety and soundness.'' After considering these 
comments, OTS concluded that safety and soundness and compliance 
considerations warranted the agency receiving advance notice of 
industry use of one developing technology--transactional web sites. 
Such web sites allow savings association customers to use the Internet 
to conduct a wide variety of financial transactions. They may, however, 
also pose particular security, compliance, and privacy risks.
    Accordingly, on August 13, 1998, OTS issued a supplemental notice 
of proposed rulemaking (Supplemental NPR) seeking comment on additional 
proposed rules that would require each savings association to notify 
OTS before

[[Page 65674]]

it establishes a transactional web site.6 OTS also proposed 
to give the Regional Offices discretion to impose additional 
requirements in appropriate circumstances.
---------------------------------------------------------------------------

    \6\ 63 FR 43327 (August 13, 1998).
---------------------------------------------------------------------------

    Safety and soundness and compliance considerations are similar for 
state-chartered and federally-chartered institutions. Thus, the 
Supplemental NPR proposed to require every savings association to 
notify OTS before it established a transactional web site and to comply 
with additional requirements that the Regional Offices may impose in 
appropriate circumstances. Since the ANPR and NPR did not specifically 
discuss these requirements and applied only to Federal savings 
associations, OTS concluded that additional public comment would assist 
in the development of a final rule.

E. Comments on Supplemental NPR--General Discussion

    The comment period on the Supplemental NPR closed on September 14, 
1998. OTS received nine comment letters from six Federal savings 
associations, two trade associations, and one public interest 
organization.
    Two commenters supported the notice requirement. Four commenters 
opposed the requirement. The other three commenters did not 
specifically support or oppose the requirement. OTS has addressed the 
specific comments on the Supplemental NPR below.

II. Today's Final Rule

    Today's final rule incorporates the same broad principles and 
reflects the same supervisory concerns articulated in the NPR and 
Supplemental NPR. OTS continues to believe that it is important to have 
enabling regulations in this area. These regulations will help ensure 
that OTS has sufficient information to understand developing 
technologies, to provide appropriate guidance on these technologies, 
and to supervise electronic operations effectively. The proposed 
approach in the NPR and Supplemental NPR, with some modifications as 
discussed below, will provide both the industry and the agency with the 
appropriate amount of flexibility to adapt to changing conditions.
    Today's final rule is meant to provide authority for Federal 
savings associations' electronic operations and a structure for all 
savings associations' use of electronic means and 
facilities.7 Standing alone, it cannot, and does not purport 
to, answer all questions in this rapidly changing area. These 
operations, by their very nature, are evolving, presenting the industry 
and the agency with both old issues in a new form (e.g., the 
appropriate documentation to open an account) and new issues unique to 
electronic operations (e.g., treatment of stored value cards). The 
agency has issued, and will continue to issue, guidance as electronic 
operations evolve. This guidance has taken the form of letters to chief 
executive officers of savings associations, interagency examiner 
guidelines, revisions to the Thrift Activities Handbooks, conditions on 
the approval of applications, and responses to requests for legal 
interpretations.8 The agency expects to continually update 
its guidance and to continue to make it available on OTS's web site at 
www.ots.treas.gov.
---------------------------------------------------------------------------

    \7\ New Sec. 555.200 is similar to the Office of the Comptroller 
of the Currency's (OCC) rule on furnishing of products and services 
by electronic means and facilities. See 12 CFR 7.1019 (1998).
    \8\ See, e.g., Memorandum from Richard M. Riccobono, Deputy 
Director, for Chief Executive Officers (November 3, 1998) (Policy 
Statement on Privacy and Accuracy of Personal Customer Information); 
Memorandum from Richard M. Riccobono, Deputy Director, for Chief 
Executive Officers (July 23, 1998) (Interagency Guidance on 
Electronic Financial Services and Consumer Compliance); Memorandum 
from John Downey, Executive Director, Supervision, for Chief 
Executive Officers (June 23, 1997) (Statement on Retail On-Line 
Personal Computer Banking); Thrift Activities Regulatory Handbook, 
Section 341, Information Technology (October 1997) (Regulatory 
Bulletin 32-6, October 15, 1997); Federal Financial Institutions 
Examinations Council (FFIEC) Information Systems Examination 
Handbook (1996); OTS Order No. 95-88 (May 8, 1995) (application 
approval of Internet bank); OTS Op. Chief Counsel (September 19, 
1997) (establishment of automated loan machines).
---------------------------------------------------------------------------

    Further, while today's final rule removes Secs. 545.138, 545.141, 
and 545.142, OTS emphasizes that the new rules continue to authorize 
all activities formerly authorized under these provisions.

III. Section-by-Section Discussion

    Today's final rule creates a new part 555 to address electronic 
operations. In the NPR, OTS originally proposed to place the electronic 
operations regulations in a new subpart B to part 545. However, part 
545 only applies to Federal savings associations. The notice 
requirements proposed in the Supplemental NPR and incorporated into 
this final rule, however, apply to all savings associations. Thus, as 
proposed in the Supplemental NPR, OTS is placing the electronic 
operations regulations in a new part 555.

A. What Does This Part Do? (Sec. 555.100)

    Section 555.100 explains the purpose of part 555. Subpart A 
explains how a Federal savings association may provide products and 
services through electronic means and facilities. Subpart B contains 
the advance notice and other requirements applicable to all savings 
associations.
    OTS received no specific comments on Sec. 555.100 of the 
Supplemental NPR (or on Sec. 545.140 of the NPR, which served a similar 
function). The section is unchanged from the Supplemental NPR.

B. Authority of Federal Savings Associations to Conduct Electronic 
Operations (Subpart A to Part 555)

1. How May I Use or Participate With Others to use Electronic Means and 
Facilities? (Proposed Sec. Sec. 545.141, 545.142, and 545.143, Final 
Sec. 555.200)
    Final Sec. 555.200 combines, with changes, proposed Sec. 545.141, 
545.142, and 545.143. Section 555.200(a) corresponds to proposed 
Sec. 545.141, but merges part of proposed Sec. 545.143. Section 
555.200(b) corresponds to proposed Sec. 545.142 and also merges part of 
proposed Sec. 545.143. Sections 555.200(a) and 555.200(b) are discussed 
separately below.
Section 555.200(a)
    Consistent with OTS's goal of minimizing regulatory restrictions on 
electronic operations, proposed Sec. 545.141 would have specifically 
permitted Federal savings associations to use electronic means or 
facilities to perform any authorized function or provide any authorized 
product or service. Electronic means or facilities would include, but 
would not be limited to, automated teller machines (ATMs), automated 
loan machines, personal computers, the Internet, the World Wide Web, 
telephones, and other similar electronic devices. The preamble 
explained that this authority would include the opening of savings or 
demand accounts and the establishment of loan accounts--functions 
previously excluded from the definition of remote service unit--because 
performing these functions electronically may enhance the operating 
flexibility of Federal savings associations.
    Commenters generally supported this section. One commenter, 
however, a trade association, argued that proposed Sec. 545.141 was too 
broad and did not sufficiently protect the safety and soundness of the 
industry. Instead, the commenter emphasized the need for a thorough 
risk assessment of any new delivery system to protect safety and 
soundness. The commenter urged OTS to establish a procedure whereby OTS 
would issue an approval or interpretation before a product or service 
was first offered electronically. Once one institution was approved to 
use an electronic delivery system,

