# O

+-----------------------------------------------------------------------+
| ## Comptroller of the Currency                                        |
|                                                                       |
| > Administrator of National Banks                                     |
+-----------------------------------------------------------------------+

Washington, DC 20219

##### Interpretive Letter #928

December 24, 2001 **March 2002**

**12 USC 24(7)**

Dear **\[ \]**:

This responds to your letter of August 3, 2001, seeking, on behalf of
the **\[ \]** (the "Bank") an interpretive letter from the Office of the
Comptroller of the Currency ("OCC") on the authority of national banks
to offer certain electronic commerce and security-related services to
their wholesale and non-profit organization customers. For the reasons
set forth below, we find that the proposed activities are permissible
for national banks.

#### Background

The Bank proposes to engage in several activities in association with
its electronic payments services. For merchants, government agencies,
and non-profit service organizations that are Bank customers (the
"Customers") with previously established web sites, the Bank will design
and host[^1] a web site and provide software[^2] enabling: 1) the
Customers to process various forms of payments electronically from their
end clients; 2) Customers' end clients to electronically schedule and
pay for events offered by a Customer organization; and 3) the Customer
to acquire and compile information[^3] from their end clients ("Client
Information") in connection with the above described transactions to be
used for authentication purposes and to facilitate future interactions
between the Customer and its end client. Also, in connection with these
Internet-related web-services, the Bank will consult with and advise its
Customers on how the web site should be designed and operated so the web
site hosted by the Bank and the related information is secure from
unauthorized access while on the Bank\'s premises, while in transit to
and from the Bank, and while in the Customer\'s possession. Finally, the
Bank will also offer electronic bill presentment and payment services
for its merchant, government agency, and non-profit service organization
customers.

In addition, while the proposed activity will focus on the Bank's
Customers, the Bank will also market the Group\'s Internet-related
services to non-customers \-- who may or may not have an existing web
site \-- but who wish to have a payment related portion added to a new
web site that can accommodate the services described above. Any person
who wishes to have a payment portion of a web site designed must have a
Bank account for settlement purposes \-- thereby becoming a Bank
customer.

Customers that sign up for the services offered by the Bank will be
charged various fees, including a licensing or start-up fee when they
initially sign up for the services offered by the Bank, monthly
maintenance and hosting fees, and/or transaction fees in connection with
processing payment transactions.

When the Bank builds and hosts the Customer's web site, the Bank will do
so in a manner that is consistent with the appropriate levels of
security and confidentiality risk control measures that are consistent
with the standards OCC adopted under 15 U.S.C. 6801(b) and codified in
12 CFR Part 30, Appendix B (the Interagency Guidelines Establishing
Standards for Safeguarding Customer Information).

Bank is aware that the proposed activities will impose added risks to
the Bank, including transaction risk, legal risk, and reputation risk.
Through a series of internal and external audits of the Bank\'s
technology, procedures and controls, the Bank has identified and reduced
operational risks that were identified by making the adjustments
recommended in the audits. The Bank plans to have regular internal and
external audits of the activities. The staff that would conduct the
activities have worked closely with the Bank's internal auditors on the
Bank\'s recently implemented Information Security Program, required
under 12 CFR Part 30, so that the Program incorporates the current and
proposed activities discussed in this letter. OCC has recently completed
an information technology review of the Bank that included the proposed
web-hosting activities and systems.

***Discussion***

The OCC has found that, as part of the business of banking and in
association with electronic payments services, national banks may
provide merchant customers with services that will enable the merchant
to operate a commercially enabled web site.[^4] The processing of
payments resulting from orders received through a merchant\'s web site
is also clearly part of the business of banking.[^5] Merchant credit and
debit card processing services generally involve verifying credit card
authorizations at the time of purchase, processing card transactions,
settlement of card transactions, and depositing funds into merchants'
accounts. The fact that the credit and debit card and other electronic
payment transactions would involve purchases of goods or services over
the Internet does not change the nature of the service that would be
provided.[^6] Thus, the Bank's proposed payment processing and
associated commercial web site hosting activities are permissible.

