FOREWORD - Bank Electronic Funds Act - Rules and Regulations The Banking Board is authorized by the Bank Electronic Funds Act to issue Rules and Regulations necessary or incident to the provisions of the Act. Furthermore, the Act directs the Board to adopt regulations with respect to specific matters. The Bank Electronic Funds Act is a part of the Colorado Banking Code and the Board is empowered to implement by regulation any provision of the Code. The purpose of the regulations is to permit an orderly development of Electronic Funds Transfer Systems in the state for all banks domiciled within the state, to serve their customers more effectively and efficiently and for the market place to determine the growth and development of Electronic Funds Transfer Systems rather than by regulation. It is not the intention of the Board to issue unnecessary regulations which might well inhibit the development of EFT Systems or prevent them from achieving their maximum potential. The primary purpose of the regulations is to remove any potential legal barriers and to regulate only to prevent unwise ventures and injury to the public interest. No financial institution is authorized to offer or provide additional or new services or is granted powers by virtue of the regulations that were not previously permitted.

EFT1. Definitions A. “Account Holder” is defined in Section 11-101-401(1), C.R.S., to mean a person having an established demand, savings or loan account at a Colorado bank.

B. “Account Overline” is defined in Section 11-101-401(2), C.R.S., to mean a banking transaction pursuant to which an account holder debits his existing demand or savings account even though such debit may create or extend a negative balance to be covered by an extension of credit, or would create a negative balance but for an extension of credit to such account by the Colorado bank.

C. “Act” means the Bank Electronic Funds Act, which is Title 11, Article 105, Part 2, C.R.S., as amended.

D. “Bank of Account” means the bank in which an account holder has established a demand, savings or loan account.

E. “Banking Transactions” are defined in Section 11-101-401(9), to mean cash withdrawals, deposits, account transfers, payments from bank accounts, disbursements under a preauthorized credit agreement, and loan payments initiated by an account holder at a communications facility and accessing his account at a Colorado bank.

F. “Card” shall refer to the card, plate or other device issued to an account holder for use to engage in one or more banking transactions at a communications facility.

G. “Cardholder Agreement” shall refer to the written agreement between the card Issuer and the account holder specifying the terms of use of the card and repayment of obligations arising therefrom.

H. “Card Issuer” shall, with respect to any card, refer to the Colorado bank which issued the card to the account holder.

I. “Communications Facility” is defined in Section 11-101-401(18), C.R.S., to mean an attended or unattended electronic information processing device, other than an ordinary telephone instrument, located in this state separate and apart from a Colorado bank or detached facility and through which account holders and Colorado banks may engage in banking transactions by means of either the instant transmission (on-line) of electronic impulses to and from the Colorado bank or its data processing agent or the recording of electronic impulses or other indicia of a banking transaction for delayed transmission (off-line) to a Colorado bank or its data processing agent. Such a device located on the premises of a Colorado bank or its detached facility shall be a communications facility if such device is utilized by the account holders of other Colorado banks.

J. The person deemed to have “control” of a communications facility shall be:

1. The sole lessee thereof which may grant Colorado banks the right to use thereof by sublease or other arrangement, or 2. If there is no such person as described in Paragraph (J)(1) of this Rule, the person that has a greater than 50 percent ownership interest in the communications facility, or 3. If there is no such person as described in Paragraph (J)(1) or Paragraph (J)(2) of this Rule, the managing agent who shall be appointed by those persons having ownership interests in the communications facility.

K. “Organization” means a corporation, trust, estate, partnership, cooperative, association, government, or governmental subdivision, agency or instrumentality.

L. “Other Financial Institutions” means any savings and loan association, credit union or industrial bank located in Colorado.

M. “Person” is defined in Section. 2-4-401(8), C.R.S., to mean an individual, corporation, government or governmental subdivision or agency, business trust, estate, trust, partnership, or association, or any other legal entity. “Person” includes another bank.

N. “Unauthorized Use” means the use of a card by a person other than the account holder.

1. who does not have actual, implied or apparent authority for such use, and 2. from which the account holder receives no benefit.

