# O

+-----------------------------------------------------------------------+
| ## Comptroller of the Currency                                        |
|                                                                       |
| > Administrator of National Banks                                     |
+-----------------------------------------------------------------------+

Washington, DC 20219

##### Corporate Decision #2002-11

June 28, 2002 **July 2002**

Richard E. Brophy, Jr.

Naman, Howell, Smith & Lee

P.O. Box 1470

Waco, TX 76703

Subject: Operating Subsidiary Application by Extraco Bank, N.A., Waco,
TX to Expand Activities of Extraco Institutional Services Corp.,
Application Control Number: 2002-WO-08-0002

Dear Mr. Brophy:

Extraco Bank, N.A., (the \"Bank\"), Waco, TX has filed an application
under 12 CFR § 5.34 to expand the scope of activities performed by an
operating subsidiary of the Bank, Extraco Institutional Services
Corporation (the \"Company\"). The Company proposes to provide advisory
and consulting services to Bank customers who use the Bank's electronic
retail or wholesale transactional services; the advice would cover the
hardware, software, and other technologies necessary to use those
services. The Company also proposes to provide advisory and consulting
services to business customers on the hardware, software, and other
technology necessary to enable those customers to process for themselves
banking, economic, and financial information. Based on the commitments
and representations in the Bank\'s application and other materials, the
expanded activities of the Company are approved.

## Background

Currently, the Company is engaged in a wide range of activities
providing support for the Bank and its affiliates in their lending
operations, internal training, human resources, marketing, cash
management and deposit operations, and information systems. However, in
light of its significant capital expenditures and human resource
acquisitions to improve the Company's technological service capacities,
the Bank would like to use the Company's competence to offer
technology-related advisory and consulting services to the Bank\'s
retail and small business customers. Specifically, the Bank now proposes
that the Company engage in three new activities.

First, the Company would provide advisory and consulting services to
Bank retail customers with regard to the installation of necessary
hardware, software, telephone lines, modems and other devices in order
to operate the Bank\'s Internet-based home banking product. The Bank has
found that many of its customers, particularly elderly customers, wish
to use the Bank\'s electronic home banking product, but lack the
expertise and knowledge to install the necessary hardware and software
needed to make the Bank\'s home banking product operational.[^1]
Accordingly, the Bank believes that to more successfully market its home
banking service, it needs to provide customers with advice and
consultation on the technology (including installation and maintenance)
needed to operate that Internet home banking service.

Second, the Company would provide advice and consultation to the Bank\'s
wholesale and business customers with regard to the hardware, software,
telephone lines, and other devices necessary to use the Bank\'s
Internet-based cash management and ACH services. The Bank states that in
order to provide the electronic cash management and ACH services to
business customers, it has found that many customers require advice and
consultation with regard to the technology needed to maintain and
operate those services. In order for the Bank\'s customers to install
and integrate with the banking products, the Bank has periodically been
asked to assist its customers with their information technology needs.
The Bank has concluded that if it is unable to provide such advice and
consultation to its small business customers, it will be unable to
market effectively its Internet-based cash management and ACH services.

Third, the Company would provide advice and consulting services to Bank
business customers on the processing of banking, financial, and economic
data for themselves, including the hardware and software needed to
enable customers to process such data.[^2] The Bank represents that such
banking, financial, and economic data would include accounts receivable,
accounts payable, revenues, expenses, and similar financial data. The
advisory and consulting services would be limited to the type of
banking, financial, and economic data that the Bank would be permitted
to process on behalf of its customers. See 12 CFR § 7.5006. The Bank
asserts that the proposed consulting activities will respond to a clear
customer need and will assist the Bank because it will enable a customer
to set up data processing systems that provide the kind of information
needed by both the Bank and the customer for transactions between the
Bank and the customer. The Bank has found that many of its small
business customers lack the resources to design, install, and maintain
their information technology systems. Further, the Bank has found that,
in connection with providing traditional bank products such as deposit
products and loans, it is essential that its customers have information
technology systems that function properly.

