It’s All about the PIN: Fed Staff Interpretation of Reg. II Creates Precarious Limbo for Debit and Prepaid (April 2013)

Fed Staff Interpretation of Reg. II Creates Precarious Limbo for Debit and Prepaid

By Marilyn Bochicchio, CEO, and Brad Fauss, EVP and General Counsel, Brightwell Payments

It’s April 3, two days past the effective date for the Durbin Amendment exclusivity routing rules for prepaid. And, many prepaid (and, likely, debit) executives in the United States are wondering what just hit them and how they should fulfill their compliance obligations (while not disrupting the use and distribution of various prepaid products—including gift, loyalty and promotion, health care and employee benefits cards—and government benefits) in a very unusual regulatory environment.

What hit them was the Federal Reserve Board’s quiet release of Frequently Asked Questions (FAQs) regarding the final Durbin Regulations on March 13. FAQs, when issued by the Board staff, are generally received favorably because they clarify the staff’s thinking, often making complex rules easier to understand and aiding compliance efforts. The release of the March 13 FAQs had quite the opposite effect—throwing into doubt the usefulness of several years of preparation and untold millions of dollars spent on new prepaid packaging, processes, partnerships and legal bills to comply with what industry thought were the new rules regarding routing exclusivity under Reg. II, the Fed’s Final Rule implementing the Durbin Amendment.

Right now, many eyes are focused on the Fed, hoping it will provide clarification or relief before prepaid cards start disappearing from the landscape, leaving consumers, businesses and governments with fewer viable options to receive payments and transact business.

What Happened

The Fed staff actually issued six FAQs on March 13—five new and one revised—on Reg. II. The FAQ causing the most consternation is the one addressing network routing requirements (see sidebar). Reg. II requires all debit cards (including prepaid) to provide merchants with a second unaffiliated network through which transactions may be routed. In most situations, due to the inability to add dual-signature network capability, this means adding a PIN network routing option to a signature-based card. And, this, of course, means issuing PINs to cardholders.

Until March 13, prepaid businesses generally interpreted the Reg. II requirement to allow for distribution of PINs in a variety of ways, including enabling cardholders to freely select the PIN after the card was acquired, without restriction. PIN delivery options long used in conjunction with debit cards and reloadable prepaid cards with cash access were the model for prepaid PIN delivery under Reg. II and included:

• Directing the cardholder through the card packaging to call an IVR to self-select a PIN.
• Directing the cardholder through the card packaging to visit a Website to self-select a PIN.
• Mailing the PIN two to five days after mailing the card to reduce the opportunities for fraudsters to access the card and PIN together in a cardholder’s mailbox.

And, many prepaid businesses created the infrastructure to deliver PINs in one of these (or similar) ways to fulfill the new network routing requirements.

Now, here’s the rub. The Fed staff’s new FAQ appears to require PIN issuance when the card is activated, eliminating the flexibility of the above time-tested options for PIN delivery and negating the work and money invested in using one or more of those options to comply with the new network routing requirements.

Without clarification or relief, the FAQ would mean that, for prepaid cards activated in a retail location unaffiliated with the issuer, either the card must not be activated at the time of sale—contrary to the way such cards are commonly sold in retail locations today—or the purchaser must be able to self-select a PIN at the retail location or have the PIN conveyed to him/her by the seller at the retail point of sale or within the card packaging.

The first approach (providing unactivated cards) is a hardship on consumers, as their cards would not work until they selected the PIN on a Website or via telephone. In the case of a gift card, a PIN selected by the purchaser might never make its way to the gift card recipient. In addition, consumers who have been used to using a gift or promotional card immediately upon receipt may be frustrated when the card is declined at the point of sale because the card is not activated, and the program sponsor likely will see a huge increase in customer service complaints about the failure of cards to work as expected.

The self-select approach is feasible in some, but not all, environments. For many cards, a pre-set standard from each network would be required, such as setting the PIN at 1234 or the last four digits of the card number. And, providing the PIN within the card packaging doesn’t work for the millions of existing cards in consumers’ hands, on retailers’ shelves and in warehouses, because there isn’t a feasible way to insert a PIN in existing packaging or change the activation process without replacing and destroying these cards and/or their packaging. This approach also increases the fraud risk as cards and PINs would be combined in a single package.

Did the Fed Overstep Its Bounds?

The stated purpose of the Fed staff’s FAQs is to “assist entities in complying with the Board’s Regulation II.”

The preamble to the FAQs states:

“These FAQs are not official interpretations of the Board of Governors. These FAQs illustrate how select provisions of the regulation apply to specific situations an entity may confront. However, they do not necessarily address all provisions that may apply to any given situation. Staff may supplement or revise these FAQs as necessary or appropriate in light of further questions and experience.”[Italics added.]

Some argue, however, that the Fed staff’s FAQ on network routing requirements is more than “just” a clarification of Reg. II. They suggest that it is an entirely new rule that has not been properly reviewed and may violate the Administrative Procedure Act (APA), which governs the process by which federal agencies develop and issue regulations. APA requirements include publishing notices of proposed and final rulemaking in the Federal Register and providing opportunities for the public to comment on notices of proposed rulemaking.

Others argue that the FAQs, including the network routing FAQ, are “just” staff interpretations, not official interpretations of the Board of Governors, as stated in the preamble. They also point out that the FAQs do not have the force of law. Yet, with the dramatic increase in regulatory scrutiny and recent assessments of record-breaking fines by prudential financial regulators for compliance lapses, the distinction doesn’t promote restful sleep if you believe your program may not be compliant to the very letter of the FAQ.