EFT-3. Privacy, Communications Integrity and Financial' Safety 3.1 Colorado banks must maintain, with respect to communications facilities controlled by them or used by their account holders, insurance, which may include self-insurance, consistent with reasonable and prudent business practice.

3.2 A Colorado bank may not use an account holder's social security number as a means for authenticating the identity of the account holder.

3.3 A Colorado bank shall have the right to validate any banking transaction initiated at a communications facility within a reasonable time after the initiation.

3.4 Any bank that utilizes a communications facility which accepts and receipts deposits shall process or arrange for the processing of all deposits each banking day.

3.5 A Colorado bank may not provide information about an account holder that is secured solely for the operation of a communications facility to any agent of state or federal government or to any other person, except for a purpose that is germane to providing services to the account holder, authorized by the account holder in writing, authorized by statute or regulation, or specifically required by a valid court order or subpoena. Nothing contained herein shall be deemed to limit the ordinary usual transfer of information to consumer reporting agencies, to regulatory agencies, and for banking purposes.

3.6 No account balance, specific overline information, or similar specific dollar information concerning an account may be transmitted to a communications facility operator other than the account holder or a person authorized by the account holder.

3.7 Where a Colorado bank utilizes the services, communications facilities, or computer network systems of another person, a contract between the bank and the outside person must indicate that any information compiled by the outside person must be treated with the same degree of confidentiality as in the case of transactions handled entirely within the bank.

3.8 Account holders shall be provided the, name, address and telephone number of the Card Issuer or the Card Issuer's agent to be notified in the event of Card lose, statement error, or to report complaints.

3.9 Any bank which has, directly or through an agent, operational control over a communications facility shall maintain for two years sufficient records, and upon valid request furnish or arrange to be furnished a report thereof, to the bank of account of any person who has utilized the communications facility, of all banking transactions conducted at the communications facility affecting such person as may be reasonably necessary to provide an audit trail.

3.10 Any communications received through the authorized use of a communications facility from an account holder under the provisions of these Regulations requesting that deposit funds be paid to him, transferred for his benefit, or transferred to the account of a third party, shall constitute authority for payment by the Card Issuer or Bank of Account as if it were a paper transaction and may be treated by the Card Issuer or Bank of Account as a valid demand for payment. Any such communication received may be considered final and the Cam Issuer or Bank of Account cannot be compelled to retrace or void the transaction.

3.11 Where payment for goods or services is made through a communications facility, any rights that the account holder may have against his seller on any warranty, right to return goods, or to rescind the transaction will not be affected. Payments made for sales in this manner shall not deprive an account holder of any rights and protections now offered by existing law concerning a cash or credit sale by conventional means.

EFT5 On-Premises Facilities A. An electronic information processing device located on the premises of a Colorado bank or its detached facility which would be a communications facility as defined in Section 11-101-401(18), C.R.S., if it were located separate and apart from the bank or its detached facility is a communications facility within the meaning of the Colorado Banking Code only if it is utilized by account holders of other Colorado banks.

B. The conditions of authority stated in subparagraphs (a) and (b) of Section 11-105-203(1), C.R.S., are not applicable to a communications facility located on the premises of a Colorado bank or its detached facility, but the conditions of authority stated in subparagraph (c) of paragraph (1) are applicable to such a facility.

C. A Colorado bank having a communications facility located on its premises or the premises of its detached facility shall be considered as having “control” of such communications facility. Whether such communications facility is made available to another Colorado bank for the use of its account holders shall be in the sole discretion of the bank having control thereof and the Colorado Banking Code does not require that any such facility be made available to any Colorado bank.

EFT-6. Conditions for Bank Agreements with Retailers 6.1 No bank may make an agreement with a retailer at whose retail location a communications facility is to be located, established, or utilized unless the agreement is made upon commercially reasonable terms and conditions. While the terms and conditions must be “commercially reasonable” (not defined in the Act, but subject to judicial or administrative finding), the terms may vary among agreements with different contracting parties.

6.2 Such “commercially reasonable terms”, may be tailored to the individual contracting owner, operator or user bank, and the pricing terms may take into account differing costs to the retailer 6.3 Every agreement between a bank and a retailer concerning the establishment or use of an attended communications facility shall require that the operator of the facility, upon request, shall advise any account holder who identifies his bank whether the facility may be utilized by account holders of his bank.