[[Page 65675]]

approval for subsequent institutions would not be required. Presumably, 
subsequent institutions would be required to provide the same 
protections and safeguards.
    While OTS does not believe that a new procedure is necessary for 
most types of electronic operations, OTS has added subpart B to part 
555, to deal with the special risks associated with transactional web 
sites. As discussed in Section III.C. below, subpart B will enhance 
OTS's ability to supervise electronic operations, particularly Internet 
banking activities.
    Three Federal savings associations asked OTS to clarify whether the 
new regulation would permit specific products or services. As noted in 
the preamble to the proposed rule, by revising its rules, OTS intends 
to allow Federal savings associations to engage in any authorized 
activity through electronic means that they may conduct through more 
traditional delivery mechanisms.9 To clarify this point, OTS 
has revised the language of Sec. 555.200(a) to provide that a Federal 
savings association may use electronic means or facilities ``to perform 
any function, or provide any product or service, as part of an 
authorized activity.''
---------------------------------------------------------------------------

    \9\ 62 FR at 51818.
---------------------------------------------------------------------------

    As with all activities of Federal savings associations, OTS's 
position, like that of its predecessor agency, the Federal Home Loan 
Bank Board (FHLBB), has been that if the Home Owners' Loan Act (HOLA) 
10 authorizes an activity, a specific authorizing regulation 
is not necessary.11 In some cases, the HOLA speaks clearly 
on an activity and institutions generally choose to act without 
obtaining agency concurrence. In other cases, where the authority is 
less clear or specific facts are more determinative, an application or 
an interpretive legal opinion may be the best route for resolving 
issues of first impression.
---------------------------------------------------------------------------

    \10\ 12 U.S.C. 1461-1468c.
    \11\ See, e.g., 60 FR 44442, 44444 (August 28, 1995); 48 FR 
23032 (May 23, 1983).
---------------------------------------------------------------------------

    To assist the industry further, OTS will continue to provide both 
formal and informal guidance on authorized activities for Federal 
savings associations. If applicable statutes, regulations, court cases, 
and OTS opinions do not provide a sufficient basis for a Federal 
savings association to determine whether a product or service is 
authorized under the HOLA or the use of electronic means or facilities 
is appropriate, it may request an interpretive opinion 12 or 
consult with OTS's Regional Director for the Region in which its home 
office is located.
---------------------------------------------------------------------------

    \12\ See OTS Customer Service Plan--Interpretive Opinions 
(January 1996). Such questions may also be addressed in the context 
of an application process (e.g., de novo applications).
---------------------------------------------------------------------------

    OTS has previously provided explicit guidance on several of the 
questions about specific products or services raised. For example, the 
preamble to the proposed rule stated that Federal savings associations 
could establish loan accounts and open savings or demand accounts 
through electronic means.13 Similarly, the ANPR indicated 
that the term ``electronic means and facilities'' would clearly 
encompass new technologies that enable a depository institution to make 
risk-based judgments electronically.14 This would include, 
for example, automated credit scoring and other forms of automated 
underwriting.
---------------------------------------------------------------------------

    \13\ 62 FR at 51818. However, all statutory and regulatory 
restrictions associated with offering a product or service continue 
to apply where electronic means and facilities are used.
    One commenter asked whether a signed deposit application would 
have to be executed and transmitted with the initial deposit in hard 
copy. At one time, FHLBB regulations specifically imposed this type 
of signature card requirement. See 12 CFR 545.2(a) (1983). In May 
1983, the FHLBB eliminated this specific requirement. 48 FR 23032 
(May 23, 1983).
    \14\ 62 FR at 15632.
---------------------------------------------------------------------------

    In addition, OTS and the FHLBB have long recognized that Federal 
savings associations may open accounts and transfer funds for persons 
overseas. For example, the FHLBB opined that Federal savings 
associations may solicit deposits and open accounts for individuals who 
are not citizens or residents of the United States by mail or 
electronic means.15 Since this is an authorized activity 
under the HOLA, this final rule permits a Federal savings association 
to engage in this activity through electronic operations. However, 
Federal savings associations engaging in such electronic activities 
must comply with all applicable requirements, including addressing 
safety and soundness concerns and ensuring compliance with other 
federal laws and requirements.16
---------------------------------------------------------------------------

    \15\ See Memorandum from Jack D. Smith, Deputy General Counsel, 
FHLBB, to Alvin Smuzynski, Deputy Director, Supervisory Activities 
(December 7, 1987). Pursuant to that opinion, the institution was 
permitted to undertake the activity where the institution maintained 
the deposits in United States dollar denominations, offered standard 
money market and term certificate of accounts with interest rates 
and other terms and conditions that were the same as those offered 
by the institution to those residing in the United States, and 
complied with the requirements applicable to the type of accounts. 
See also FHLBB Op. General Counsel (May 10, 1984).
    \16\ OTS anticipates that it will shortly publish a proposed 
``Know Your Customer'' rule, as part of an interagency rulemaking 
effort.
---------------------------------------------------------------------------

    OTS has not opined on whether certain activities cited by 
commenters are authorized for Federal savings associations. 
Specifically, one commenter asked whether a Federal savings association 
may issue, use, and deal in all forms of electronic monetary value, 
including stored value and smart-card technologies. Another commenter 
asked whether a Federal savings association may use and participate in 
digital authentication and certification, including serving as a 
certificate authority (an entity certifying electronic signatures for 
use in electronic commerce).
    OTS has not opined on whether every activity that could involve the 
use of electronic money or participation in digital authentication 
regimes is an authorized activity for Federal savings 
associations.17 With any new activity, the factual context 
and the accompanying safeguards are often critical to determining 
whether and how an activity may be conducted, whether or not electronic 
means are involved. Thus, OTS believes that it is important that 
savings associations continue to consult with their Regional Offices to 
obtain up-to-date guidance as they move forward in the use of 
electronic means and facilities.
---------------------------------------------------------------------------

    \17\ With regard to electronic monetary value, OTS has opined 
that a Federal savings association has authority to market and sell 
prepaid telephone cards as agent for a telephone company. OTS Op. 
Chief Counsel (August 29, 1996). We also note that the other federal 
banking agencies have indicated that financial institutions may deal 
in other types of electronic monetary value. See OCC Interpretive 
Letter No. 718 (March 14, 1996) (national banks may dispense 
alternate media such as public transportation tickets, event and 
attraction tickets, gift certificates, prepaid phone cards, 
promotional and advertising materials, electronic benefits transfer 
scripts, and credit and debit cards) and Federal Deposit Insurance 
Corporation General Counsel's Op. No. 8, published in, 61 FR 40490 
(Aug. 2, 1996) (discussing whether, and under what circumstances, 
funds underlying stored value cards may be considered deposits under 
the Federal Deposit Insurance Act, 12 U.S.C. 1811-1835a).
    With regard to digital authentication and certification, Federal 
savings associations have incidental authority under the HOLA to 
guarantee customer signatures for documentary transactions in which 
an association has an interest as part of its deposit taking, 
lending, or trust business, as well as guarantees executed as a 
separate customer service with respect to stock transfers and 
similar transactions in which the association has no direct 
interest. FHLBB Op. General Counsel (August 11, 1981). In addition, 
the OCC has authorized a national bank operating subsidiary to act 
as a certification authority and repository for certificates that 
verify digital signatures. The authority was not limited to 
transactions in which the subsidiary had a direct interest. OCC Op. 
Chief Counsel (January 12, 1998) (Operating Subsidiary Application 
by Zions First National Bank, Salt Lake City, Utah).
    OTS believes the reasoning of the other regulators appears 
persuasive. OTS will consider these opinions when it reviews a 
Federal savings association's authority to conduct such activities 
as these issues are presented to the agency.
---------------------------------------------------------------------------