OCC has found that the finder authority to host, develop, and support
commercially enabled web sites extends not only to merchants, but also
to non-profit service entities such as government agencies that provide
goods and services to the public. OCC Conditional Approval No. 361
(March 3, 2000) (national bank may host web sites for government
agencies that offer goods and services to the public). We believe this
rationale applies equally to private non-profit organizations that
provide goods and services to the public.[^7]

Moreover, OCC has found that incidental to a payments processing service
and associated commercial web site hosting, a national bank may provide
web design and development services. The ability to build the web sites
for the participating merchants as part of a commercial Internet
services package is critical to the successful marketing of the
package.[^8] To enhance marketability and reduce costs to merchants, the
firms that will compete with the Bank in providing Internet commerce
products and services are now offering complete packages to merchants,
which include the building of the web sites. *See e.g*., Bloom, *supra*;
Steven Marjanovic, *First Data to Buy Stake in iMall, a Software Firm*,
American Banker, Nov. 9, 1998, at 17; Tami Luhby, *Wells Fargo Opens
Door to Web for Small Business*, American Banker, Sept. 15, 1998.[^9]

OCC has long held that, under their incidental powers, national banks
may sell non-banking products and services when reasonably necessary to
provide banking products on a competitive basis by creating a package of
related services needed to satisfy consumer demand, meet market
competition, and enable the Bank to successfully market its banking
services. Thus, for example, in OCC Interpretive Letter No. 742, OCC
found offering of Internet access service was needed to successfully
provide and market the Bank\'s Internet banking service. We found
limiting the Bank\'s Internet access services, to block non-banking use,
would not meet customer needs or the competing products in the
marketplace. See also, OCC Interpretive Letter No. 611, supra, (bank
selling home banking service can also provide customer access to
non-banking services "to increase the customer base and the usage of the
program"); OCC Interpretive Letter No. 653, reprinted in \[1994-1995
Transfer Binder\] Fed. Banking L. Rep. (CCH) ¶ 83,601 (December 22,
1994) (national banks may offer non-banking products as part of larger
product or service when necessary, convenient and useful to bank
permissible activities). Cf., National Courier Ass'n v. Board of
Governors, 516 F. 2d 1229, 1240 (D.C. Cir. 1975) (incidental powers of
holding companies to provide specialized courier services when service
necessary to obtain full benefit of data processing services).

For this reason, the proposed building of web sites by the Bank for
those merchants desiring that service is incidental to the business of
banking. Corporate Decision No. 2000-08, *supra* and OCC Interpretive
Letter No. 875 *reprinted in* \[1999-2000 Transfer Binder\] Fed. Banking
L. Rep. (CCH) ¶ 81-369 (October 31, 1999). *See also* OCC Interpretive
Letters No. 856, *supra* (national bank engaged in permissible web site
hosting activity may provide merchants with software that will enable
them to design and modify their web sites).

As noted above, one of the features the Bank proposes to provide for
merchants in the designed and hosted web sites would enable the merchant
Customer to acquire and compile information from their end clients that
would be used primarily for authentication and security purposes and to
facilitate additional transactions when the end client returns to the
web site to conduct additional business. This "one-click" shopping
information concept is becoming increasingly prevalent in electronic
commerce. Major firms such as AOL Time Warner, Inc. and Microsoft are
currently developing systems that will allow people to store personal
information (such as names, addresses, and credit card numbers) online
to simplify their purchasing transactions on the Internet. A. Klein and
A. Cha, "AOL May Launch an Internet ID Service," Washington Post, July
27 2001, p. E-1. Similarly, a number of significant electronic merchants
and payment processors have developed and are refining an "electronic
wallet" which performs much the same function by enabling customers to
store identifying, shipping, and payment-related information so that the
customer does not need to re-key the information the next time they
submit an order. *See* M. Barnett, "It\'s the Year of the E-wallet," The
Industry Standard, June 30, 1999, viewed July 27, 2001
<http://www.cnn.com/tech/computing/9907/01/ewallet.idg/;> M. Zane,
"NextCard to Offer E-wallet," ZDNN, October 18, 1999, viewed July 27,
2001 at <http://www.zdnet.com/printerfriendly/0,6061,2374202-2,00.html;>
Bloom and J. Kutler, "Web Wallet Marketers Struggle for Definition and
Acceptance," The American Banker, November 4, 1999; and J. Capachin,
"Digital Wallets: Their Potential Exceeds Their Performance," American
Banker, August 17, 2001.