The Bank acknowledges that providing the proposed technology advisory
services may increase risks, particularly if the Company fails to render
accurate advice. However, the Bank believes it can adequately limit and
control these risks. To that end, the Bank commits that it and the
Company will: 1) document the advice given to clients, 2) obtain
appropriate insurance coverage, 3) ensure that staff providing advice is
competent, trustworthy, and has appropriate professional credentials, 4)
limit the areas in which advice given to those in which the Company\'s
personnel have sufficient training and experience, 5) avoid any
management role regarding or operating control over customers by
limiting the role of Company personnel to advice and consultation and by
leaving decisions to the customer's management, and 6) enter into
appropriate engagement letters to define the scope of proposed services
and limit the Company\'s liability for such services.[^3]

The Bank commits that it will not directly offer any data processing to
its customers and thereby will avoid the possible conflicts of interest
that could arise between the Bank\'s advisory activities and its role as
a direct provider of data processing services. Moreover, the advice and
consultation provided by the Company will relate to products offered by
third-party providers. The Bank has represented that neither the Bank
nor the Company currently have or plan to enter into any relationships
with third-party software or hardware providers under which the Bank
will 1) endorse or recommend third party products or 2) receive special
incentives in compensation for sales of such products. The Company's
recommendations with regard to hardware will be made based upon a
customer\'s existing hardware or the customer\'s preference. If the
customer has no existing hardware or preferences, the Company likely
will recommend hardware with which it is most familiar, although neither
the Bank nor the Company has any arrangements or agreements to recommend
specific hardware.

**Discussion**

The OCC recently adopted a final regulation on electronic activities of
national banks. Among other things, this regulation codified the
existing OCC position on a national bank's authority to engage in data
processing activities. The new regulation provides in relevant part:

> It is part of the business of banking under 12 U.S.C. § 24(Seventh)
> for a national bank to provide data processing, and data transmission
> services, facilities (including equipment, technology, and personnel),
> data bases, advice and access to such services, facilities, data bases
> **and advice**, for itself and for others, where the data is banking,
> financial, or economic data, and other types of data if the derivative
> or resultant product is banking, financial, or economic data. For this
> purpose, economic data includes anything of value in banking and
> financial decisions.

12 CFR § 7.5006(a) (emphasis added). This rule codifies OCC
interpretations confirming that a national bank may collect, process,
transcribe, analyze, and store banking, financial, and economic data for
itself and its customers as part of the business of banking.[^4] The new
rule clarifies that permissible "processing" of eligible data includes
provision of data processing services, data transmission services,
facilities (including equipment, technology, and personnel), data bases
and advice. It also includes providing access to such services,
facilities, data bases, and advice. Finally, the rule specifies that for
purposes of this section, "economic data" includes anything of value in
banking and financial decisions.[^5] We find that the Company's proposed
advisory and consulting activities are permissible under this regulation
and the underlying OCC and judicial precedent supporting the rule.

The new rule and OCC precedent authorize national banks to provide
advice with respect to data processing and data transmission services,
facilities (including equipment, technology, and personnel) and data
bases provided that the underlying data is banking, financial, or
economic data. The OCC has held that where a bank would be permitted as
part of the business of banking to provide a service and related
expertise to an entity, the bank should also be permitted, as part of
the business of banking, to employ that expertise to provide advice to
that entity as to how the entity can perform the service for itself. See
OCC Interpretive Letter No. 928 (December 24, 2001) and the authorities
cited therein.

Here, all three of the proposed advisory services entail providing
advice on the processing of banking, financial, or economic data. The
Company proposes to advise retail and wholesale Bank customers, who use
the Bank's electronic transactional services, on the hardware, software,
and other technologies necessary to use those services. Such advice is
clearly focused on the processing of banking data.[^6] The Company also
proposes to provide advisory and consulting services to business
customers on the hardware, software, and other technology necessary to
enable Bank customers to process banking, economic, and financial
information for themselves. This would include processing of information
on the customer's accounts receivable, accounts payable, revenues,
expenses, and similar financial data. The Bank has committed that it
will limit its advisory and consulting services to the type of banking,
financial, and economic data that the Bank would be permitted to process
on behalf of its customers.

