CUSTOMER PROTECTION POLICY FOR LIMITING LIABILITY OF CUSTOMERS IN UNAUTHORISED ELECTRONIC BANKING

Transcription

1 CUSTOMER PROTECTION POLICY FOR LIMITING LIABILITY OF CUSTOMERS IN UNAUTHORISED ELECTRONIC BANKING February, 2018

2 Contents 1. Introduction: Background and Reference: Types of Electronic Banking Transactions: Strengthening of systems and procedures Reporting of unauthorised transactions by customers: Limited Liability of a Customer: Vide aforementioned RBI Circular RBI/ /15 DBR.No.Leg.BC.78/ / dated July 6, 2017, the customer shall be entitled to Zero Liability and Limited Liability under the conditions mentioned below: i. Zero Liability of a Customer... 4 ii. Limited Liability of a Customer... 5 iii. Limited Liability of a Customer (Delay in Reporting beyond Seven Days) Reversal Timeline for Zero Liability/ Limited Liability of customer: Burden of Proof: Reporting and Monitoring Requirements: Approval and Review of the Policy: Annexure I... 9 Page 2 of 9

3 1. Introduction: Utkarsh Small Finance Bank Limited (USFB) is a wholly owned subsidiary promoted by Utkarsh Micro Finance Limited. It aims to provide affordable & accessible banking services which are process centric, technology enabled and people oriented resulting in a reliable, scalable and sustainable institution, facilitating socioeconomic change. The purpose is to provide banking products and services to the unserved and underserved sections of the society, which includes small and marginal farmers, micro and small industries, and other organized sector entities, at an affordable cost. The vision of the Utkarsh Small Finance Bank is to be the trusted financial service provider to over 10 million customers by Background and Reference: RBI has issued circular RBI/ /15 DBR.No.Leg.BC.78/ / dated July 6, 2017 on Customer Protection Limiting Liability of Customers in Unauthorised Electronic Banking Transactions. The instructions contained in this circular supersede some of the instructions contained in RBI Master Circular DBR.No.FSD.BC.18/ / dated July 1, 2015 on Credit Card, Debit Card and Rupee Denominated Co-branded Pre-paid Card Operations of Banks and Credit card issuing NBFCs. With the increased thrust on financial inclusion and customer protection and considering the recent surge in customer grievances relating to unauthorised transactions resulting in debits to their accounts/ cards, the criteria for determining the customer liability in these circumstances have been reviewed by RBI. The revised directions in this regard are set out below. 3. Types of Electronic Banking Transactions: Broadly, the electronic banking transactions can be divided into two categories i. Remote/ online payment transactions (transactions that do not require physical payment instruments to be presented at the point of transactions e.g. internet banking, mobile banking, card not present (CNP) transactions), Pre-paid Payment Instruments (PPI), and ii. Face-to-face/ proximity payment transactions (transactions which require the physical payment instrument such as a card or mobile phone to be present at the point of transaction e.g. ATM, POS, etc.) 4. Strengthening of systems and procedures The systems and procedures in the Bank shall be designed to make customers feel safe about carrying out electronic banking transactions. In order to ensure this, the Bank shall put in place the following:- i. appropriate systems and procedures to ensure safety and security of electronic banking transactions carried out by customers ii. robust and dynamic fraud detection and prevention mechanism iii. mechanism to assess the risks (for example, gaps in the bank existing systems) resulting from unauthorised transactions and measure the liabilities arising out of such events iv. appropriate measures to mitigate the risks and protect themselves against the liabilities arising therefrom; and Page 3 of 9

4 v. a system of continually and repeatedly advising customers on how to protect themselves from electronic banking and payments related fraud. 5. Reporting of unauthorised transactions by customers: i. The Bank will ask their customers to mandatorily register for SMS alerts and wherever available register for alerts, for electronic banking transactions. The SMS alerts shall mandatorily be sent to the customers, while alerts would be sent, wherever registered. Bank will maintain all the SMS logs for the messages sent to the customers, with date and time of delivery details. The Bank will offer Electronic Banking services only to those customers who provide their mobile numbers to the bank. ii. The customers will be advised to notify the Bank of any unauthorised electronic banking transaction at the earliest after the occurrence of such transaction, and informed that the longer the time taken to notify the Bank, the higher will be the risk of loss to the Bank/ customers. To facilitate this, the Bank will provide customers with 24x7 access through multiple channels (at a minimum, via website, SMS, , IVR, a dedicated toll-free helpline, reporting to home branch, etc.) for reporting unauthorised transactions that have taken place and/ or loss or theft of payment instrument such as card, etc. iii. Bank will ensure that immediate response (including auto response) is sent to the customers acknowledging the complaint along with the registered complaint number. The communication system used by the Bank to send alerts and receive their responses thereto will record the time and date of delivery of the message and receipt of customer s response, if any, to them. This shall be important in determining the extent of a customer s liability. Bank will maintain logs of all the transactional messages delivered to customers along with date and time of the delivery, which would be treated as proof of delivery of such messages for all such transactions. On receipt of report of any unauthorised transaction from the customer, Bank will take immediate steps to prevent further unauthorised transactions in the account. 6. Limited Liability of a Customer:- Vide aforementioned RBI Circular RBI/ /15 DBR.No.Leg.BC.78/ / dated July 6, 2017, the customer shall be entitled to Zero Liability and Limited Liability under the conditions mentioned below:- i. Zero Liability of a Customer Customer entitlement to zero liability may arise where the unauthorised transaction occurs in the following events: a) Contributory fraud/ negligence/ deficiency on the part of the Bank (irrespective of whether or not the transaction is reported by the customer). b) Third party breach where the deficiency lies neither with the Bank nor with the customer but lies elsewhere in the system, and the customer notifies the Bank within three working days of receiving the communication from the Bank regarding the unauthorised transaction. Page 4 of 9