The Bank may permissibly offer this "one-click" shopping information
service to Customers of its commercial web site services for two
reasons. First, the service is incidental to the electronic payments
processing service provided by the Bank in that it enhances the
convenience of the service for both the merchants and their end clients.
OCC has held, in Interpretive Letter No. 868 *reprinted in* \[1999-2000
Transfer Binder\] Fed. Banking L. Rep. (CCH) ¶ 81-263 (August 16, 1999),
that a national bank can hold a minority interest in a company that
designs and distributes software that performs the same "one-click"
shopping function. That letter concludes that the "one-click" shopping
software was permissible because it "will facilitate the electronic
transfer of funds from consumers to businesses and financial
institutions" and thus performed "activities commonly undertaken by
banks directly for themselves, other financial institutions, or as part
of servicing customers."

Second, processing of the retail based information relating to identity,
shipping information, and payment information with respect to end
clients and their transactions for merchant Customers is permissible
because it involves the processing of banking, financial, and economic
data. Case authority supports this conclusion. In *Ass'n of Data
Processing v. Board of Governors*, 745 F.2d 677 (D.C. Cir. 1984), the
D.C. Circuit Court of Appeals upheld a Federal Reserve Board finding
that data processing and database services were closely related to
banking (and thus a proper activity for bank holding companies) if the
"data to be processed \... are financial, banking or economic\...."[^10]
Further, the court indicated that "economic data" would include:
"agricultural matters, [retail sales matters]{.underline}, housing
matters, corporate profits matters, and anything of value in banking and
financial decisions." 745 F.2d at 691 (emphasis added).[^11]

Likewise, the proposed processing of the retail-based Client Information
is supported by OCC precedent. OCC has long held that as part of the
business of banking, national banks may collect, transcribe, process,
analyze, and store for itself and others banking, financial, or economic
data.[^12] OCC precedent establishes that the information that will be
included in the Bank's E-wallet and Client Information service is
banking, financial or economic data. OCC Corporate Decision No, 2000-08,
*supra* (national bank may, as part of its permissible web hosting
services, provide hosted merchants with information and reports relative
to the purchases and transactions on their web sites); OCC Interpretive
Letter No. 677, *supra*. *See also* OCC Interpretive Letter No. 741
*reprinted in* \[1996-1997 Transfer Binder\] Fed. Banking L. Rep. (CCH)
¶81-105 (Aug. 19, 1996) (national bank acting as finder for automobile
dealers may also maintain a comprehensive system that allows dealers to
track information on customers referred and to generate market
statistics such as buying trends and cycles); and OCC Interpretive
Letter No. 346, *supra*. *See, e.g.,* OCC Interpretive Letter No. 737,
*supra* (national bank may provide transaction and information
processing services to support an electronic stored value system); OCC
Interpretive Letter No. 653, *supra* (national bank may act as an
informational and payments interface between insurance underwriters and
general insurance agents).[^13] Other agency precedent also supports
this conclusion.[^14]

The Bank proposes to offer electronic bill presentment to its web
enabled customers. OCC has found that electronic bill presentment is
part of the business of banking.[^15]

Finally, the Bank also desires to consult with and advise its customers
on how a web site should be designed and operated so that the site
hosted by the Bank and information related to that site concerning
payment transactions and end client information is secure from
unauthorized access while on the Bank\'s premises, while in transit to
and from the Bank, and while in the Customer's possession.

Some of the Bank's proposed security services are clearly encompassed
within the hosting, design, and development services discussed above and
thus are not a separate product or service. When transaction and client
information is within the Bank's environment, the Bank will be
responsible for the security of the information. The Bank will be
operating the host server and, through its system design, will specify
appropriate logical access controls. Also, by hosting the server, the
Bank will provide physical security. Finally, in designing and
developing the commercially enabled web sites or a portion thereof the
Bank will design in appropriate security. Adequate security is part of
these authorized services and need not be separately analyzed or
authorized.

However, it is contemplated that transactional and client information
will be made available to Customers and placed in environments under
their control. The issue is whether the Bank can provide Customers with
advice on security with respect to the information when it is in
Customers' environments. For the reasons below, we find that, in this
context, the security consulting proposed by the Bank is a logical
outgrowth of its banking business and, thus, permissible.[^16]

To date, OCC has authorized national banks to provide security
consulting for other financial institutions as a correspondent service.
No-Objection Letter 90-3 *reprinted in* \[1990-1991 Transfer Binder\]
Fed. Banking L. Rep. (CCH), ¶ 83207 (May 2, 1990); OCC Interpretive
Letter No. 398 *reprinted in* \[1988-1989 Transfer Binder\] Fed. Banking
L. Rep. (CCH) ¶ 85,622 (September 28, 1987); No-Objection Letter 86-15
*reprinted in* \[198X-198X Transfer Binder\] Fed. Banking L. Rep. (CCH),
¶ 84,021 (June 6, 1986); and OCC Interpretive Letter No. 137 *reprinted
in* \[1981-1982 Transfer Binder\] Fed. Banking L. Rep. (CCH), ¶ 85218
(Dec. 27, 1979). However, the OCC has permitted national banks to
provide consulting and advisory services for non-correspondents in many
areas that are financially related or in which banks have developed
extensive expertise.

