Overdraft Protection Programs: Risk Management Practices

Summary

The Office of the Comptroller of the Currency (OCC) is issuing this bulletin to banks¹ to address the risks associated with overdraft protection programs.² Overdraft protection programs can present a variety of risks, including compliance, operational, reputation, and credit risks.³ Specifically, this bulletin discusses certain practices that may present heightened risk of violating prohibitions against unfair or deceptive acts or practices.

The bulletin also describes practices that may assist banks with managing overdraft protection program risks. When supported by appropriate risk management practices, overdraft protection programs may assist some consumers in meeting short-term liquidity and cash-flow needs. The OCC recognizes that some banks have announced changes to their overdraft protection programs that may be consistent with appropriate risk management practices.

This bulletin’s focus is consistent with the OCC’s mission to ensure that banks operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations. This bulletin also furthers the OCC’s support for innovation by banks to meet the evolving needs of consumers, businesses, and communities.

Highlights

This bulletin

• provides background information on overdraft protection programs.
• addresses certain practices that may result in heightened risk exposure, including the risk of violating section 5 of the Federal Trade Commission (FTC) Act (Section 5), which prohibits unfair or deceptive acts or practices,⁴ and Section 1036 of the Consumer Financial Protection Act of 2010, which prohibits unfair, deceptive, or abusive acts or practices.⁵ These practices include
  • assessing overdraft fees on debit card transactions that are authorized when a consumer’s available account balance is positive but later post to the account when the available balance is negative, also referred to as “authorize positive, settle negative” (APSN).
  • assessing an additional fee each time a third party resubmits the same transaction for payment after a bank returns the transaction for non-sufficient funds (NSF) (referred to as “representment fees”).
• describes certain practices that may help to manage risks associated with overdraft protection programs, including
  • assisting consumers in avoiding unduly high costs in relation to the face value of the item being presented, the amount of their regular deposits, and their average account balances.
  • implementing fees and practices that bear a reasonable relationship to the risks and costs of providing overdraft protection program services.

Background

The OCC and other agencies set out safety and soundness considerations, legal risks, and best practices for overdraft protection programs in the “Joint Guidance on Overdraft Protection Programs” (2005 Guidance) conveyed by OCC Bulletin 2005-9, “Overdraft Protection Programs: Interagency Guidance.” The agencies issued the 2005 Guidance to address concerns raised by institutions, financial supervisors, and the public about the marketing, disclosure, and implementation of overdraft protection programs. Since 2005, the OCC has observed significant developments in the consumer banking landscape, such as

• changes in overdraft protection program-related legal requirements⁶ and consumer behavior, including the increased and more frequent use of overdrafts as, in effect, a form of short-term credit.
• overdraft protection programs resulting in consumers paying high costs relative to the face value of items being presented and to deposit amounts and average account balances.

The OCC continues to observe evolution in the consumer banking landscape, such as

• banks offering deposit accounts that do not allow overdrafts.
• banks offering deposit accounts with no fees for overdrafts.
• banks reducing the amount of overdraft fees in existing overdraft protection programs.
• ongoing efforts by banks and other stakeholders to identify opportunities for modifying existing overdraft protection programs in ways to manage the risks of such programs.

The OCC encourages banks to explore offering low-cost accounts, as well as other lower-cost alternatives for covering overdrafts, such as overdraft lines of credit and linked accounts. The OCC recognizes, however, that some consumers with short-term liquidity needs may benefit from the availability of funds from overdraft protection programs via deposit accounts.

Based on examinations of overdraft protection programs at a number of banks in recent years, the OCC has observed that certain overdraft protection program practices may present a heightened risk of violations of Section 5.⁷ These include practices known as APSN and representment fees.⁸

Authorize Positive, Settle Negative Fee Practices

Banks generally maintain a “ledger balance” and an “available balance” on customer deposit accounts for numerous purposes, including assessing overdraft fees. The ledger balance refers to the actual amount of funds in a customer’s deposit account after accounting for all items that have settled and posted. The available balance generally reflects the ledger balance minus “holds” for recently deposited funds that have not yet cleared and for authorized but pending debit card transactions. Some banks assess overdraft fees on debit card transactions that authorize when a customer’s available balance is positive but that later post to the account when the available balance is negative.

