I. INTRODUCTION
The federal banking regulatory agencies have issued guidance addressing the applicability of federal consumer protection and compliance laws, regulations, and policies to activities conducted via social media by financial institutions.
The Guidance does not impose any new requirements on financial institutions. Rather, it is a guide to help financial institutions understand the applicability of existing requirements and supervisory expectations associated with the use of social media. Financial institutions are expected to manage risks associated with all types of consumer and customer communications, no matter the medium. The Guidance provides considerations that financial institutions may find useful in conducting risk assessments and crafting and evaluating policies and procedures regarding social media.
Financial institutions are expected to use the Guidance in their efforts to ensure that their policies and procedures provide oversight and controls commensurate with the risks posed by their involvement with social media.
For purposes of the Guidance, social media is a form of interactive online communication in which users can generate and share content through text, images, audio, and/or video. Social media can take many forms, including, but not limited to, micro-blogging sites; forums, blogs, customer review web sites and bulletin boards; photo and video sites; sites that enable professional networking; virtual worlds; and social games. Social media can be distinguished from other online media in that the communication tends to be more interactive. For purposes of the Guidance, messages sent via email or text message, standing alone, do not constitute social media, although such communications may be subject to a number of laws and regulations discussed in the Guidance. Social media is a dynamic and constantly evolving technology and thus any definition for this technology is meant to be illustrative and not exhaustive. In addition to the examples of social media mentioned above, other forms of social media may emerge in the future that financial institutions should also consider.
Financial institutions may use social media in a variety of ways, including marketing, providing incentives, facilitating applications for new accounts, inviting feedback from the public, and engaging with existing and potential customers, for example, by receiving and responding to complaints, or providing loan pricing. Since this form of customer interaction tends to be both informal and dynamic, and may occur in a less secure environment, it can present some unique challenges to financial institutions.
II. PRINCIPAL ELEMENTS OF GUIDANCE
The use of social media by a financial institution to attract and interact with customers can impact a financial institution’s risk profile. The increased risks can include the risk of harm to consumers, compliance and legal risk, operational risk, and reputation risk. Increased risk can arise from a variety of directions, including poor due diligence, oversight, or control on the part of the financial institution. The Guidance is meant to help financial institutions identify potential risk areas to appropriately address, as well as to ensure institutions are aware of their responsibilities to oversee and control these risks within their overall risk management program. The Agencies recognize that the scope of social media activities vary by financial institution. Each institution is responsible for carrying out an appropriate risk assessment and maintaining a risk management program that is appropriate and tailored to the particular institution's size, activities, and risk profile.
III. COMPLIANCE RISK MANAGEMENT EXPECTATIONS
A financial institution should have a risk management program that allows it to identify, measure, monitor, and control the risks related to social media. The size and complexity of the risk management program should be commensurate with the breadth of the financial institution’s involvement in this medium. For instance, a financial institution that relies heavily on social media to attract and acquire new customers should have a more detailed program than one using social media only to a very limited extent. However, in accordance with its own risk assessment, a financial institution that has chosen not to use social media should still consider the potential for negative comments or complaints that may arise within the many social media platforms described above, and, when appropriate, evaluate what, if any, action it will take to monitor for such comments and/or respond to them.
The risk management program should be designed with participation from specialists in compliance, technology, information security, legal, human resources, and marketing. Financial institutions should also provide guidance and training for employee official use of social media. Components of a risk management program should include the following:
IV. RISK AREAS
A. Compliance and Legal Risks
Compliance and legal risks arise from the potential for violations of, or nonconformance with, laws, rules, regulations, prescribed practices, internal policies and procedures, or ethical standards. These risks also arise in situations in which the financial institution’s policies and procedures governing certain products or activities may not have kept pace with changes in the marketplace. This is particularly pertinent to an emerging medium like social media. Further, the potential for defamation or libel risk exists where there is broad distribution of information exchanges. Failure to adequately address these risks can expose an institution to enforcement actions and/or civil lawsuits.
The laws and regulations discussed in the Guidance do not contain exceptions regarding the use of social media. Therefore, to the extent that a financial institution uses social media to engage in lending, deposit services, or payment activities, it must comply with applicable laws and regulations as when it engages in these activities through other media. Financial institutions should remain aware of developments involving such laws and regulations.
All the rules and regulations that apply to bank advertising, also apply to social media. The following laws and regulations may be relevant to a financial institution’s social media activities. This list is not all-inclusive. Each financial institution should ensure that it periodically evaluates and controls its use of social media to ensure compliance with all applicable federal, state, and local laws and regulations, and incorporation of guidance, as appropriate.