For example, national banks may engage in lease consulting services. OCC
Interpretive Letter No. 567 *reprinted in* \[1991-1992 Transfer Binder\]
Fed. Banking L. Rep. (CCH) ¶83,337 (October 29, 1991). They may offer
financial and consulting services, including market research and
analysis, strategic planning, advertising and promotion planning,
product development, personnel management, employee relations,
affirmative action, and salary and benefit plans to banks and commercial
customers. OCC Interpretive Letter No. 137, *supra*. They are permitted
to provide consumer financial counseling. *Id*.; OCC Interpretive Letter
No. 367 *reprinted in* \[1985-1987 Transfer Binder\] Fed. Banking L.
Rep. (CCH) 85,537 (August 19, 1986). National banks can also offer
employee benefit consulting services (including health benefit
consulting) to corporations wishing to establish qualified benefit plans
and relocation consulting for employees of a bank or its affiliates, or
customers of the bank. OCC Corporate Decision No. 98-51 (November 30,
1998). They may engage in financial consulting and advisory services for
other financial institutions and the general public, including, among
other things, acting as a conduit in conveying loan terms to prospective
borrowers or purchasers, supplying financial information regarding a
third party, or engaging on behalf of others in research in
contemplation of prospective transactions. OCC Interpretive Letter No.
238 *reprinted in* \[1983-1984 Transfer Binder\] Fed. Banking L. Rep.
(CCH) ¶ 85,402 (February 9, 1982). Finally, OCC has recognized that
national banks operating as certification authorities can provide
consulting or advisory services to help customers, including other
banks, to implement digital signature systems. OCC Conditional Approval
No. 267 (January 12, 1998).

Thus, advisory and consulting services are an appropriate way for banks
to exercise their core competencies. This has important implications
under the logical outgrowth test. As OCC observed in prior precedent:

Among other things, the "logical outgrowth" test recognizes that the
"business of banking" is defined not only by the services and products
that banks provide, but also by the core competencies that banks use to
produce them. \*\*\*

> Clearly, "the business of banking is not static\...." *New York State
> Ass'n of Life Underwriters v. New York State Banking Department*, 632
> N.E.2d 876, 880 (N.Y. 1994). OCC recognizes that the evolution of
> "business of banking" is not restricted to lines of business
> reflecting only products banks have sold or functions banks have
> served previously. Rather, the "business of banking" must be \-- and
> is \-- sufficiently flexible to enable banks to develop and exploit
> their unique core competencies and optimize the return on those
> competencies by marketing products and services reflecting or using
> those competencies. Today, banks face a rapidly changing market that
> demands rapidly evolving skills. Thus, it is vital that they be able
> to plan strategically and adapt and respond appropriately.

OCC Conditional Approval No. 267, *supra*.

In that letter, OCC concluded that as part of the business of banking
national banks could act as digital certification authorities because,
inter alia, the certification authority activity was a logical outgrowth
of the core competence that banks had developed in verifying and
authenticating customer identities through paper and electronic systems.
Here we similarly find that rendering advice is one way that banks can
and, with appropriate limitations, should be able to exploit their core
competencies. Indeed, some OCC letters authorizing advisory activities
reflect the rationale that the particular advisory activities are
permissible because they involve the bank in providing advice on an
activity that the bank could provide directly to the advisee. For
example, in concluding that a national bank can offer financial advisory
services on credit funding alternatives to public and private entities,
OCC found the activity permissible because it "will involve the Bank's
own expertise developed internally in considering direct loans to these
types of borrowers." Unpublished Letter from Thomas Taylor (May 25,
1984).