In this scenario, a customer’s account has a sufficient available balance to cover a debit card transaction when the transaction is authorized but, due to one or more intervening transactions, has an insufficient available balance to cover the transaction at the time it settles.⁹ This is commonly referred to as an APSN transaction. In addition to assessing an overdraft fee on the APSN transaction, some banks also assess an overdraft fee on intervening transactions that exceed the customer’s available balance. In this scenario, for example, the bank reduces a customer’s available balance by an amount that is more than, equal to, or less than the initial authorized debit card transaction, and subsequently, an intervening transaction further reduces the customer’s available balance so that the account no longer has a sufficient available balance. The bank charges an overdraft fee on both the intervening transaction and the initial APSN transaction when posted to the customer’s account.¹⁰

The OCC has reviewed a number of overdraft protection programs that assess overdraft fees on APSN transactions. In some instances, the OCC has found account materials to be deceptive, for purposes of Section 5, with respect to the banks’ overdraft fee practices.¹¹ In these instances, misleading disclosures contributed to findings that the APSN practice was also unfair for purposes of Section 5. In addition, and based on subsequent analysis, even when disclosures described the circumstances under which consumers may incur overdraft fees, the OCC has found that overdraft fees charged for APSN transactions are unfair for purposes of Section 5 because consumers were still unlikely to be able to reasonably avoid injury and the facts met the other factors for establishing unfairness.¹²

The OCC recognizes that compliance risk may exist when banks assess overdraft fees based on either a negative ledger balance or negative available balance for APSN transactions.¹³

Representment Fee Practices

When a bank receives a check or automated clearing house (ACH) transaction that is presented for payment from a customer’s deposit account, and the account has insufficient funds to pay the check or ACH transaction, the bank may decline to pay the transaction and charge the customer an NSF fee. If the same check or ACH transaction is presented to the bank again and the customer’s account still has insufficient funds, some banks will either again return the transaction unpaid and assess an additional NSF fee or pay the transaction and assess an overdraft fee. This practice of charging an additional fee each time a single transaction (e.g., ACH transaction or check) is presented for payment by a third party without further action by the customer contributes to customer costs in circumstances in which those customers cannot reasonably avoid the additional charges.¹⁴ Through ongoing supervision, the OCC has identified concerns with a bank’s assessment of an additional fee on a representment transaction, resulting in findings in some instances that the practice was unfair and deceptive. Disclosures may be deceptive, for purposes of Section 5, if they do not clearly explain that multiple or additional fees (NSF or overdraft) may result from multiple presentments of the same transaction. Even when customer disclosures explain that a single check or ACH transaction may result in more than one fee, a bank’s practice of assessing fees on each representment may also be unfair, for purposes of Section 5, if consumers cannot reasonably avoid the harm and the other factors for establishing unfairness under Section 5 are met. Consumers typically have no control over when a returned ACH transaction or check will be presented again and lack knowledge of whether an intervening deposit will be sufficient to cover the transaction and related fees.

Additional Practices That May Present Heightened Risk

• High limits or lack of daily limits on the number of fees assessed: In the OCC’s supervisory experience, charging overdraft or NSF fees with a high limit (or without limit) for multiple transactions in a single day has contributed to determinations that banks’ overdraft protection programs as a whole were unfair for purposes of Section 5 because the lack of limits results in high costs for consumers and difficulty in bringing accounts positive.
• Sustained overdraft fees: In the OCC’s supervisory experience, charging a fixed, periodic fee for failure to cure a previous overdrawn balance has contributed to findings of unfairness and deception, for purposes of Section 5, especially when the bank does not accurately disclose the circumstances under which the customer could incur these fees. These practices make it more difficult for customers facing liquidity challenges to reasonably avoid these fees by bringing their account balances positive.

Risk Management Practices

A bank’s risk management systems should be commensurate with the bank’s size, complexity, and risk profile. Therefore, as part of sound risk management of overdraft protection programs, the OCC encourages a bank to assess and analyze the risks posed by the bank’s overdraft protection program activities; adjust the bank’s risk management practices; and incorporate oversight of overdraft protection programs into the bank’s compliance management system. An effective compliance management system typically should include processes and practices designed to manage compliance risk, ensure compliance with applicable laws and regulations, and prevent consumer harm.¹⁵

Board and Management Oversight

A bank’s board of directors has ultimate responsibility for overseeing management’s implementation of a bank’s overdraft protection program. Effective board and management oversight generally includes

• setting and confirming the bank’s strategic approach and risk appetite for offering overdraft protection programs.
• providing guidance to senior management.
• ensuring that the bank has an effective change management process.
• performing ongoing monitoring to self-identify and self-correct weaknesses.
• monitoring the program’s performance and measures relative to the bank’s objectives and risk appetite.
• periodically reviewing information on a bank’s overdraft protection program, including an assessment of customer impacts and overdraft product analyses to confirm that these services are fair and transparent.
• ensuring proper and accurate customer disclosures.