    Another Federal savings association asked OTS to adopt an expansive

[[Page 65676]]

interpretation of the phrase ``authorized product or service.'' The 
commenter's proposed interpretation would clarify that as long as the 
primary electronic product or activity is permitted, the Federal 
savings association may provide a minor ancillary application, even 
though the ancillary application is not specifically authorized by the 
HOLA. Federal savings associations possess powers that are incident to 
the express powers of Federal savings associations, as set forth in the 
HOLA.18 Today's final rule allows Federal savings 
associations to use electronic means or facilities to perform any 
function, or provide any product or service, as part of an authorized 
activity, including activities authorized under the incidental powers 
doctrine. OTS will review whether particular activities are authorized 
as incidental powers on a case-by-case basis as these issues are 
presented to the agency.
---------------------------------------------------------------------------

    \18\ See OTS Op. Chief Counsel (August 29, 1996) at 2.
---------------------------------------------------------------------------

    As noted above, Sec. 555.200(a) continues to permit Federal savings 
associations to perform all data processing and transmission services 
formerly authorized under Sec. 545.138(a) and (b). When Sec. 545.138 
was promulgated in 1983, the FHLBB imposed certain data and customer 
restrictions designed to ensure that a Federal savings association 
would conduct data processing and transmission services consistent with 
the authority provided in HOLA.19 OTS recognizes that the 
HOLA may authorize the provision of data processing services in 
additional circumstances. Accordingly, the final rule, like the OCC's 
rule, does not impose specific data or customer restrictions. Rather, 
final Sec. 555.200(a) merely requires that services provided through 
electronic means and facilities must be a ``part of an authorized 
activity.'' This restriction means that data processing and 
transmission services provided must be authorized under the HOLA, 
either expressly or as an incidental power.
---------------------------------------------------------------------------

    \19\ See 48 FR 7428, 7429-7430 (February 22, 1983).
---------------------------------------------------------------------------

    Final Sec. 555.200(a) has also been revised to incorporate 
provisions in proposed Sec. 545.143, entitled ``How may I participate 
with others in the use of electronic means and facilities?'' Proposed 
Sec. 545.143 would have permitted a Federal savings association to 
participate with others to perform, provide, or deliver activities, 
functions, products, or services described in the proposed rule. A 
Federal savings association could have participated with an entity that 
is not subject to examination by a Federal agency regulating financial 
institutions only if that entity agreed, in writing, to permit OTS to 
examine its electronic means or facilities, to pay for any related OTS 
examination fees, and to make all relevant records in its possession, 
written or electronic, available to OTS for examination. OTS also 
indicated that if the participation by a Federal savings association 
was through a service corporation, OTS's service corporation rules 
would apply.20
---------------------------------------------------------------------------

    \20\ See 12 CFR 559.4 (1998).
---------------------------------------------------------------------------

    The Examination Parity and Year 2000 Readiness for Financial 
Institutions Act,21 has obviated the need for proposed 
Sec. 545.143 as a separate section of the rule. Section 3 of this 
legislation provides:
---------------------------------------------------------------------------

    \21\ Pub. L. No. 105-164 (enacted March 20, 1998).

    [I]f a savings association, a subsidiary thereof, or any savings 
and loan affiliate or entity, as identified by section 8(b)(9) of 
the Federal Deposit Insurance Act [12 U.S.C. 1818(b)(9)], that is 
regularly examined or subject to examination by the Director [of 
OTS], causes to be performed for itself, by contract or otherwise, 
any service authorized under [HOLA] * * *, such performance shall be 
subject to regulation and examination by the Director to the same 
extent as if such services were being performed by the savings 
---------------------------------------------------------------------------
association on its own premises.

    In light of this legislation, today's final rule simply clarifies 
the authority of a Federal savings association to participate with 
others to perform any function, or provide any product or service, as 
part of an authorized activity, through electronic means and 
facilities. This language has been merged into final Sec. 555.200(a). 
OTS is making a similar conforming change to Sec. 555.200(b), discussed 
below.
    In making these changes, OTS is removing the proposed requirement 
concerning record availability since this requirement is implicit in 
examinations authorized by the legislation. OTS is also removing the 
proposed requirement concerning examination fees. The other banking 
agencies do not charge fees specifically for examinations of service 
providers. OTS does not intend to impose fees for the examination of 
service providers, except as otherwise provided for under OTS's 
assessment rule and Thrift Bulletins.
    While the relevance of many of the comments on proposed 
Sec. 545.143 has been negated by this intervening legislation, it is 
useful to respond to some of the points raised by commenters on the 
NPR. Two commenters criticized the third party examination, fee, and 
record requirements as burdensome and unnecessary. In implementing the 
new legislation, OTS will focus its service provider examinations on 
those whose activities could have a direct impact on the safety and 
soundness of savings associations.\22\ Data processing servicers and 
ATM servicers are among the types of service providers OTS examines 
because they provide functions critical to financial operations.
---------------------------------------------------------------------------

    \22\ See Statement of Ellen Seidman, Director, Office of Thrift 
Supervision, concerning Examination Parity and Year 2000 Readiness 
for Financial Institutions Act, before the Committee on Banking and 
Financial Services, United States House of Representatives, February 
5, 1998, at 8-10.
---------------------------------------------------------------------------

    Another Federal savings association explained that the software 
industry is wary of providing unrestricted access to their information 
without explicit assurances of confidentiality to protect proprietary 
trade secrets. The commenter stated that, at a minimum, the final rule 
should provide that any information reviewed or gathered during an 
examination of a service provider will be treated as ``unpublished OTS 
information'' under 12 CFR 510.5 (1998), which provides confidentiality 
safeguards.
    OTS treats service provider examination reports as confidential 
unpublished OTS information.\23\ Consistent with this regulation, these 
reports are not publicly available, but OTS does share the examination 
reports of service providers with the Federal banking agencies. It also 
shares relevant portions of the examination reports with Federal and 
State savings associations that use the services of those service 
providers.
---------------------------------------------------------------------------

    \23\ See 12 CFR 510.5(a)(2)(ii) (1998).
---------------------------------------------------------------------------

Section 555.200(b)
    Former Sec. 545.138(c) subjected marketing by-products and excess 
capacity of data processing and transmission services to significant 
restrictions. In contrast, under proposed Sec. 545.142, a Federal 
savings association could market and sell electronic capacities and by-
products to third parties if it acquired or developed the capacities 
and by-products in good faith as part of providing financial services. 
The proposed rule was substantially identical to the OCC rule on 
marketing and selling such capacities.\24\
---------------------------------------------------------------------------

    \24\ See 12 CFR 7.1019 (1998).
---------------------------------------------------------------------------

    Two commenters expressly supported the proposed section. Upon 
further review, OTS believes it is necessary to make two minor 
clarifications to Sec. 555.200(b).
    First, the final rule indicates that the marketing and selling of 
electronic capacities and by-products to third-parties is to enable 
Federal savings

[[Page 65677]]

