Amended Electronic Fund Transfer Requirements
The Board of Governors of the Federal Reserve System recently amended its Commentary regarding preauthorized electronic fund transfers (EFTs), specifically concerning the use of recorded authorizations and debit cards for such payments.
The Board has authority over the Electronic Funds Transfer Act (EFTA) and its implementing regulation, Regulation E (Reg E). Reg E requires that recurring electronic fund transfers from a consumer’s account be authorized by a writing signed or similarly authenticated by the consumer. This includes written authorization and electronic authorization that complies with the requirements of the Electronic Signatures in Global and National Commerce Act (E-SIGN Act).
On January 10, 2006, the Board published a final rule amending Reg E. The final rule became effective February 10, 2006; the mandatory compliance date was January 1, 2007. The final rule contains two important changes to the Board’s Official Staff Interpretations, which are a supplement to Reg E. Comment 10(b)-3 was amended to possibly allow recorded telephone authorizations to constitute acceptable authorization for recurring electronic fund transfers. Comment 10(b)-7 was amended to state that bona fide errors, such as accepting a debit card for payment and believing it to be a credit card, is not a violation of the EFTA so long as the merchant maintains procedures reasonably adapted to avoid such errors, such as asking the consumer whether the card is a debit (or check) card or credit card. Companies that collect debit and credit card numbers for use on a recurring basis must adhere to the new policies described herein, whether collecting debit card numbers online, via telephone, or in hard copy.
Comment 10(b)-3 – Recorded Authorization May Be Allowed
The final rule removes previous Commentary to Reg E that had stated that a merchant could not obtain valid authorization by tape recording a telephone conversation with a consumer who agrees to recurring electronic fund transfers. The Commentary was removed as a result of suggestions that, pursuant to the E-SIGN Act, a recorded telephone authorization might satisfy the Reg E authorization requirements.
However, the Board did not expressly say that such an authorization satisfies the requirements of the E-SIGN Act. The Board chose to withdraw the guidance regarding the invalidity of tape recordings because of E-SIGN Act considerations, but did not amend its Commentary to address how the E-SIGN Act should be interpreted with regard to tape recordings of telephone conversations.2 The Federal Register notice states, “The final rule does not interpret Regulation E to treat recorded telephone authorizations as written authorizations; however, the Board believes that the E-SIGN Act’s provisions regarding written documents are applicable to the EFTA and Regulation E. As a result, if, under the E-SIGN Act, a tape-recorded authorization, or certain types of tape-recorded authorizations, constitute a written and signed (or similarly authenticated) authorization, then the authorization would satisfy the Regulation E requirements.”3 In other words, this type of recorded authorization may be sufficient so long as the requirements of the E-SIGN Act are satisfied.
In addition to complying with E-SIGN Act requirements, merchants must of course comply with Reg E general authorization requirements, such as ensuring that the terms of the preauthorized debits are clear and readily understandable to the consumer and providing the consumer a copy of the terms consented to. The Board therefore leaves open the possibility that recorded telephone authorizations may be acceptable to the extent that they satisfy the provisions of the E-SIGN Act and Reg E. In withdrawing its previous Commentary, the Board no longer explicitly prohibits recorded telephone authorizations as a method of obtaining the “signed or similarly authenticated” authorization required by the EFTA and Reg E.
Comment 10(b)-7 – Reasonable Procedures Are Required to Avoid Error of Treating Debit Card as Credit Card
Formerly, Comment 10(b)-7 did not contemplate asking whether cards to be used for recurring electronic payments were debit or credit because of the small number of debit cards in circulation as of the last review of Reg E. In discussing the amendments, the Board stated, “It may have been reasonable in the past, when relatively few debit cards were in use compared to credit cards, for payees to use procedures that did not involve asking questions about the type of card being used. Today, however, given the growth of debit card usage, the Board believes that reasonable procedures should include interaction with the consumer specifically designed to elicit information about whether a debit card is involved.”
The previous Comment 10(b)-7 did not provide advice as to what types of procedures would be reasonable. The Board stated that retail and other industry groups had expressed concern as to what types of procedures would be viewed as reasonably adapted to avoid error when seeking a consumer’s authorization for recurring payments using a credit or debt card. The Board therefore, proposed to revise Comment 10(b)-7 to state that procedures reasonably adapted to avoid error will vary with the circumstances, and that asking whether the card to be used is a debit or credit card would be a reasonable procedure, thus providing a safe harbor for industry.
The amended Comment 10(b)-7 to Reg E states:
If the consumer indicates use of a credit card account when in fact a debit card is being used, the payee does not violate the requirement to obtain a written authorization if the failure to obtain written authorization was not intentional and resulted from a bona fide error, and if the payee maintains procedures reasonably adapted to avoid any such error. Procedures reasonably adapted to avoid error will depend upon the circumstances. Generally, requesting the consumer to specify whether the card to be used for the authorization is a debit (or check) card or a credit card is a reasonable procedure.
Therefore, bona fide error, such as accepting a debit card for payment and believing it to be a credit card, would not be a violation of the EFTA provided the merchant maintains procedures reasonably adapted to avoid such errors, such as asking the consumer if the card in question is a debit (or check) card or credit card.7 The final rule leaves open the possibility that there may be other procedures (besides asking whether the card is credit or debit) that would satisfy the requirement to have in place procedures that are reasonably adapted to avoid the error of failing to obtain written authorization for recurring debits. However, asking whether the card is credit or debit is a safe harbor approved by the Board.
Implementing the Amended Requirements
It appears that many industry members are recently becoming aware of the amendments to Reg E involving preauthorized electronic fund transfers. However, it is important to note that the mandatory date of compliance was January 1, 2007. The implementation date has therefore arrived, and enforcement by the Board against banks and financial institutions and by the Federal Trade Commission against merchants is now a possibility.
In the past it may have been acceptable not to ask the consumer whether the card being provided for payment is a debit or a credit card, but the revised Commentary appears now to place the onus on the merchant to have some reasonable mechanism in place for determining whether the card is a debit or a credit card and to obtain the appropriate authorization depending on which type of card is presented. If a merchant makes an error and treats a debit card as a credit card, that will be considered a bona fide error so long as the merchant has in place procedures reasonably adapted to avoid such errors. The safe harbor and the potentially simplest of any “reasonable procedures” is to ask the customer whether it is a debit (or check) card or credit card and to then obtain the appropriate authorization.
Companies should, as soon as practicable, begin to develop processes that will enable them to comply with the Board’s amended Commentary regarding recorded phone authorizations and/or the necessity of obtaining signed or similarly authenticated authorization for recurring electronic fund transfers for online and/or offline transactions. In combination, the two amended Comments may be positive for industry. While merchants are required to obtain written or similarly authenticated authorization for recurring electronic fund transfers, they may now be able to do so by recording telephone authorizations, which the Board had previously prohibited.