The new regulation provides that the "OCC may determine that activities
are permissible under 12 U.S.C. § 24(Seventh) or other statutory
authority only if they are subject to standards or conditions designed
to provide that the activities function as intended and are conducted
safely and soundly, in accordance with other applicable statutes,
regulations, or supervisory policies." 12 CFR § 7.5001(b). The Company's
proposed activities do raise additional risks, but we conclude that that
the Bank can ensure the activities are conducted in a safe and sound
manner.

The OCC has recognized that banks offering technical advice may need to
take special precautions. We have said:

> The advising bank would potentially be liable if it failed to render
> competent advice. Accordingly, we would expect advising banks to take
> suitable steps to control that risk, such as keeping adequate records
> of the advice rendered, obtaining appropriate insurance coverage, and
> ensuring that the staff rendering the advice is competent,
> trustworthy, and has appropriate professional credentials. Moreover,
> we would expect that generally a bank would only render advice on
> banking services that it has actual direct experience in performing
> adequately. This would not generally include, for example, a bank that
> has relied upon outsourcing for an activity. Additionally, when acting
> in an advisory or consulting capacity, a bank should not actually
> engage in a management role or exercise any form of operating control
> over the advisee. Finally, banks providing advisory services should be
> careful to define clearly in their engagement letters or agreements
> the scope of advice rendered and the bank's liability for that advice.

OCC Interpretive Letter No. 928, [supra]{.underline}, N. 17. The Bank
has committed that it will adopt these precautions.

Another risk in rendering advice may arise from the failure to
appropriately manage potential conflicts of interest between the
advising bank and its client. Conflicts of interest arise when an
advisor's ability to act exclusively in the best interests of a client
is impaired by the interests of the advisor or a related party. Thus,
the code of ethics for many institutes and associations for technology
consultants urge their members to avoid conflicts of interest and to
disclose conflicts to affected parties when they arise.[^7]

For example, conflicts of interest could arise if the Company had an
incentive to recommend particular systems or configurations because it
would receive finder fees from system providers or because certain
system configurations would facilitate the Bank's ability to conduct
banking business with the consulting client. The Bank has represented
that neither the Bank nor the Company have or plan to enter into any
relationships with third-party software or hardware providers to endorse
or recommend their products or that provide for any special incentives
in compensation for sales. Similarly the OCC expects that the Company
will disclose to consulting clients any other situations where the Bank
has an interest in promoting specific system configurations or
technologies.[^8]

#### Conclusion

Accordingly, based on the foregoing, the Bank's application to expand
the activities of the Company is approved.[^9]

A separate letter is enclosed requesting your opinion of our service in
processing your applications. We would appreciate your response so we
may evaluate our service. In the event of questions, please contact
Steven Strasser, Licensing Analyst, at (202) 874-5060.

Sincerely,

**-signed-**

Julie L. Williams

First Senior Deputy Comptroller and Chief Counsel

[^1]: The Bank notes that elderly people have been identified as the
    fastest-growing segment of Internet users. S. Berger, \"The Web
    Welcomes Older Women," Technology News (July 18, 2000). See also
    Press Release, Microsoft Corp. and National Council on Aging (Sept.
    4, 1998) (Americans over age 60 represent the fastest-growing
    segment of computer and Internet users).

[^2]: This would include advice and consultation with regard to
    information system design, network and computer administration,
    software and hardware installation and maintenance, and
    telecommunications installation and maintenance to the extent
    necessary to enable the customer to process banking, financial, or
    economic data.

[^3]: On larger projects, the Company plans to enter into engagement
    letters that contain provisions limiting the liability of the
    Company to the amount paid for services.