5 ii. Limited Liability of a Customer Customer may be liable for the loss occurring due to unauthorised transactions in the following cases: a) In cases where the loss is due to negligence by a customer, such as where he has shared the payment credentials, the customer will bear the entire loss until he reports the unauthorised transaction to the Bank. Any loss occurring after the reporting of the unauthorised transaction shall be borne by the Bank. b) In cases where the responsibility for the unauthorised electronic banking transaction lies neither with the Bank nor with the customer, but lies elsewhere in the system and when there is a delay (of four to seven working days after receiving the communication from the Bank) on the part of the customer in notifying the Bank of such a transaction, the per transaction liability of the customer shall be limited to the transaction value or the amount mentioned in Table 1, whichever is lower Table 1 Maximum Liability of a Customer under paragraph 6 - ii (b) Type of Account Maximum Liability ( in ) BSBD Accounts ,000 All other SB accounts Pre-paid Payment Instruments and Gift Cards Current/ Cash Credit/ Overdraft Accounts of MSMEs Current Accounts/ Cash Credit/ Overdraft Accounts of Individuals with annual average balance (during 365 days preceding the incidence of fraud)/ limit up to Rs.25 lakh Credit cards with limit up to Rs.5 lakh All other Current/ Cash Credit/ Overdraft Accounts Credit cards with limit above Rs.5 lakh 25,000 iii. Limited Liability of a Customer (Delay in Reporting beyond Seven Days) Further, if the delay in reporting is beyond seven working days after receiving the communication from the Bank, the customer liability is to be determined as per the Bank s Board approved policy vide aforementioned RBI Circular RBI/ /15 DBR.No.Leg.BC.78/ / dated July 6, 2017, which is mentioned below:- a) In cases where the responsibility for the unauthorised electronic banking transaction lies neither with the Bank nor with the customer, but lies elsewhere in the system and when there is a delay (beyond seven working days and upto fourteen working days after receiving the communication from the Bank) on the part of the customer in notifying the Bank of such a transaction, the per transaction liability of the customer Page 5 of 9

6 shall be limited to the transaction value or the amount mentioned in Table 2, whichever is lower Table 2 Maximum Liability of a Customer under paragraph 6 - iii (a) Type of Account Maximum Liability ( in ) BSBD Accounts 10,000 25,000 All other SB accounts Pre-paid Payment Instruments and Gift Cards Current/ Cash Credit/ Overdraft Accounts of MSMEs Current Accounts/ Cash Credit/ Overdraft Accounts of Individuals with annual average balance (during 365 days preceding the incidence of fraud)/ limit up to Rs.25 lakh Credit cards with limit up to Rs.5 lakh All other Current/ Cash Credit/ Overdraft Accounts Credit cards with limit above Rs.5 lakh 50,000 b) In cases where the responsibility for the unauthorised electronic banking transaction lies neither with the Bank nor with the customer, but lies elsewhere in the system and when there is a delay beyond fourteen working days after receiving the communication from the Bank, the customer liability shall be full. The Bank will display the details of the policy in regard to customers liability in public domain for wider dissemination. The existing customers will also be individually informed about the Bank s policy. Overall liability of the customer in third party breaches, as detailed in paragraph 6 i (b), paragraph 6 ii (b) and paragraph 6 iii (a) & (b) above, where the deficiency lies neither with the Bank nor with the customer but lies elsewhere in the system, is summarised in the Table 3 Table 3 Summary of Customer s Liability Time taken to report the fraudulent transaction from the date of receiving the communication Within 3 working days Within 4 to 7 working days Beyond 7 to 14 working days Beyond 14 working days Customer s Liability ( in ) Zero liability The transaction value or the amount mentioned in Table 1, whichever is lower The transaction value or the amount mentioned in Table 2, whichever is lower Full Liability Page 6 of 9