1. Deposit and Lending Products
Social media may be used to market products and originate new accounts. When used to do either, a financial institution is expected to take steps to ensure that advertising, account origination, and document retention are performed in compliance with applicable consumer protection and compliance laws and regulations. These measures may include, but are not limited to:
a. Truth in Savings Act/Regulation DD and Part 707
b. Fair Lending Laws: Equal Credit Opportunity Act/Regulation B and Fair Housing Act. A financial institution should ensure that its use of social media does not violate fair lending laws and regulations.
c. Truth in Lending Act/Regulation Z. Any social media communication in which a creditor advertises credit products must comply with Regulation Z’s advertising provisions.
d. Real Estate Settlement Procedures Act. Section 8 of the Real Estate Settlement Procedures Act (RESPA) prohibits certain activities in connection with federally related mortgage loans. These requirements apply to applications taken electronically, including via social media.
e. Fair Debt Collection Practices Act. The Fair Debt Collection Practices Act (FDCPA) restricts how debt collectors (generally defined as third parties collecting others’ debts and entities collecting debts on their own behalf if they use a different name) may collect debts. Using social media to inappropriately contact consumers, or their families and friends, may violate the restrictions on contacting consumers imposed by the FDCPA.
f. Unfair, Deceptive, or Abusive Acts or Practices. Section 5 of the Federal Trade Commission (FTC) Act prohibits “unfair or deceptive acts or practices in or affecting commerce.” A financial institution should not engage in any advertising or other practice via social media that could be deemed “unfair,” “deceptive,” or “abusive.” Of course, any determination as to whether an act or practice engaged in through social media is unfair, deceptive, or abusive, will necessarily be fact-specific. As with other forms of communication, a financial institution should ensure that information it communicates on social media sites is accurate, consistent with other information delivered through electronic media, and not misleading.
B. Deposit Insurance or Share Insurance
A number of requirements regarding FDIC membership and deposit insurance apply equally to advertising and other activities conducted via social media as they do in other contexts.
C. Payment Systems
If social media is used to facilitate a consumer’s use of payment systems, a financial institution should keep in mind the laws, regulations, and industry rules regarding payments that may apply, including those providing disclosure and other rights to consumers. Under existing law, no additional disclosure requirements apply simply because social media is involved (for instance, providing a portal through which consumers access their accounts at a financial institution). Rather, the financial institution should continue to be aware of the existing laws, regulations, guidance and industry rules that apply to payment systems and evaluate which will apply. These may include the following:
Electronic Fund Transfer Act/Regulation E
Rules Applicable to Check Transactions
D. Bank Secrecy Act/Anti-Money Laundering Programs (BSA/AML)
Financial institutions should also be aware of emerging areas of BSA/AML risk in the virtual world. For example, illicit actors are increasingly using Internet games involving virtual economies, allowing garners to cash out, as a way to launder money. Virtual world Internet games and digital currencies present a higher risk for money laundering and terrorist financing and should be monitored accordingly.
E. Community Reinvestment Act
A depository institution subject to the CRA should ensure that its policies and procedures addressing public comments take into account such comments when they are received through social media sites run by or on behalf of the institution. However, under the CRA, comments about the institution made on the Internet through sites that are not run by or on behalf of the institution are not necessarily deemed to have been received by the depository institution and would not be required to be retained. Rather, the institution should retain comments made on sites run by or on behalf of the institution that specifically relate to the institution’s performance in helping to meet community credit needs.
F. Privacy
Privacy rules have particular relevance to social media when, for instance, a financial institution collects, or otherwise has access to, information from or about consumers. A financial institution should take into consideration the following laws and regulations regarding the privacy of consumer information:
1. Gramm-Leach-Bliley Act Privacy Rules and Data Security Guidelines. Title V of the Gramm-Leach-Bliley Act (GLBA) establishes requirements relating to the privacy and security of consumer information. Whenever a financial institution collects, or otherwise has access to, information from or about consumers, it should evaluate whether these rules will apply. The rules have particular relevance to social media when, for instance, a financial institution integrates social media components into customers’ online account experience or takes applications via social media portals.
2. CAN-SPAM Act and Telephone Consumer Protection Act. The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act) and Telephone Consumer Protection Act (TCPA) may be relevant if a financial institution sends unsolicited communications to consumers via social media.
3. Children’s Online Privacy Protection Act (COPPA). A financial institution should evaluate whether it, through its social media activities, could be covered by COPPA.
4. Fair Credit Reporting Act. The Fair Credit Reporting Act (FCRA) and its implementing regulations contain restrictions and requirements concerning making solicitations using eligibility information, responding to direct disputes, and collecting medical information in connection with loan eligibility. The FCRA applies when social media is used for these activities.
V. REPUTATION RISK
Reputation risk is the risk arising from negative public opinion. Activities that result in dissatisfied consumers and/or negative publicity could harm the reputation and standing of the financial institution, even if the financial institution has not violated any law. Privacy and transparency issues, as well as other consumer protection concerns, arise in social media environments. Therefore, a financial institution engaged in social media activities is expected to be sensitive to, and properly manage, the reputation risks that arise from those activities. Reputation risk can arise in areas including the following:
A. Fraud and Brand Identity
Financial institutions should be aware that protecting their brand identity in a social media context can be challenging. Risk may arise in many ways, such as through comments made by social media users, spoofs of institution communications, and activities in which fraudsters masquerade as the institution. Financial institutions should consider the use of social media monitoring tools and techniques to identify heightened risk, and respond appropriately. Financial institutions should have appropriate policies in place to monitor and address in a timely manner the fraudulent use of the financial institution’s brand, such as through phishing or spoofing attacks.