Waste of Resources and Assets

Even if the Fed staff didn’t overstep its bounds in issuing the new FAQ, it’s not likely to win a popularity contest in the prepaid world any time soon. Generally regarded as a cautious, savvy and thorough regulator, the unanticipated release of the FAQs three weeks before the compliance deadline has created significant hardship for the prepaid industry. The Network Branded Prepaid Card Association’s early warning system appears to have been the first to pick up the release of the new FAQs (reportedly, even before the American Bankers Association [ABA], suggesting that the existence of the FAQs was not well known and that prepaid businesses easily could have been blindsided).

Certainly, it wouldn’t have been reasonable for prepaid businesses to have waited until just weeks before the April 1 effective date to have undertaken the complex efforts to comply with network routing requirements. Issuing the FAQ on March 13 hardly provided sufficient time for prepaid businesses to evaluate its implications, much less make the printing, programming and fulfillment changes necessary to align existing PIN-issuance processes with the FAQ—a process that could legitimately take a year or more to implement.

The timing issue might have gone down more easily if card and packaging inventory in the pipeline (including in retailers and branches or in production) had been grandfathered. But, the FAQ doesn’t address grandfathering, leading to another issue: waste. If millions of non-compliant cards and packaging must be pulled from stores, branches and warehouses, the potential waste of assets is monumental—and all because of the timing of when a PIN is issued. The waste seems vastly disproportionate to any benefit accruing to anyone.

Precarious Limbo

It’s no secret that a variety of organizations with a stake in the prepaid market have called or visited Fed staff to explain their positions and ask for relief from the unanticipated requirement included in the FAQs. Although the Fed staff is reportedly sympathetic to the difficulties of the prepaid industry and may be considering further clarification of its position, there is no guarantee of any regulatory relief. And, should it come, it’s not coming tomorrow, leaving a lot of prepaid programs in precarious limbo.

What to Do?

If there were an easy or clear-cut solution for prepaid participants, you’d know it already. But there isn’t. And, your only option is to engage your in-house or outside counsel and/or compliance officers to ensure you’re reading the situation right and understanding the potential risk your organization faces.

It’s probably a good time to recognize that not all programs are out of alignment with the FAQ. Either through incredible prescience or dumb luck, some prepaid programs include PIN issuance that is compliant with the FAQ by ensuring the cardholder has or can use a PIN as soon as the card is activated. But if you aren’t prescient or lucky, you need to start with an eyes-wide-open evaluation of the prepaid programs you’re associated with.

At one end of the spectrum, risk-averse organizations may feel compelled to start pulling prepaid programs. And, reportedly, there already is activity in this area. At the other end of the spectrum, some organizations may choose a wait-and-see approach if they believe their programs are fully compliant with Reg. II, despite the language contained in the FAQ, and are hoping for Fed clarification affirming their position. But even the wait-and-see approach requires action, particularly documenting in writing the reasoning for the opinion that they are compliant with the network routing requirement and preparing how to respond to partners and examiners about PIN issuance practices.

Some, including the ABA’s Nessa Feddis, vice president and senior counsel, suggest that issuers should talk to their regulators to make sure they understand what they must do and explain they are working diligently to comply. At least one other attorney disagrees, suggesting that calling attention to the FAQ at this time is not useful because examiners are not yet briefed on the matter.

In fact, some attorneys examining the FAQ will tell you it’s not time to panic; there are enough holes in the Fed staff’s interpretation to make compelling legal arguments that the interpretation is flawed, including that it goes beyond the requirements of Reg. II and the Durbin Amendment; the consumer’s role in determining whether and when to select a PIN should be honored; and by adding an unaffiliated PIN network to its prepaid cards, a prepaid card provider has met the requirement. And, as previously mentioned, the FAQs are not an “official interpretation” of the Board; they are informal guidance issued by the Fed staff and the guidance may be changed or amended.

Compliance Is the Goal

Like all players in financial services, prepaid businesses have an obligation to comply with all applicable laws and regulations. About that there is no question or argument. And, if there ever were any doubt that prepaid businesses take compliance seriously, spend time at a prepaid-focused conference and you’ll see that compliance issues are front and center. Or, ask a prepaid executive to share information on the increases in expenditures on costs related to compliance.

Prepaid businesses want to be on the right side of this issue (and all compliance issues), but they don’t want to tear apart infrastructure, toss out cards and packaging, and reinvest millions of dollars unless they’re totally clear on what the rules are. And, industry doesn’t yet have that clarity.

The network routing FAQ is problematical and there are legitimate questions about the appropriateness of the “clarification.” The industry has articulated to the Fed the unintended consequences of the FAQ and the need for swift clarification. Now it’s time for the Fed to act. There are no guarantees, of course, as the Fed staff can do what it wishes on this matter. As an industry we must stand ready to assist the Fed from an informational perspective to give it every reason and opportunity to support relief or further clarification on the network routing FAQ. In the meantime, prepaid businesses must look internally and prepare themselves to support whatever position they may take in the face of potential scrutiny.

Hope isn’t much of a strategy, but we must remain hopeful that the Fed will do the right thing—and quickly.

Authors’ Note: Brad Fauss and Marilyn Bochicchio wish to acknowledge the contributions of a significant number of members of the prepaid industry who participated in the development of this article.