[^4]: [See]{.underline}, [e.g.]{.underline}, OCC Conditional Approval
    No. 289 (Oct. 2, 1998); OCC Interpretive Letter No. 805, [reprinted
    in]{.underline} \[1997-1998 Transfer Binder\] Fed. Banking L. Rep.
    (CCH) ¶ 81,252 (Oct. 9, 1997). A prior OCC interpretive ruling on
    electronic banking specifically stated that \"as part of the
    business of banking and incidental thereto, a national bank may
    collect, transcribe, process, analyze and store for itself and
    others, banking, financial, or related economic data.\" 39 FR 14192,
    14195 (Apr. 22, 1974). This language was deleted from former 12 CFR
    § 7.3500 because the OCC was concerned that the specific examples of
    permissible activities in the ruling, such as the marketing of
    excess time, by-products, and the processing of \"banking,
    financial, or related economic data,\" had led to confusion and
    misinterpretation. [See]{.underline} 47 FR at 46526, 46529 (Oct. 19,
    1982). However, the preamble stated \"the Office wishes to make
    clear that it does not intend to indicate any change in its position
    regarding the permissibility of data processing services.\"
    [Id.]{.underline} Since 1982, the risk of confusion and
    misinterpretation of a regulation has significantly diminished due
    to, among other reasons, the substantial number of interpretive
    letters the OCC has issued on permissible data processing that can
    provide a context for understanding the rule.

[^5]: [See]{.underline}*,* [e.g.]{.underline}, [Association of Data
    Processing Service Organizations, Inc. v. Board of
    Governors]{.underline}, 745 F.2d 677, 691 (D.C. Cir. 1984).

[^6]: The new regulation also codifies the long established rule that an
    electronic banking activity is authorized for a national bank as
    incidental to the business of banking if it is convenient or useful
    to an activity that is specifically authorized for national banks or
    to an activity that is otherwise part of the business of banking. In
    determining whether an activity is convenient or useful to such
    activities, the regulation provides that OCC will consider, among
    other things, "whether the activity facilitates the production or
    delivery of a bank's products or services, enhances the bank's
    ability to sell or market its products or services, or improves the
    effectiveness or efficiency of the bank's operations, in light of
    risks presented, innovations, strategies, techniques and new
    technologies for producing and delivering financial products and
    services\...." 12 CFR § 7.5001(d)(1)(i). While this need not be
    decided today, the Company's technical advice with respect to the
    use of the Bank's electronic home banking, CMA, and ACH services
    would appear to be incidental to the offering of those banking
    services.

[^7]: See, e.g., the codes of ethics for the Institute of Electrical and
    Electronic Engineers
    ([www.ieee.org/about/whatis/code.html)](http://www.ieee.org/about/whatis/code.html)),
    Independent Computer Consultants Association
    ([www.icca.org](http://www.icca.org/ethics.asp)/ethics.asp), and the
    National Bureau of Certified Consultants
    ([www.national-bureau.com/html/code_of_ethics.html)](http://www.nationla-bureau.com/html/code_of_ethics.html)).

[^8]: For example, in the third type of proposed advisory activity
    (advice on processing financial data including on system
    architecture) to small businesses, conflict situations might arise
    where the Bank's ability to provide *banking* services to the client
    would be facilitated if the client adopted one particular
    architecture over others. However, in the first two types of
    proposed activities (advice to existing home banking and CMA
    customers), there would be no need for such conflict disclosures
    because the customers would be specifically seeking advice on how
    best to connect electronically to receive services from the Bank.

[^9]: This approval, and the activities and communications by OCC
    employees in connection with the filing, do not constitute a
    contract, express or implied, or any other obligation binding upon
    the OCC, the U.S., any agency or entity of the U.S., or an officer
    or employee of the U.S., and do not affect the ability of the OCC to
    exercise its supervisory, regulatory, and examination authorities
    under applicable law and regulations. The foregoing may not be
    waived or modified by any employee or agent of the OCC or the U.S.