use this link to access the blog

http://shrinkster.com/10ik

Sent to you by pakurilecz via Google Reader: Bank Retention of
Electronic Mail Archives via Hack-igations by Ben Wright on 7/22/08 OCC
and FDIC Regulation and GuidanceFinancial Institution Audit
ProceduresWhat do regulations say about a bank retaining e-mail
records? Relevant statements have been issued by both the Office of the
Comptroller of the Currency (OCC) (regulator for all national banks in
the U.S.) and The Federal Deposit Insurance Corporaiton (FDIC).

The OCC issued an Advisor Letter on Electronic Record Retention June
21, 2004. The Advisory Letter points to the Electronic Signatures in
Global and National Commerce Act (E-Sign) as special reason for
financial institutions to set up electronic record keeping systems. The
E-Sign Act generally confirms the legal effectiveness of electronic
commerce transactions, including e-mail contracts. The implication for
banks is that their electronic records, such as e-mail records, can be
evidence of legally-binding contracts and other transactions.
Accordingly, the OCC Advisory Letter states:

"[B]anks should design, implement, and operate their electronic records
systems so that they are adequate to serve the following purposes and
functions according to the nature of the retained records:

* Potential use in litigation support,

* Internal and external audits and controls,

* Bank supervision, and

* Compliance with regulatory requirements."

Notice those are broad purposes, which suggests that the retention of
e-records should be generous at a time when the quantity and importance
of electronic transaction is growing. The Advisory Letter goes on
specifically to emphasize the retention of electronic message and
electronic mail records.

Consistent with the OCC Advisory Letter, FDIC has issued guidance on
the retention of electronic records under the E-Sign Act. See FDIC
Compliance Handbook — June 2006, page X-3.1. Although the FDIC Handbook
does not provide as much detail as the OCC Advisory Letter, it says
banks need good records of their electronic business transactions.
Naturally, those records will include e-mail records, as the OCC
Advisory Letter confirms.

The FCIC Handbook page X-3.1 states: "Record Retention. The E-Sign Act
requires a financial institution to maintain electronic records
accurately reflecting the information contained in applicable
contracts, notices or disclosures and that they remain accessible to
all persons who are legally entitled to access for the period required
by law in a form that is capable of being accurately reproduced for
later reference."

Further, the FDIC's 1998 Electronic Banking Safety and Soundness
Examination Procedures specifically discuss record retention procedures
for e-mail at page 8. Page 8 says bank examiners should expect banks to
have retention policies for e-mail. It reads: "Determine if retention
guidelines exist and are updated for source documents supporting
electronic activities, such as account applications, instructions for
account transactions, and other records. Determine whether the
guidelines also address electronic mail, data files, and similar
records." The implication is that if a bank does not have a retention
policy, and FDIC examiner will expect the bank to create one.

I prepared the above research in response to an inquiry from Anita
Bhuptani, VP of Business Development Corporate & Healthcare at
Messaging Architects. Anita made the inquiry as she helped a
prospective customer understand the landscape on e-records.

–Benjamin Wright

[The above is only general information. If a bank needs legal advice,
it should of course consult its lawyers.]
Things you can do from here:
- Subscribe to Hack-igations using Google Reader
- Get started using Google Reader to easily keep up with all your
favorite sites 

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]