B. Third Party Concerns
Working with third parties to provide social media services can expose financial institutions to substantial reputation risk. A financial institution should regularly monitor the information it places on social media sites. This monitoring is the direct responsibility of the financial institution, as part of a sound compliance management system, even when such functions may be delegated to third parties. Even if a social media site is owned and maintained by a third party, consumers using the financial institution’s part of that site may blame the financial institution for problems that occur on that site, such as uses of their personal information they did not expect or changes to policies that are unclear. The financial institution’s ability to control content on a site owned or administered by a third party and to change policies regarding information provided through the site may vary depending on the particular site and the contractual arrangement with the third party. A financial institution should thus weigh these issues against the benefits of using a third party to conduct social media activities. A financial institution should conduct an evaluation and perform due diligence appropriate to the risks posed by the prospective service provider prior to engaging with the provider. To understand the risks that may arise from a relationship with a given third party, the institution should be aware of matters such as the third party’s reputation in the marketplace; the third party’s policies, including policies on collection and handling of consumer information, including the information of the institution’s customers; the process and frequency by which the third party’s policies may change; and what, if any, control the institution may have over the third party’s policies or actions.
C. Privacy Concerns
Even when a financial institution complies with applicable privacy laws in its social media activities, it should consider the potential reaction by the public to any use of consumer information via social media. The financial institution should have procedures to address risks from occurrences such as members of the public posting confidential or sensitive information —for example, account numbers — on the financial institution's social media page or site.
D. Consumer Complaints and Inquiries
Although a financial institution can take advantage of the public nature of social media to address customer complaints and questions, reputation risks exist when the financial institution does not address consumer questions or complaints in a timely or appropriate manner. Further, the participatory nature of social media can expose a financial institution to reputation risks that may arise when users post critical or inaccurate statements. Compliance risk can also arise when a customer uses social media to communicate issues or concerns directly with a financial institution, such as an error dispute under Regulation E, a billing error under Regulation Z, or a direct dispute about information furnished to a consumer reporting agency under FCRA and its implementing regulations. The Guidance does not require financial institutions to monitor and respond to all Internet communications; however, a financial institution is expected to take into account the results of its own risk assessments in determining the appropriate approach to take regarding monitoring of, and responding to, such communications. Appropriate steps may include, for example, establishing one or more specific channels consumers must use when submitting complaints or disputes directly to the institution for further investigation, to the extent consistent with other applicable legal requirements. However, the institution should also consider the risks, particularly the reputation risk, inherent in not responding to complaints and disputes received through other channels and tailor its policies and procedures accordingly, in a manner appropriate to the institution’s size and risk profile.
Based on its own risk assessment processes, a financial institution should also consider whether and how to respond to communications disparaging the financial institution on other parties’ social media sites. One approach to managing these risks would be to monitor question and complaint forums on social media sites to ensure that such inquiries, complaints, or comments are reviewed, and when appropriate, addressed in a timely manner.
E. Employee Use of Social Media Sites
Financial institutions should be aware that employees’ communications via social media may be viewed by the public as reflecting the financial institution’s official policies or may otherwise reflect poorly on the financial institution, depending on the form and content of the communications. Employee communications can also subject the financial institution to compliance risk, operational risk, as well as reputation risk. Therefore, as appropriate, financial institutions should take steps to address these risks, such as establishing policies and training to address employee participation in social media representing the financial institution. For example, if an employee is communicating with a customer regarding a loan product through an approved social media channel, policies should include steps to ensure the customer is receiving all of the required disclosures. The Guidance does not address any employment law principles that may be relevant to employee use of social media. In addition, the Guidance is not intended to impose any specific requirements for policies or procedures regarding employee personal use of social media. Each financial institution should evaluate the risks for itself and determine appropriate policies to adopt in light of those risks.
VI. OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed processes, people, or systems. The root cause can be either internal or external events. Operational risk includes the risks posed by a financial institution’s use of information technology (IT), which encompasses social media.
The identification, monitoring, and management of IT-related risks are addressed in the FFIEC Information Technology Examination Handbook, as well as other supervisory guidance issued by the FFIEC or individual agencies. A financial institution should pay particular attention to the booklets “Outsourcing Technology Services” and “Information Security” when using social media, and include social media in existing risk assessment and management programs.
Social media is one of several platforms vulnerable to account takeover and the distribution of malware. A financial institution should ensure that the controls it implements to protect its systems and safeguard customer information from malicious software adequately address social media usage. Financial institutions’ incident response protocol regarding a security event, such as a data breach or account takeover, should include social media, as appropriate.