Bank management is responsible for developing, implementing, and effectively managing overdraft protection programs in line with the board’s direction, the bank’s objectives, and the bank’s risk appetite, and in compliance with all applicable laws and regulations. Sound risk management generally should include appropriate policies, processes, personnel, and control systems that focus on consumer protection requirements and consider customer outcomes.¹⁶

New Activities Processes and Third-Party Risk Management

Banks should have processes in place to manage the risks associated with offering new, modified, or expanded products or services (collectively, new activities), including new overdraft protection programs or changes to existing overdraft protection programs. Effective new activity development processes typically consider the financial attributes of consumers using the products, consumer disclosures, use of new technologies, use of alternative underwriting information, and use of third-party relationships. An effective risk management program should be in place if banks use third-party relationships as part of their overdraft protection programs.¹⁷ Third-party relationships include a bank’s arrangement with its service providers that often play a significant role in processing and reprocessing transactions, processing of payments, and providing systems that determine when overdraft or NSF fees are assessed.¹⁸

Policies, Processes, and Control Systems

A bank’s processes and control systems should align with established policies and incorporate appropriate procedures and practices for managing risks associated with overdraft protection programs. The following non-exhaustive list outlines examples of potentially appropriate risk management practices that banks may consider adopting:

• Eligibility: Overdraft limits and account agreement terms that are aligned with eligibility and underwriting criteria that promote fair treatment and fair access. Product structures, including short-term single payment structures, support consumer affordability and successful repayment of negative account balances in a reasonable time frame rather than reliance on regular or repeated reborrowing.
• Opt-in status: Policies and procedures that fully comply with the requirements of 12 CFR 1005.17 for one-time debit card and automated teller machine transactions. Policies and procedures should address compliance with these requirements. For other types of transactions (e.g., paper checks and recurring ACH or debit card transactions), consumers are provided the opportunity to affirmatively opt in to and opt out of overdraft protection at any time.¹⁹
• Consumer disclosures: Disclosures that effectively convey policies and practices related to accounts and products offered to consumers via transparent, understandable, and timely communication of account features. These disclosures support informed decision making with regard to overdraft protection programs and their related costs. Banks periodically test operating system settings and parameters to determine whether transaction postings are aligned to disclosures.
• Overdraft protection product analysis: A process for reviewing data and analyzing whether overall overdraft protection program revenues are reasonably related to the product risks and costs, as appropriate, at the portfolio, account, and transaction levels. Such analyses can also inform (1) modifications to overdraft protection programs intended to support a bank’s longer-term competitive position, consumer satisfaction levels, and customer retention activities; and (2) a bank’s evaluation of the effect of any implemented modifications.
• Periodic account analysis: Processes to periodically review accounts of customers who use overdraft protection programs on a regular basis. The objectives of this review are primarily to confirm that customers
  • are provided with readily accessible and understandable tools and information to assist in managing their finances.
  • are not routinely relying on overdraft protection programs.
  • receive fair treatment.
  • are not incurring disproportionate costs relative to the face value of the item being presented, the amount of their regular deposits, and their average account balances.
• Account monitoring: Periodic account analyses that result in appropriate changes to overdraft limits, eligibility for continued use, or recommendations to consumers for other appropriate deposit account services when overreliance, excessive costs, or options for more cost-effective credit usage are detected. Overdraft limits and any changes to overdraft limits are clearly and timely communicated to consumers.
• Grace amounts: Grace amounts, or de minimis exclusions from fees that are based on transaction size or the magnitude of the overdrawn balance, are meaningful and periodically reviewed.
• Grace periods: Grace periods that provide additional time before the assessment of fees sufficient for customers to address a potential or actual negative account balance through an additional deposit or transfer of funds.
• Online access and timely automated alerts: Processes to send consumers accurate information in real or near real time through online account access or electronic alerts, such as text messages, online or web-based applications, or emails. In certain circumstances, these technologies may provide opportunities for customers to react to and address negative balances or items being presented for settlement to avoid fees.
• Single daily fee: Single daily fee assessments that are reasonably related to the costs of providing either overdraft protection or returned item for NSF services, offer effective transparency to customers, and eliminate confusion caused by item-posting order protocols or the use of available account balances.
• Timing of fee collection: A practice of collecting fees related to overdraft protection or NSF services from the next deposit only after all other appropriately presented items have posted or cleared to ensure that a greater amount of the consumers’ deposited funds is available for consumer use.
• Complaints management: Incorporating overdraft protection-related complaints into a bank’s complaint management and resolution processes,²⁰ which should be commensurate with the bank’s size, complexity, and risk profile. Processes should include steps to analyze complaint data and to detect and remediate concerns or problem areas, including potential unfair or deceptive acts or practices or unfair, deceptive, or abusive acts or practices.²¹

Corrective Action

The OCC encourages banks to have processes in place to identify and correct risk management weaknesses and violations of laws and regulations. OCC violation findings at specific banks related to overdraft protection programs have typically led to corrective action, including remediation to harmed consumers. The OCC encourages banks to review their overdraft protection programs and related practices to ensure that banks comply with Section 5 and other applicable laws and regulations and take corrective action as appropriate.

Further Information

Please contact Candace B. Matzenauer, Director for Consumer Compliance Policy, at (202) 649-5470, or Terence W. Culler, Director for Retail Credit Risk Policy, at (202) 649-6670.

Grovetta N. Gardineer
Senior Deputy Comptroller for Bank Supervision Policy