7 The number of working days mentioned in Table 3 shall be counted as per the working schedule of the home branch of the customer excluding the date of receiving the communication. In order to mitigate the risk arising out of unauthorised electronic banking transactions, in cases of ATM, Ecom and POS related transactions, the Bank has bought insurance from New India Assurance Company Ltd. The coverage available is mentioned in Annexure I. In addition, the Bank may explore to take Cyber Risk Insurance Policy as per the extant guidelines and after due risk assessment of the Bank. 7. Reversal Timeline for Zero Liability/ Limited Liability of customer: On being notified by the customer, the Bank will credit (shadow reversal) the amount involved in the unauthorised electronic transaction to the customer s account within 10 working days from the date of such notification by the customer (without waiting for settlement of insurance claim, if any). The credit shall be value dated to be as of the date of the unauthorised transaction. Further, Bank will ensure that a) a complaint is resolved and liability of the customer, if any, established within 90 days from the date of receipt of the complaint, and the customer is compensated as per provisions of paragraphs 6 i (b), paragraph 6 ii (b), and paragraph 6 iii (a) & (b) and paragraph 7. b) where it is unable to resolve the complaint or determine the customer liability, if any, within 90 days, the compensation as prescribed in paragraphs 6 i (b), paragraph 6 ii (b), paragraph 6 iii (a) & (b) and paragraph 7 is paid to the customer; and c) in case of Debit Card/ Bank account, the customer does not suffer loss of interest, and in case of credit card, the customer does not bear any additional burden of interest. 8. Burden of Proof: The onus of proving customer s liability in case of unauthorised electronic banking transactions will lie with the Bank 9. Reporting and Monitoring Requirements: Bank will put in place a suitable mechanism and structure for reporting of the customer liability cases to the Board through its Customer Service Committee. The reporting will, inter alia, include volume/ number of cases, the aggregate value involved and distribution across various categories of cases viz., card present transactions, card not present transactions, internet banking, mobile banking, ATM transactions, etc. The Standing Committee on Customer Service of the Bank will periodically review the unauthorised electronic banking transactions reported by customers or otherwise, as also the action taken thereon, the functioning of the grievance redress mechanism and take appropriate measures to improve the systems and procedures. All such transactions shall be reviewed by the Bank s internal auditors. Page 7 of 9

8 10. Approval and Review of the Policy: This policy would be reviewed annually taking into account the various amendments to guidelines and regulations (if any), Business models and would be placed to Board for their approval. Page 8 of 9

9 11. Annexure I Sum Assured Debit Card Insurance Coverage Classic Cards: Rs 50000/- per card Platinum Cards : Rs 1,00,000/- per card Undernoted unauthorized transactions/ withdrawals would be covered under the insurance: Unauthorized withdrawals/transactions due to: Skimmed cards Cloned cards Counterfeit cards Payments made on mirror sites Phishing (Mails only) POS terminal purchases ATM withdrawals (skimmed or cloned cards only) ATM withdrawals / POS transactions on Lost / Stolen cards Non-pin based transactions on Lost / Stolen cards Cards under Pradhan Mantri Jan Dhan Yojna Pre-delivery frauds Scope of cover ( 24hrs i.e. at any point of time) Territory (world- wide coverage) Second factor authorisation breach cover Coverage does not include :- Losses from family members / relatives / known persons Losses due to war, invasion, act of foreign enemy, hostilities or warlike operations (whether war has been declared or not), civil war, rebellion, revolution, insurrection, civil commotion, uprising, military or usurped power, martial law, terrorism, riot or the act of any lawfully constituted authority or vandalism of any kind Cover for Add on cards Conditions / Reporting Timelines for the coverage Pre-reporting timeline (7 days) Insurance covers the fraud happened within 7 days prior to the date of reporting of the transaction. Post-reporting timeline (7 days) - Insurance also covers the fraud happened after 7 days of reporting from the date of the transaction. Quarterly declarations Bank shall be providing quarterly declaration for the card issued to the Insurance Company. Rupay Debit Card Domestic BINs will be covered by the Insurance Company. Above transaction are on un- aggregated cover, which means each card will have individual cover as per prescribed limit of the type of card. No Deductibles There will be NIL deduction at the time of claim up to the cover limit. Intimation of Claim within 30 days from date of loss / blocking by the insured. Claim Submission to NIA. Corporate office to be within a period of 60 days from date of blocking. For skimming / phishing / counterfeit card / internet banking extensions - reporting to Bank within 60 days from the statement/billing cycle date Page 9 of 9