Website Compliance Checklist

Chris Collver
July 28, 2009 | COMMENTS

Question: What laws and regulations do we need to follow regarding our credit union website?

The short, smart-alecky answer is, “All of them.” The longer, more polite answer is that all applicable laws and regulations must be followed whether your member is visiting your credit union's branch or your credit union's website. While there may be some additional, unique compliance issues regarding websites, for the most part, website compliance is just a matter of following the laws and regulations you also follow “offline.”

The following checklist will get you started on the key issues to consider when developing your own website compliance checklist. Please keep in mind this checklist is provided as an overview of these issues. It's important that your credit union staff, vendors, counsel, etc., have in-depth knowledge of these areas.

Use of Logos and Pictures

• Do any pages have materials with copyrights, trademarks, or service marks (including photos or drawings)? Make sure you have appropriate approvals to use or link to these materials.
• Is the NCUA advertising statement—or its short version, accompanied by the NCUA logo—on all pages advertising deposit account products? (§740.5 of NCUA Rules and Regulations)
• Is the Equal Housing logo on all pages advertising real estate-related loans?
• Are there pictures or drawings of human images? Look at the entire site for the possibility of encouraging some types of applications and discouraging others on any prohibited basis (§701.31 of NCUA Rules and Regulations and §202.5 of Regulation B)

Disclosures and Notices

• Is your privacy notice conspicuous and easy to find? Does it match the board-approved notice/policy?
• Review any pages offering loan products to ensure compliance with Regulation Z requirements. Be on the lookout for the use of any trigger terms that require the need for additional disclosures (e.g., any reference to a loan term on a closed-end loan triggers the requirement to include the terms of repayment). Also, make sure any related disclosures are noticeable, either by including them on the same screen, or providing a clearly marked link to them (§226.16 and §226.24 of Regulation Z).
• Review any pages promoting deposit accounts to ensure compliance with Truth-in-Savings requirements. Pay particular attention to triggering terms, as well as use of the word “free.” (§707.8 of NCUA Rules and Regulations)
• Be sure your site advertises terms that will actually be available, especially when rates are increasing or decreasing.
• Does your site have a separate children's area? The portion of your website that collects information from children under 13 must be compliant with the Children's Online Privacy Protection Act (COPPA).
• Are non-deposit investment products advertised? If so, make sure the disclosures required by NCUA Letter to Credit Unions No. 150 are followed.
• Are other disclosures presented in a clear and conspicuous manner?

General

• Are there links to third parties? If so, do the links imply endorsement of third-party products or services? Have you reviewed the security and privacy policies of the linked third parties?
• Do calculators and links operate accurately?
• Has all information been through an advertising clearance process (review) before posting?

Keep in mind, if your credit union has a transactional website (e.g., home banking, online applications, remote deposit capture), a whole new compliance can of worms is opened, such as Bank Secrecy Act (e.g., Member Identification Program, Suspicious Activity Reports), OFAC, rules regarding accepting applications, delivery of account or loan disclosures, compliance with E-Sign provisions, and providing check hold notices.

Chris Collver is a legislative and regulatory analyst with the California and Nevada Credit Union Leagues This article was reprinted with permission from Credit Union Digest, the publication of the California and Nevada Credit Union Leagues.