associations to optimize their resources. This language conforms the 
OTS rule more closely to the OCC's rule.
    Second, the final rule indicates that a Federal savings association 
may also participate with others to market and sell electronic 
capacities and by-products to third-parties. Like the revision to 
Sec. 555.200(a) discussed above, this change incorporates part of 
Sec. 555.143 of the proposed rule.
    One Federal savings association asked OTS to define the phrase 
``electronic capacities and by-products'' to clarify that Federal 
savings associations may provide ``fully integrated solutions to a 
range of business needs.'' These solutions may involve a combination of 
software development, computer systems design and construction, 
electronic communication (including sending electronic mail), and data 
processing and storage.
    OTS does not believe it is appropriate to make the clarification 
requested by the commenter. As long as a Federal savings association 
acquired or developed its electronic capacities and by-products in good 
faith as part of providing financial services, the Federal savings 
association may market and sell them to third-parties. OTS cautions, 
however, that to the extent a Federal savings association may wish to 
engage in additional activities in connection with the marketing and 
sale of such capacities and by-products, the additional activities must 
be authorized under the HOLA, either expressly or as an incidental 
power.
2. What Precautions Must I Take? (Proposed Sec. 545.144, Final 
Sec. 555.210)
    Although OTS believes that it is vital that Federal savings 
associations establish appropriate internal controls for risks and 
security measures when they engage in electronic operations, it did not 
propose to codify static risk or security requirements. Because methods 
of electronic commerce and their attendant security measures are 
continually evolving, OTS's proposed rule reflected the view that it is 
impracticable to prescribe security measures that would remain useful 
for the indefinite future.
    Instead, proposed Sec. 545.144 would have required a Federal 
savings association to adopt standards and policies designed to ensure 
secure operations. In addition, the proposed rule would have required a 
Federal savings association to implement security measures adequate to 
prevent unauthorized access to its records and its customers' records, 
and to prevent financial fraud through the use of electronic means or 
facilities. The proposed rule also stated that a Federal savings 
association must comply with the current security devices requirements 
of part 568, if it provides an ATM, an automated loan machine, or 
another similar electronic device.
    One Federal savings association noted that the banking industry has 
not yet embraced any particular standards with respect to encryption, 
authentication, digital signatures, and other technical matters 
affecting transmission over the Internet. Accordingly, the commenter 
urged OTS to avoid imposing unnecessary regulatory impediments or 
micro-managing system implementation or maintenance. While the 
commenter was not critical of proposed Sec. 545.144, the commenter 
criticized OTS's imposition of certain security-related conditions on 
approvals of recent applications, such as requiring an applicant to 
have its delivery of services over the Internet tested and reviewed by 
independent computer security specialists before commencing operation. 
The commenter urged OTS to reconsider whether there is a need to impose 
such conditions.
    In approving applications to commence operations, OTS requires 
proof that adequate security measures are in place for safe, sound, and 
secure operations. To date, these requirements routinely have included 
testing and review by independent computer security specialists. OTS 
tailors specific conditions on a case-by-case basis. It may be possible 
that future applications may not raise these security concerns. 
However, currently OTS believes such a condition in application 
approval orders remains essential to safe and sound internal 
operations. Similarly, under the notice procedures in subpart B to part 
555 of this final rule (including the 30-day advance notice 
requirement), OTS will have an opportunity to consider, before any 
savings association establishes a transactional web site, whether the 
savings association will be able to conduct such operations in a safe, 
sound, secure, and compliant manner.
    In the preamble to the proposed rule, OTS indicated that it 
``expects Federal savings associations to establish security measures 
that are consistent with current industry standards, and to continually 
monitor and regularly update these security procedures to keep pace 
with changes to industry standards.'' 25 One trade 
association urged OTS to incorporate this statement in the final rule.
---------------------------------------------------------------------------

    \25\ 62 FR at 51819.
---------------------------------------------------------------------------

    OTS believes that such interpretive statements are best contained 
in OTS policy statements, advisories, and other explanatory materials, 
rather than the regulation. For similar reasons, OTS has deleted from 
the final rule the proposed statement indicating that Federal savings 
associations should adopt standards and policies on security issues. 
Instead, the rule requires Federal savings associations to implement 
security measures designed to ensure secure operations.
    Another trade association urged OTS to provide guidelines alerting 
Federal savings associations to security issues that should be 
addressed before a new electronic delivery mechanism is implemented. As 
summarized in Section II above, OTS has issued such guidelines and 
advisories to Federal savings associations, both on its own and as part 
of FFIEC.
    OTS has made clarifying revisions to the section. These revisions 
require that the management of Federal savings associations identify, 
assess, and mitigate potential risks and establish prudent internal 
controls, in addition to implementing security measures that are 
designed to ensure secure operations.26 These risks may be 
strategic, legal, regulatory, or operational.27
---------------------------------------------------------------------------

    \26\ Further guidance on these requirements is provided in 
Appendix A to Part 570, section 341 of the Thrift Activities 
Regulatory Handbook, and Statement on Retail On-Line Personal 
Computer Banking.
    \27\ See Statement on Retail On-Line Personal Computer Banking.
---------------------------------------------------------------------------

C. Requirements Applicable to All Savings Associations

1. Must I Inform OTS Before I Use Electronic Means or Facilities? 
(Sec. 555.300)
    Proposed Sec. 555.300(a) of the Supplemental NPR sets forth the 
general rule that a savings association does not have to inform OTS 
before it uses electronic means and facilities. However, two exceptions 
apply. First, proposed Sec. 555.300(b) would require a savings 
association to file a written notice with OTS before it establishes a 
transactional web site. Second, proposed Sec. 555.300(c) would provide 
that if the OTS Regional Office has informed a savings association of 
any supervisory or compliance concerns that may affect the savings 
association's use of electronic means or facilities, the savings 
association must follow any additional procedures the Regional Office 
has imposed in writing. Proposed Sec. 555.300(a) also would encourage 
savings associations to consult with OTS even in circumstances not 
covered by the notice requirement or other procedures in 
Sec. 555.300(b) or (c).

[[Page 65678]]

    Four commenters indicated that the proposed notice requirement 
would help OTS to monitor adequately savings associations' 
technological innovations and to assess security, compliance, and 
privacy risks. Some commenters, however, expressed concerns.
    Four commenters argued that the notice requirement would place 
savings associations at a competitive disadvantage, since other banking 
regulators do not impose a similar notice requirement. OTS does not 
anticipate that the notification requirement will place savings 
associations at a significant competitive disadvantage. As discussed 
below, in general, once an association has addressed any follow-up 
questions from the Regional Office and the 30-day period has expired, 
the association will be free to bring its transactional web site on-
line. No affirmative authorization from OTS is necessary except where 
the Regional Office may otherwise indicate.
    While providing this information will impose a minimal burden on 
savings associations, the process will allow individual associations, 
and the industry as a whole, to reap important benefits. The notice 
will make it easier for OTS to obtain information on the industry's use 
of transactional web sites. As a result, OTS will be better able to 
assist associations that are contemplating or already conducting 
Internet operations to identify and address the risks that accompany 
such activities. The information will also broaden OTS's awareness of 
trends in Internet banking operations, which OTS can share with 
institutions. It will also efficiently allow OTS to keep abreast of 
significant changes in the way particular savings associations interact 
with their existing or potential customers to enable OTS to issue 
appropriate guidance. Finally, the procedure responds to the concern 
raised by the commenter on the NPR who indicated that OTS should be 
vigilant about new electronic operations raising safety and soundness 
concerns, since the procedure will assist OTS to supervise effectively 
the electronic operations of savings associations.28
---------------------------------------------------------------------------

    \28\ A September 30, 1998 report prepared, at OTS's request, by 
the Office of Inspector General (OIG), United States Department of 
the Treasury, made several suggestions. Among these were that OTS: 
(1) develop a complete list of savings associations providing on-
line and Internet banking services; (2) enhance monitoring of 
savings associations' web sites for compliance with federal 
disclosure regulations and laws, and (3) begin to focus more on the 
operational risks presented by on-line and Internet banking. The OIG 
recommended these steps to help OTS determine risks, plan strategic 
examination coverage, identify staff development needs, and foster 
examination uniformity and consistency. See Office of Inspector 
General, U.S. Dep't of the Treasury, Consultative Report on the 
Office of Thrift Supervision Examination of On-Line and Internet 
Banking Risks, (OIG-CA-98-003, 1998).
---------------------------------------------------------------------------

    One commenter asserted that transactions conducted over the 
Internet pose no more risk than transactions performed using other 
technologies for which no prior notice is required. This commenter also 
asserted that the notice was unnecessary since the industry already 
fully understands the risks associated with the Internet.
    OTS does not agree that transactions conducted over the Internet 
pose no more risk than transactions performed through other more 
established technologies.29 While it is true that risks are 
inherent in all electronic capabilities, the use of an electronic 
channel such as the Internet to deliver products and services 
introduces unique risks due to the increased speed at which systems 
operate, user anonymity, and broad access in terms of geography, user 
groups, applications, databases, and peripheral systems.
---------------------------------------------------------------------------