EFT-8. Minimum Standard for Receipt or Record 8.1 The receipt or record of a banking transaction to be provided to an account holder at the time a communications facility is used shall contain the following information, which may be in symbols or code: the type of transaction, the date of the transaction, the dollar amount involved, the identity of the customer's account, and, for payment from bank accounts, identification of the third party payee, if any. If payment is made at an unattended communications facility, third party payee identification is not required on the receipt.

EFT9 Liability for Unauthorized Use A. An account holder whose card is lost or stolen shall be liable for unauthorized use of the card at a communications facility only if:

1. Such liability does not exceed the lesser of $50.00 or the amount of money, goods or services obtained by such use prior to notice to the card Issuer;

2. Provided, however, the account holder shall have no liability if such use occurs through no fault of the account holder.

B. Commencing January 1, 1978, card issuers must, at or prior to the time of issuing any new card or reissuing an existing card, notify their account holders:

1. Of the liability limitation provision of Section 11-105-208(2), C.R.S., and this Paragraph (A) of this Rule; or 2. That they have no liability for unauthorized use of their card at a communications facility. This Notice must be in writing but may be combined with the cardholder agreement, other notices required by state or federal law or regulation, or other communications with the account holder, so long as the notice is not obscured by the additional material.

C. Cardholder agreements entered into on or after January 1, 1978, may not specifically state or imply that the account holder may be liable for unauthorized use of the card at a communications facility, unless the limitations on such liability as prescribed by statute are fully set forth.

D. If the account holder allows another to use the card or to have access to the account holder's security code and that person then or subsequently uses the card in an unauthorized manner, such use shall be deemed to be an authorized use of the card. Such authorized use may be revoked by written notice to the card Issuer, which notice shall be effective as to transactions conducted after midnight on the next banking day following the banking day on which the card Issuer receives the written notice. This Paragraph shall not be deemed an all inclusive listing of what constitutes an authorized use.

E. For the purposes of Paragraph (A) of this Rule, an account holder notifies a card Issuer by taking such steps as may be reasonably required in the ordinary course of business to provide the card issuer with the pertinent information with respect to loss, theft, or possible unauthorized use of any card, whether or not any particular officer, employee, or agent of the card Issuer does, in fact, receive such notice or information. At the option of the account holder, notice may be given to the card issuer of its designee in person or by telephone, or by letter, telegram, radiogram, cablegram, or other written communication which sets forth the pertinent information. Notice by mail, telegram, radiogram, cablegram, or other written communication shall be considered given at the time of receipt or, whether or not received, at the expiration of the time ordinarily required for transmission, whichever is earlier.

F. If ten (10) or more cards are issued by one card issuer for use by the employees of a single business or other organization, nothing in this Rule or Section 11-105-208(2), C.R.S., prohibits the card issuer from agreeing by contract with such business or other organizations as to liability for unauthorized use of any such cards without regard to the provisions of this Rule or Section 11- 105-208(2), C.R.S., but in no case may any business or other organization or card issuer impose liability on any employee of such business or other organization with respect to unauthorized use of such card except in accordance with and subject to the other liability limitations of this Rule or Section 11-105-208(2), C.R.S.

EFT10 Continued Offering of Checking Accounts A. Colorado banks shall continue to offer their customers the right to use checking accounts and, while banks may charge for the use of checking accounts, they may not make charges which are for the intent of discouraging such use. Also, banks may inform their customers of the operational characteristics and convenience of carrying out banking transactions at a communications facility without being in violation of Section 11-105-208(4), C.R.S. EFT-11. Permissive Sharing Among, Dissimilar Institutions 11.1 A Colorado bank which controls a communications facility is authorized to make the use thereof available to savings and loan associations, credit unions and industrial banks located in this state and to their customers. The decision to share with dissimilar institutions, and the particular institutions which are to share, is discretionary with the controlling Colorado bank. If such use is permitted by the controlling bank, the contract establishing the terms and conditions shall be “fair and reasonable” to all contracting parties. Differentiation by a Colorado bank among various dissimilar institutions in contractual provisions with the intent or effect of denying use of a communications facility to any particular institutions on arbitrary or capricious grounds is subject to review by the Banking Board.

