Banking Law

Contracts between banks and their technology service providers need to be carefully reviewed by competent legal counsel, as well as by knowledgeable bank employees. Why? Well, it should be sufficient to state that regulatory agency guidelines advise banks that contractual review be taken seriously, as a matter of basic safety and soundness, and that certain laws require that certain contracts with certain vendors comply with certain legal requirements (such as the privacy and security requirements of the Gramm-Leach-Bliley Act). Apparently, those basic standards haven't made much of an impression on some banks, at least not if my most recent experience in reviewing and negotiating a software license and technology services agreement for a large commercial bank is any indication.

The vendor was providing services of an important nature to the bank, in the course of which the vendor would have access to sensitive information of the bank and its customers, including "nonpublic personal information" of consumers. In the course of my review, I found a number of provisions that imposed what should have been to any commercial bank unacceptable risk-shifting from the service provider to the bank, and several provisions that did not meet the requirements of applicable law or regulatory guidelines. In the course of performing due diligence on the vendor, the bank officer in charge of the project contacted in excess of five other banks that had been referred to my client by the vendor and that were using the software and services, and asked them what positions they had taken on several of the contractual issues. Every one of the contact persons at the other banks told my client's officer that they had signed the contract without a legal review and without requesting any changes, inasmuch as they assumed it was all "boilerplate" contract language.

As might be expected, the vendor was surprised by our requested changes, since other banks had apparently merely signed the contract "as is." However, after explaining the basis for our requests, and with a minimal amount of back-and-forth, we negotiated a mutually acceptable contract. Neither side looked at the process as a "zero sum game," and we tried to understand each party's legitimate business and legal concerns and to accommodate them, if possible, or at least try to reach a reasonable compromise. This necessary process was not complicated or time consuming, although it certainly took more time than merely signing a contract with no changes.

I'm not certain why the other banks did not have such a review performed. Unless the appropriate regulator uncovers that fact in the course of an examination, or a problem arises in the course of the relationship between the bank and the vendor that causes the bank to focus on the contractual provisions (especially the warranties, remedies, limitations of liability, and disclaimers), they'll all sit there fat, happy, and legally exposed.

Then again, there's always the chance that this sort of unfortunate event occurs.

Brett Rekola, owner of a small civil engineering and land surveying business in Webster, Mass., has never visited Cincinnati, and after his experience this month he's in no hurry.

Rekola said he and his wife, Karen, spent all day Dec. 3 and half of Dec. 4 trying to get someone at Cincinnati-based Fifth Third Bank to correct a mistake made by a bank vendor. That mistake left them with a badly damaged credit score, unable to get a student loan for their son's college tuition and complete a pending mortgage refinancing.

[...]

Fifth Third admits the error, which affects "several thousand" people, the exact number of which it hasn't disclosed. It blames the mistake on Fiserv, an outsourced-services vendor it says was hired by Florida-based Crown Bank, which Fifth Third acquired last month.

The error "on the part of Crown's software vendor," said Fifth Third spokeswoman Debra DeCourcy, happened when Milwaukee-based Fiserv was trying to transmit active mortgage documents to the major credit agencies and mistakenly included documents related to paid-off mortgages.

A Fiserv spokeswoman said Dec. 6 that she was not aware of the problem.

Blissfully unaware, eh? Merry Christmas!

The paid-off mortgages were supposed to have been suppressed, but they were not. Once they were received by the credit bureaus, they were treated as delinquent from the time they'd been paid off, because there was no indication of any further payments having been made.

In the Rekolas' case, their latest credit report from Experian said they'd been more than 180 days delinquent on their mortgage for 25 months.

In fact, the loan they'd taken out with a Boston-area bank and which somehow ended up in Crown's portfolio was paid off in full in May 2005.

Luckily for the bank, it's unlikely to be sued by the borrowers, or, if sued, is not likely to lose the suit.

Steve Shane, a lawyer whose practice specializes in consumer credit matters, said under federal law a borrower can sue only if he or she first disputes the credit report error with the offending credit agency or agencies. The reporting creditor - in this case, either Crown (which owned the mortgages) or Fifth Third (which bought Crown) - is under no legal obligation until it receives notice from a credit agency, even if it receives a complaint from the borrower, Shane said.

"By law, you can't accomplish anything by sending it to the creditor. There's no obligation to correct it until they're contacted by the credit bureau," Shane said. "Every creditor gets a free bite of the apple until they're notified."

The bank, however, suffers a hit to its reputation from articles like this, and incurs substantial man hours of effort to implement a software fix, whether or not, in this specific instance of possible vendor negligence, any other damages are incurred by the bank.  I'll bet Fifth Third took a look at the contract between Crown Bank and Fiserv to see what exposure Fiserv might have had. While I have no personal knowledge of the terms of this Fiserv agreement, past personal experience in reviewing and negotiating contracts with Fiserv leads me to strongly suspect that Fiserv didn't leave itself exposed to much risk to Crown Bank. If Fifth Third had been the bank negotiating the contract, I'd strongly suspect that the risk allocation provisions of the agreement would be "balanced." Then again, I could be surprised.

I've previously discussed on this blog the problems banks have with the reluctance of many technology service providers to provide meaningful recourse to banks when the technology services contract is breached by the vendor or the vendor is negligent. I expanded upon the subject in an article published in the December 2005 issue of The Journal of Internet Law. Nevertheless, no bank, no matter how large or small, ought to enter into a technology services agreement with a vendor without understanding all of the provisions of the agreement, including the risk allocation provisions. The time to determine whether adequate contractual remedies are provided is not when a problem arises.