    \29\ See 63 FR at 43328.
---------------------------------------------------------------------------

    As explained in the preamble to the Supplemental NPR, OTS has been, 
and continues to be, concerned with the adequacy of firewalls to 
prevent hackers from breaking into an association's computer systems 
and thereby jeopardizing the association's security.30 OTS 
is also concerned about other operational and compliance risks 
presented by Internet banking and intends to increase its monitoring of 
web sites for compliance with disclosure laws and 
regulations.31 Additionally, OTS is concerned about 
protecting the privacy of individuals submitting information (or about 
whom information has been submitted).32
---------------------------------------------------------------------------

    \30\ Id.
    \31\ As noted in the preamble to the Supplemental NPR, OTS is 
aware that advertising and disclosure problems may apply equally to 
transactional and informational web sites. OTS believes, however, 
that the need for advance notice is greater where such concerns are 
combined with the other compliance, security, and privacy issues 
related to transactional web sites. To minimize regulatory burden, 
OTS is limiting the advance notice requirement to transactional web 
sites. However, OTS will continue to examine both types of web sites 
for operational and compliance problems. See 63 FR at 43329 n. 11.
    \32\ 63 FR at 43328.
---------------------------------------------------------------------------

    Even traditional risks that are similar to those in customary 
banking activities must be considered in a new light. For example, if 
an association conducts lending or deposit gathering activities over an 
electronic channel, credit risks must be considered in the context of 
the high-speed, wide-access electronic environment. The collection of 
baseline information on transactional web sites is an important and 
integral part of OTS efforts to enhance its supervision of Internet 
banking activities.
    Another commenter noted that the costs of developing a web site are 
substantial and would be incurred before the savings association files 
the notice. Consistent with Sec. 555.300(a), OTS encourages 
associations concerned about expending resources to develop a 
transactional web site to consult with their Regional Office in the 
early stages of development, even before filing a notice.
    In lieu of the notice requirement, several commenters urged OTS to 
continue to rely on existing supervisory guidance, examination 
oversight, and application processes to ensure that Internet activities 
are conducted in a safe, sound, secure, and compliant manner. One 
commenter encouraged OTS to address transactional web sites in the 
Statement on Retail On-Line Personal Computer Banking and in additional 
questions in the Pre-Examination Response Kit. Another commenter 
suggested that the additional guidance should address such issues as 
development costs, security and privacy issues, and compliance matters.
    OTS has provided and will continue to provide important guidance to 
the industry. OTS has addressed development costs, security, privacy, 
and compliance matters in its Statement on Retail On-Line Personal 
Computer Banking and in section 341 of the Thrift Activities Regulatory 
Handbook. OTS will update and supplement this guidance as necessary. 
However, this guidance is not a substitute for OTS's obtaining 
information necessary for proper supervision.
    OTS proposed to define a transactional web site as ``an Internet 
site that enables users to conduct financial transactions such as 
accessing an account, obtaining an account balance, transferring funds, 
processing bill payments, opening an account, applying for or obtaining 
a loan, or purchasing other products or services.'' 33 Four 
commenters supported OTS's proposed definition. Two commenters 
indicated that the Supplemental NPR adequately distinguished between 
transactional and informational web sites.
---------------------------------------------------------------------------

    \33\ 63 FR at 43330 (proposed Sec. 555.300(b)).
---------------------------------------------------------------------------

    In light of the generally favorable comments, OTS does not believe 
significant changes to the definition are necessary. However, OTS is 
making one clarifying change to the definition of transactional web 
site in response to a comment. The commenter recommended clarifying the 
meaning of the phrase ``purchasing other products

[[Page 65679]]

or services'' used in the definition. The final rule clarifies that the 
phrase refers to any authorized products or services.
    Another commenter asked OTS whether a new notice would be required 
when the type and level of activities conducted on a transactional web 
site are increased or substantially modified. A new notice will not be 
required in such circumstances. Once the savings association alerts OTS 
about its transactional web site, the agency will be able to monitor 
and examine the web site without a need for subsequent notices when 
changes are made.34
---------------------------------------------------------------------------

    \34\ However, as noted in the preamble to the Supplemental NPR, 
before a savings association may change an informational web site to 
a transactional web site, the savings association must file a notice 
with OTS. 63 FR at 43329 n. 9.
---------------------------------------------------------------------------

    Other commenters, however, suggested further revisions or 
clarifications that OTS believes would be too limiting. One commenter 
indicated that the covered web sites should be those that transact 
business equivalent to a branch through which money passes. Another 
argued that a web site is not transactional if an applicant may only 
complete and return a loan application electronically, but would be 
transactional if the web site also permits the application to be 
processed through an automated credit scoring system and is used to 
notify the customer of an approval or denial.
    OTS does not agree that transactional web sites subject to the 
notice requirement should be limited to those that are used for 
monetary transactions or are used to notify the customer of an 
application approval or denial. The same concerns about providing a 
secure environment apply where confidential information is exchanged in 
other circumstances that are transactional, but do not necessarily 
constitute a monetary transaction or notification on an application.
    However, it is appropriate to clarify a related matter. OTS will 
not consider a web site to be transactional simply because it allows 
the sending of e-mail messages. For an association simply to include an 
e-mail address on its web site does not necessarily invite the public 
to attempt to conduct transactions with the association over the 
Internet or to submit confidential information. For example, the public 
may use the e-mail address for a variety of tasks (e.g., inquiring 
about products or services offered, requesting that a customer service 
representative call, or asking that forms or information be mailed). In 
contrast, a web site that provides an electronic application form for 
transmission to the association by e-mail would be considered 
transactional. Such an application, by its nature, is designed to 
conduct a transaction and will likely actively elicit the submission of 
confidential information to the association over the Internet through 
the questions contained in the application.
    One commenter recommended that OTS define an ``informational web 
site.'' OTS does not believe that a separate definition of this term is 
necessary. As noted in the preamble to the Supplemental NPR, an 
informational web site is a non-transactional web site, such as one 
limited to advertising and fee and rate posting.35
---------------------------------------------------------------------------

    \35\ 63 FR at 43329.
---------------------------------------------------------------------------

    Six commenters opposed a notice requirement for electronic 
activities other than a transactional web site. Three commenters 
explained that OTS already has sufficient authority to examine any 
activity that raises safety and soundness concerns.
    OTS is not requiring a notice under Sec. 555.300(b) for any 
activities using electronic means or facilities other than 
transactional web sites. For example, a savings association would not 
be required to notify OTS before it establishes an informational web 
site.36 As with other activities, OTS will continue to rely 
on its existing supervisory examinations and application processes to 
ensure the savings association's ability to engage in new activities in 
a safe, sound, secure, and compliant manner.37
---------------------------------------------------------------------------

    \36\ However, OTS has implemented a change to the Thrift 
Financial Report (TFR). The electronic filing software now collects 
information on all savings associations' Internet web site 
addresses. This change was effective for the third quarter 1998 TFR.
    \37\ OTS reviews the safety and soundness of new activities, the 
appropriateness of the internal controls and security precautions, 
and compliance with applicable laws and regulations on a case-by-
case and institution-by-institution basis in connection with 
applications and through the examination process. For institutions 
subject to an application process (e.g., de novo applications), 
these initial safety and soundness and compliance determinations 
will be made in the application review. After application approval 
or where no application is required, safety and soundness and 
compliance will generally be assessed as a part of the examination 
process. This process will review and assess the institution's 
identification of risks of the activity, the steps it has taken to 
mitigate these risks, the testing it has undertaken to ensure safety 
and soundness, and its compliance monitoring process.
---------------------------------------------------------------------------