11.2 Any communications facility which is shared by a controlling Colorado bank with dissimilar institutions shall remain under the jurisdiction of the Banking Board subject to the Act and these rules and regulations. Other statutes, and rules and regulations pertinent to the sharing dissimilar institutions, which are not in conflict, may also apply.

11.3 For the purpose of this section, a Colorado bank shall be deemed to “control” a communications facility if it or its agent has operational control over the facility and its computer software. EFT-12. Operation by Bank Employees 12.1 Bank employees may not operate a communications facility located separate and apart from a Colorado bank or its detached facility for, or on behalf of, another account holder. A bank employee may use such facility to carry out his or her own banking transactions. A Colorado bank may station an employee or agent at any communications facility for the purpose of instructing existing or potential account holders in the use of the facility or for servicing or observing the operation of the facility.

EFT13 Liability of the Bank of Account A. The bank of account shall be liable for erroneous, unauthorized or fraudulent use of the EFT account unless the bank of account can demonstrate its own use of reasonable care and that the account holder's negligence or fraud substantially contributed to the erroneous, unauthorized, or fraudulent act. Account holder negligence exists if the bank of account can demonstrate, for example, that:

1. Account holder carelessness about the security of the personal identification code thereby permitted the transaction to occur;

2. The account holder, knowing that the card is lost or stolen or that the security of his personal identification code has been compromised, neglects to report the facts and to confirm the same in writing within a reasonable amount of time to the Card Issuer or its designee and the neglect causes the loss; or 3. Unreasonable account holder delay in reporting unauthorized transactions that appear in his statement permits further loss to occur.

B. The bank of account shall be liable for any direct monetary loss, but not for consequential losses, occurring as a result of any tampering, malfunction or manipulation of a communications facility unless the account holder authorizes or performs such acts. Guidelines for EFT-13 These guidelines or recommendations are not intended by the Banking Board to be statements of general applicability and future effect.

A. Use_of_the_Account. To promote account holder understanding of the banking system and of electronic fund transfer technology, the Colorado State Banking Board recommends that the following information be given by the card issuer or the bank of account to each account holder at the time an EFT card is issued, in addition to any other information by law or regulation:

1. The types of financial services available through the use of the account.

2. The schedule of charges made by the bank for maintaining the account, for the use of communications facilities, and for any other activity for which charges are made.

3. Any limitations on the number or monetary value of transactions permitted within any given period of time.

4. The expected schedule for sending periodic statements on the account.

5. The account holder's duty, pursuant to Section 11-105-106, C.R.S., to examine the statement of account, to report errors in the account to the bank of account and that the statement is conclusively presumed to be correct if no objection has been made within one year.

6. Notification that the receipt given for an electronic banking transaction should be retained by the customer just as a deposit receipt or cancelled check would be retained on a non- electronic transaction, and that the receipt may be the only document which has legal status to show that the transaction occurred.

B. Use_of_the_Facility. The Colorado State Banking Board also recommends that instructions regarding the proper use or operation of the facility be provided at each communications facility. EFT14 Fees [Sections 11-105-207 and 11-102-103(12), C.R.S.] A. The Banking Board shall collect the fees set forth by schedule, and such fees shall not be refundable.

1. The Banking Board shall set fees annually by publishing a schedule of fees for services as of July 1 of each year.

2. Such schedule shall list all services performed which are subject to a fee and the fee to be charged. In addition, the fee schedule shall list fees set by statute, if any.

3. Fees shall be remitted to the Division of Banking in the form of a cashier's check or similar instrument payable to the Colorado Division of Banking.

4. Any fee relating to examinations shall be paid within twenty (20) days after a statement of the amount thereof shall have been received by the institution.

5. All other fees shall be paid at the time the service is rendered. Services relating to statutory application or notice is deemed to be rendered at the time of filing application or notice.

B. In the event that the fees collected pursuant to the schedule are not sufficient to defray the costs of administering the Colorado Banking Code, the Banking Board may assess such additional fees as are necessary to so defray costs.