    As technologies emerge, OTS may revise the rule to require notice 
of activities other than establishing a transactional web site. 
Similarly, as technologies mature and the industry and OTS gain 
additional experience, OTS may revise the rule to no longer require 
notice before establishing a transactional web site.
    OTS is also making an editorial change to Sec. 555.300(a). The 
change clarifies that OTS encourages consultations with the Regional 
Office regardless of whether the notice requirement in Sec. 555.300(b) 
or the additional procedures in Sec. 555.300(c) apply.
2. How do I Notify OTS? (Sec. 555.310)
    Proposed Sec. 555.310 of the Supplemental NPR described the advance 
notice procedures. Proposed Sec. 555.310(a) would require a savings 
association to provide a written notice to the appropriate Regional 
Office at least 30 days before establishing a transactional web site. 
Proposed Sec. 555.310(b) contained a transition provision applicable to 
transactional web sites established after the date of the association's 
last regular onsite OTS safety and soundness examination but before the 
effective date of the rule.
    Two commenters supported the 30-day advance notice period. Another 
commenter argued that the 30-day notice period would be too long and 
suggested a 10-day notice period. Another commenter urged OTS to permit 
a savings association to apprise OTS within 30 days after establishing 
a transactional web site. This notice would permit OTS to review the 
web site in an examination.
    OTS has decided to retain the 30-day advance notice procedure as 
proposed. As discussed above, OTS does not anticipate this procedure 
will be burdensome. Thirty days is an appropriate time period to allow 
OTS to consider the notice and ask any follow-up questions that may be 
necessary.
    In the Supplemental NPR, OTS did not propose to prescribe any 
particular form for the notice. Proposed Sec. 555.310(a) would simply 
require that a savings association describe the transactional web site, 
indicate the date the transactional web site will become operational, 
and list a contact familiar with the deployment, operation, and 
security of the transactional web site. The preamble to the 
Supplemental NPR indicated that, upon receipt of the notice, the 
Regional Office may require additional information to ensure that the 
savings association will operate the transactional web site in a safe, 
sound, secure, and compliant manner.38 The preamble further 
indicated that OTS contemplated that the notice may be brief. It 
contained sample language that read:
---------------------------------------------------------------------------

    \38\ 63 FR at 43329.

    [Name of savings association] plans to establish a transactional 
web site on the Internet at [URL]. It will be operational on [Date]. 
The site will contain mortgage loan applications that can be 
transmitted securely

[[Page 65680]]

to our loan processing office. For further information contact: 
[Name at telephone number, e-mail].39
---------------------------------------------------------------------------

    \39\Id.

    Four commenters stated that OTS should not require any information 
in the notice beyond that described in the Supplemental NPR. One 
commenter specifically endorsed OTS's sample statement in the preamble 
as sufficient. One commenter, however, recommended that institutions 
describe how they will conduct the activity, the type of security they 
will use, the internal controls they will follow, and the program they 
will follow to ensure compliance with all applicable laws and 
regulations. Another commenter observed that an overview of controls 
and safeguards designed to preserve privacy and security and protect 
against financial fraud would be sufficient. 40 
One commenter suggested that if OTS discovers that new information is 
necessary following this rulemaking, it should require this information 
in guidance, rather than in a revised rule.
---------------------------------------------------------------------------

    \40\ One commenter, however, noted that security information may 
be difficult to obtain when the web site is maintained by a service 
bureau. This commenter noted that service bureaus often claim that 
the release of such information will compromise their systems.
---------------------------------------------------------------------------

    OTS is adopting the requirements concerning the contents of the 
notice as proposed. It believes these requirements will provide 
sufficient information to the Regional Offices without being burdensome 
or inflexible. The guidance contained in the preamble to the 
Supplemental NPR, including the sample language set forth above, 
remains valid.
    Several commenters sought clarification of the review procedures. 
One commenter sought assurance that the notice process was 
informational only. Two commenters sought clarification whether OTS 
would approve or disapprove notices (e.g., where there are supervisory 
or compliance concerns). One noted that if prior OTS approval is 
required, the notice process would impose substantial financial, 
strategic, and compliance risks on institutions. Another commenter 
urged OTS to review all notices within the notice period and quickly 
act to prevent a savings association from establishing a transactional 
web site that could threaten its safety and soundness.
    The procedure will work as follows: The savings association will 
file a written notice with the Regional Office. The Regional Office 
will review the notice and may ask follow-up questions. In general, 
once an association has addressed those follow-up questions from the 
Regional Office and the 30-day period has expired, the association will 
be free to bring its transactional web site on-line. No affirmative 
authorization from OTS is necessary except where the Regional Office 
may otherwise indicate. If, however, by the end of the 30-day period, 
the Regional Office informs the association that there are supervisory 
or compliance concerns that may affect the association's establishment 
of a transactional web site, the association must follow any procedures 
that the Regional Office imposes in writing. The procedures the 
Regional Office may impose could include, for example, requiring 
further information to be submitted or precautions to be taken before 
the savings association may establish the transactional web site, 
limiting in some fashion the ways in which the association may use the 
transactional web site, or prohibiting the association from 
establishing a transactional web site.
    One commenter opposing notice procedures observed that the advance 
notice only made sense if the Regional Office would review the notice 
before the roll-out of the web site. This commenter, however, predicted 
that OTS Regional Offices may apply inconsistent standards and that 
this inconsistency could be problematic since web sites provide 
services nationwide. The commenter suggested that the final rule should 
require the Regional Office to notify the thrift of any conditions it 
would impose on web site operations. OTS will issue industry guidance 
to help a savings association deploy a transactional web site in a 
safe, sound, secure, and compliant manner. OTS will also issue uniform 
guidance to its Regional Offices to verify that transactional web sites 
are in compliance with the industry guidance and this regulation and 
that savings associations have established an adequate infrastructure 
for operating safe, sound, secure, and compliant transactional web 
sites.
    One commenter urged OTS to require public notice and comment before 
a savings association may establish a transactional web site. This 
commenter indicated that, in some states, financial institutions must 
provide public notice and comment before opening a deposit-collecting 
branch or deposit-taking ATM.
    OTS does not believe it is appropriate to require a public comment 
procedure. Moreover, OTS posts notices on its web site upon filing. The 
same policy will apply to notices for transactional web sites. This 
procedure will provide adequate information to the public.

IV. Other Rule Provisions

A. Conforming Amendment to Branch Offices Regulation

    The proposed rule would revise OTS's branch office regulation to 
clarify that electronic facilities (such as automated loan machines) 
are not branch offices. Three commenters specifically supported this 
section, although two requested clarifications. One Federal savings 
association argued that the final rule should indicate that all 
electronic facilities and the Internet are excluded from the definition 
of ``branch office.'' The proposed rule would have excluded an 
``electronic facility'' from the definition of ``branch office,'' but 
did not indicate that an ``electronic means'' was also excluded.
    For consistency in terminology, the final rule has been revised to 
exclude all ``electronic means or facilities'' from the definition of 
``branch office.'' Under Sec. 555.200(a), the Internet continues to be 
an electronic means or facility and is not considered to be a branch.
    Another Federal savings association asked whether a ``hybrid 
office'' would be treated as a branch office. This commenter defined a 
hybrid office as an office in which a Federal savings association 
conducts the majority of its operations electronically, but conducts 
some functions in person by appointment. The type of office the 
commenter has described may be either a branch office \41\ or an agency 
\42\ depending upon the types of services provided. A Federal savings 
association may request an OTS opinion if it requires further guidance 
on this topic.\43\
---------------------------------------------------------------------------

    \41\ 12 CFR 545.92 (1998).
    \42\ 12 CFR 545.96 (1998).
    \43\ OTS will shortly undertake another rulemaking to clarify 
the regulations governing various types of offices.
---------------------------------------------------------------------------

B. Conforming Amendment to Subordinate Organizations Rule

    The Examination Parity and Year 2000 Readiness for Financial 
Institutions Act, discussed above, applies to Federal and State savings 
associations and provides OTS with the authority to examine service 
corporations. Accordingly, OTS is conforming the service corporation 
examination provision of its Subordinate Organizations regulation, 12 
CFR 559.3(o)(2), to reflect this authority.

V. Other Issues Raised by Commenters

A. Preemption

    One Federal savings association commenting on both the NPR and the

[[Page 65681]]

Supplemental NPR urged OTS to add specific preemption provisions 
stating that OTS's electronic operations regulations preempt state laws 
purporting to restrict or govern the electronic operations of federal 
savings associations. The commenter noted that various states have 
enacted such laws. The commenter argued that preemption would encourage 
Federal savings associations to participate in various electronic 
banking activities, facilitate the development of best industry 
practices, and prevent the development of a patchwork of conflicting 
state and local rules.
    Electronic operations and related state and federal laws are still 
evolving. Thus, OTS believes it is premature to craft specific 
preemption regulations in the area of electronic operations. OTS 
intends to address specific state laws on a case-by-case basis as they 
are raised to the agency.
    The commenter may have raised this matter, in part, because the 
electronic operations provisions will not be placed in part 545, but 
rather in a new part 555. Part 545 currently contains regulations 
pertaining to electronic operations \44\ and also contains a general 
provision preempting state laws affecting ``Operations.'' \45\ However, 
the movement of the electronic operation provisions to a new part 555 
does not indicate a substantive change. OTS will apply principles of 
preemption consistently with its prior interpretations of OTS's 
authority under the HOLA.\46\ Accordingly, the regulations in subpart A 
to part 555 will have preemptive effect where appropriate to: (1) 
facilitate the safe and sound operations of a Federal savings 
association, (2) enable a Federal savings association to operate 
according to the best thrift institution practices in the United 
States, or (3) further other purposes of the HOLA.\47\
---------------------------------------------------------------------------

    \44\ 12 CFR 545.138, 545.141, and 545.142 (1998).
    \45\ 12 CFR 545.2 (1998).
    \46\ See 12 CFR 545.2 (Operations), 557.11-557.13 (Deposits), 
and 560.2 (Lending and Investment) (1998).
    \47\ Accord 12 CFR 557.11(a) and 560.2(a) (1998).
---------------------------------------------------------------------------

    When evaluating preemption of a state law, OTS will focus first on 
the underlying activity affected by the state law. For example, if a 
state law affects a Federal savings association's ability to take 
deposits or lend using electronic means and facilities, OTS will apply 
the part 557 or part 560 preemption analysis for deposit or lending 
activities, respectively. OTS will evaluate other activities that may 
be conducted electronically, on a case-by-case basis.
    While OTS intends to give Federal savings associations maximum 
flexibility to operate electronically according to a uniform federal 
scheme of regulation, OTS has recognized that some types of state laws, 
under certain circumstances, generally will not be preempted.\48\ 
Consistent with this approach, OTS will determine that a state law 
regulating electronic operations is not preempted if it furthers a 
vital state interest, and either has only an incidental effect on 
Federal savings associations' ability to provide financial services 
electronically or is not otherwise contrary to the purposes of OTS's 
rule.
---------------------------------------------------------------------------

    \48\ See 12 CFR 557.13 and 560.2(c) (1998).
---------------------------------------------------------------------------

B. Community Reinvestment Act

    Several commenters on the NPR addressed the impact of emerging 
electronic technologies on Community Reinvestment Act (CRA) 
requirements. The comments generally argued that the current CRA 
requirements do not: (1) provide adequate recognition of loans, 
investments and services generated outside of a Federal savings 
association's traditional assessment area (i.e. the area surrounding 
its branch network), or (2) permit Federal savings associations with 
Internet operations to define their CRA assessment areas more broadly 
than the branch network concept allows. Some commenters offered options 
intended to address these types of concerns. These included allowing 
Federal savings associations that engage in alternate delivery systems 
to be treated as limited purpose institutions or to define an 
assessment area in a manner that is tied to the customer base rather 
than a particular geography. One commenter on the Supplemental NPR 
expressed concern that financial institutions may use web sites to 
conduct business nationwide, but would be required to include only 
certain geographical areas in their CRA assessment areas.
    Currently, OTS is working on an interagency basis to resolve these 
concerns and other CRA issues arising from the use of alternative 
methods of delivering financial products and services. The interagency 
effort involves revisiting the definition of an assessment area for 
institutions that use alternative delivery systems. Until this 
interagency effort is completed, OTS intends to allow the new 
electronic technologies to develop within the existing CRA regulatory 
framework. Specific CRA issues that arise in connection with an 
application will continue to be handled on a case-by-case basis in an 
effort to adapt existing laws to modern technologies and innovations. 
49 An institution, of course, always has the option of 
taking advantage of the flexibility in the existing CRA regulation by 
developing and seeking approval of a strategic plan that would link CRA 
performance to its particular business strategy. 50
---------------------------------------------------------------------------

    \49\ While not specifically involving electronic operations, the 
1997 application from the Travelers Group is illustrative of an 
institution's efforts to develop a new approach on CRA. The 
Travelers Group filed an application to convert a state-chartered 
bank to a Federal savings association charter. The converted Federal 
savings association was to engage in consumer lending and trust 
services nationwide. In its application, Travelers stated that its 
CRA obligation extended throughout all the communities where it does 
business and made an initial pledge to make at least $430 million of 
home equity loans to low- and moderate-income borrowers over three 
years. OTS approved Travelers' application. See Order No. 97-120 
(November 24, 1997).
    \50\ See 12 CFR 563e.27 (1998).
---------------------------------------------------------------------------

C. Other Interagency Issues

    Both trade association commenters on the NPR urged OTS, other 
Federal bank regulators, and the Treasury Department to coordinate 
their activities to ensure the development of consistent approaches to 
electronic operations issues, to minimize regulatory burdens, and to 
avoid potential conflicts. One commenter on the Supplemental NPR 
indicated it would only support the notice requirement for 
transactional web sites if all banking regulators imposed the same 
requirement on their regulated institutions.
    As OTS issues rules and guidance on electronic operations, it 
continually strives for consistency with other Federal banking 
regulators. Accordingly, OTS will continue to participate in all 
interagency efforts to establish consistent regulatory approaches to 
electronic operations issues.
    One Federal savings association noted that when the Federal banking 
agencies and the Department of Justice review a merger or acquisition 
for its impact on competition, the analysis focuses on the relevant 
product and geographic markets. These concepts generally require an 
analysis of deposits taken, loans made, and services provided in the 
geographic areas served by the combining institutions. The commenter 
urged the Federal banking agencies to view Internet banking activities 
as outside the scope of the traditional antitrust analysis and 
recognize that current technology gives Federal savings associations 
and banks the ability to conduct business with customers all over the 
country.
    The entry of financial institutions into electronic operations 
raises a host of new issues. OTS has attempted through

[[Page 65682]]

this rulemaking and guidelines to address issues that have arisen. To 
date, the antitrust issue cited by the commenter has not been a 
critical issue in an application. Currently, financial business through 
electronic operations constitutes a very small portion of financial 
services offered by Federal savings associations. OTS will consider 
providing guidance on this issue and other issues in the future should 
they emerge as prominent issues.

VI. Executive Order 12866

    The Director of OTS has determined that this final rule does not 
constitute a ``significant regulatory action'' for the purposes of 
Executive Order 12866.

VII. Paperwork Reduction Act of 1995

    The collection of information requirements in this rule have been 
submitted to and approved by the Office of Management and Budget in 
accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) 
under OMB control number 1550-0095.
    Comments on all aspects of this information collection should be 
sent to the Office of Management and Budget, Paperwork Reduction 
Project (1550-0095), Washington, DC 20503, with copies to the 
Regulations and Legislation Division, Chief Counsel's Office, Office of 
Thrift Supervision, 1700 G Street, NW., Washington, DC 20552.
    Under the Paperwork Reduction Act of 1995, no persons are required 
to respond to a collection of information unless it displays a 
currently valid OMB control number. The valid OMB control number 
assigned to the collection of information in this final rule is 
displayed at 12 CFR 506.1.
    The collection of information requirements are found in 12 CFR 
555.300 and 555.310. OTS requires this information for the proper 
supervision of electronic operations by savings associations. The 
likely respondents/recordkeepers are savings associations.

VIII. Regulatory Flexibility Act Analysis

    Pursuant to section 605(b) of the Regulatory Flexibility Act, OTS 
certifies that this regulation will not have a significant impact on a 
substantial number of small entities. This final rule should make it 
easier for Federal savings associations, including small institutions, 
to engage in electronic operations. While it imposes a notice 
requirement on savings associations using one particular type of 
electronic means or facility (i.e., a transactional web site) and 
allows Regional Offices to impose case-by-case restrictions for 
supervisory or compliance reasons, these requirements are the minimum 
necessary for proper supervision and should not have a significant 
impact on a substantial number of small institutions.

IX. Unfunded Mandates Act of 1995

    Section 202 of the Unfunded Mandates Reform Act of 1995, Pub. L. 
104-4 (Unfunded Mandates Act), requires that an agency prepare a 
budgetary impact statement before promulgating a rule that includes a 
Federal mandate that may result in expenditure by state, local, and 
tribal governments, in the aggregate, or by the private sector, of $100 
million or more in any one year. If a budgetary impact statement is 
required, section 205 of the Unfunded Mandates Act also requires an 
agency to identify and consider a reasonable number of regulatory 
alternatives before promulgating a rule. OTS has determined that the 
rule will not result in expenditures by state, local, or tribal 
governments or by the private sector of $100 million or more. 
Accordingly, this rulemaking is not subject to section 202 of the 
Unfunded Mandates Act.

List of Subjects

12 CFR Part 545

    Accounting, Consumer protection, Credit, Electronic funds 
transfers, Investments, Reporting and recordkeeping requirements, 
Savings associations.

12 CFR Part 555

    Accounting, Consumer protection, Credit, Electronic funds 
transfers, Investments, Reporting and recordkeeping requirements, 
Savings associations.

12 CFR Part 559

    Reporting and recordkeeping requirements, Savings associations, 
Securities.

    Accordingly, the Office of Thrift Supervision amends chapter V, 
title 12 of the Code of Federal Regulations as set forth below:

PART 545--OPERATIONS

    1. The authority citation for part 545 continues to read as 
follows:

    Authority: 12 U.S.C. 1462a, 1463, 1464, 1828.

    2. Section 545.92 is amended by revising paragraph (a) to read as 
follows:


Sec. 545.92  Branch offices.

    (a) General. A branch office of a Federal savings association is 
any office other than its home office, agency office, administrative 
office, data processing office, or an electronic means or facility 
under part 555 of this chapter.
* * * * *


Secs. 545.138 through 545.142  [Removed]

    3. Sections 545.138 through 545.142 are removed.
    4. Part 555 is added to read as follows:

PART 555--ELECTRONIC OPERATIONS

Sec.
555.100  What does this part do?

Subpart A--Authority of Federal Savings Associations to Conduct 
Electronic Operations

555.200  How may I use or participate with others to use electronic 
means and facilities?
555.210  What precautions must I take?

Subpart B--Requirements Applicable to All Savings Associations

555.300  Must I inform OTS before I use electronic means or 
facilities?
555.310  How do I notify OTS?

    Authority: 12 U.S.C. 1462a, 1463, 1464.


Sec. 555.100  What does this part do?

    Subpart A of this part describes how a Federal savings association 
may provide products and services through electronic means and 
facilities. Subpart B of this part contains requirements applicable to 
all savings associations.

Subpart A--Authority of Federal Savings Associations to Conduct 
Electronic Operations


Sec. 555.200  How may I use or participate with others to use 
electronic means and facilities?

    (a) General. A federal savings association (``you'') may use, or 
participate with others to use, electronic means or facilities to 
perform any function, or provide any product or service, as part of an 
authorized activity. Electronic means or facilities include, but are 
not limited to, automated teller machines, automated loan machines, 
personal computers, the Internet, the World Wide Web, telephones, and 
other similar electronic devices.
    (b) Other. To optimize the use of your resources, you may market 
and sell, or participate with others to market and sell, electronic 
capacities and by-products to third-parties, if you acquired or 
developed these capacities and by-products in good faith as part of 
providing financial services.


Sec. 555.210  What precautions must I take?

    If you use electronic means and facilities under this subpart, your 
management must:

[[Page 65683]]

    (a) Identify, assess, and mitigate potential risks and establish 
prudent internal controls; and
    (b) Implement security measures designed to ensure secure 
operations. Such measures must be adequate to:
    (1) Prevent unauthorized access to your records and your customers' 
records;
    (2) Prevent financial fraud through the use of electronic means or 
facilities; and
    (3) Comply with applicable security devices requirements of part 
568 of this chapter.

Subpart B--Requirements Applicable to All Savings Associations


Sec. 555.300  Must I inform OTS before I use electronic means or 
facilities?

    (a) General. A savings association (``you'') are not required to 
inform OTS before you use electronic means or facilities, except as 
provided in paragraphs (b) and (c) of this section. However, OTS 
encourages you to consult with your Regional Office before you engage 
in any activities using electronic means or facilities.
    (b) Activities requiring advance notice. You must file a written 
notice as described in Sec. 555.310 before you establish a 
transactional web site. A transactional web site is an Internet site 
that enables users to conduct financial transactions such as accessing 
an account, obtaining an account balance, transferring funds, 
processing bill payments, opening an account, applying for or obtaining 
a loan, or purchasing other authorized products or services.
    (c) Other procedures. If the OTS Regional Office informs you of any 
supervisory or compliance concerns that may affect your use of 
electronic means or facilities, you must follow any procedures it 
imposes in writing.


Sec. 555.310  How do I notify OTS?

    (a) Notice requirement. You must file a written notice with the 
appropriate Regional Office at least 30 days before you establish a 
transactional web site. The notice must do three things:
    (1) Describe the transactional web site.
    (2) Indicate the date the transactional web site will become 
operational.
    (3) List a contact familiar with the deployment, operation, and 
security of the transactional web site.
    (b) Transition provision. If you established a transactional web 
site after the date of your last regular onsite OTS safety and 
soundness examination but before January 1, 1999, you must file a 
notice describing your activity by February 1, 1999.

PART 559--SUBORDINATE ORGANIZATIONS

    5. The authority citation for part 559 continues to read as 
follows:

    Authority: 12 U.S.C. 1462, 1462a, 1463, 1464, 1828.

    6. Section 559.3 is amended by revising paragraph (o)(2) to read as 
follows:


Sec. 559.3  What are the characteristics of, and what requirements 
apply to, subordinate organizations of federal savings associations?

* * * * *
    (o) * * *
    (2) A service corporation is subject to examination by OTS.
* * * * *
    Dated: November 20, 1998.

    By the Office of Thrift Supervision.
Ellen Seidman,
Director.
[FR Doc. 98-31746 Filed 11-27-98; 8:45 am]
BILLING CODE 6720-01-P