Thus, we find that where a bank would be permitted as part of the
business of banking to provide a service and related expertise to an
entity, the bank should also be permitted, as part of the business of
banking, to employ that expertise to provide advice to that entity as to
how the entity can perform the service for itself. This will enable a
bank that has developed extensive expertise on a service to share that
expertise and competence with persons to whom the bank could have sold
the service. The risk exposures of providing advice on an activity,
while somewhat different from providing the actual service, would
certainly be no greater and can be properly limited and controlled.[^17]

Here the Bank proposes to provide advice on maintaining the security of
information relating to transactions arising from a commercially enabled
web site the Bank designed and hosts for its Customer. Clearly, the Bank
could provide safekeeping and security services directly to its
Customers on this information.[^18] The OCC recently issued a letter
concluding that, as part of the business of banking, a national bank can
provide electronic safekeeping services for personal information and
valuable confidential trade or business information. OCC Conditional
Approval No. 479, (July 27, 2001). That letter found national banks have
established safekeeping functions that encompass securing valuable
business records and papers and that the electronic safekeeping of such
records is an electronic expression of this established safekeeping
function.

The information for which the Bank would provide its Customers security
consulting services would qualify for direct safekeeping under this
precedent. Thus, it would be a logical outgrowth for the Bank to provide
security consulting with respect to that information. In other words,
since the Bank as part of the business of banking can and will provide
safekeeping services for its Customers with respect to this information,
it is a logical outgrowth of that business for the Bank to advise its
Customers on maintaining the security of that information when it is in
the Customers' systems and under their control.

The proposed consulting activities would also respond to customer needs
or otherwise benefit the Bank or its customers. The Customers would
clearly benefit because the Bank could insure that the security program
of the Customer integrated with the program and systems of the Bank that
initially would hold and process the information. The Bank would benefit
because it would be able to allocate additional resources to upgrading
its security expertise (and enhance its own security) since it would be
able to share the cost of that expertise with its consulting Customers.

Finally, the proposed advisory activity would involve risks similar in
nature to those already assumed by banks. As noted in OCC Conditional
Approval No. 479, *supra*:

> \[T\]he offering of electronic safekeeping of data will expose banks
> to risks similar to those that banks are already expert in handling.
> As noted, national banks have long experience in safekeeping of
> physical items and documents for their customers. In that capacity,
> they have developed extensive procedures and regimes to handle the
> responsibilities and risks that arise from this bailment. *See,
> generally*, Ann Graham, 1 BANKING LAW, Ch. 10 (Safe Deposit Boxes);
> James McBain, *Safe Deposit Department*, 72 BANKING L. J. 533 (1955).
> Moreover, OCC has developed guidance on this activity*. Comptroller's
> Handbook: Consigned Items and Other Customer Services,* *supra*. Much
> of this experience, process, and guidance can and should be applied to
> electronic safekeeping activities. While the use of electronic media
> to store and access items raises additional risks, banks already have
> extensive expertise in dealing with these risks and OCC has provided
> guidance on addressing these risks. In this regard, as noted above,
> OCC expects that banks offering this service will comply with the
> requirements under the new Interagency Guidelines Establishing
> Standards for Safeguarding Customer Information.

Footnotes omitted.

Thus, banks are expert in dealing with business information security
risks and in managing the risks of safekeeping activities regarding that
information. Moreover, as noted above, banks have considerable
experience in managing the special risks that arise when acting in an
advisory capacity.

*Conclusion*

For the reasons set forth below, the proposed activities described in
your letter of August 3, 2001, pertaining to electronic commerce and
security-related services to their commercial and quasi-commercial
customers activities are permissible for national banks.

Sincerely,

/s/

Julie L. Williams

First Senior Deputy Comptroller and

Chief Counsel

[^1]: The Bank will require that it host the portion of the page it
    develops.

[^2]: The software will either be developed by the Bank or obtained from
    a third party.

[^3]: The Client Information described in above, will consist of
    information such as the end client\'s name, mailing address,
    shipping address, e-mail address, telephone number, preferred credit
    card numbers for billing purposes, and other billing account
    information. The Client Information will primarily be used for
    authentication and security purposes by the Bank on behalf of its
    Customer. However, from the end client's perspective, the Client
    Information will enable the Customer to provide a more convenient
    shopping service since the end client will not have to re-key their
    information when they visit the Customer's site again. The Client
    Information will also the enable Customer to communicate more
    effectively with its end clients by sending out newsletters or
    communication to the end client's e-mail address acquired during the
    setup process.

[^4]: In association with their electronic payments services, national
    banks may provide a "package" of Internet-based services to retail
    merchants including: hosting web sites on the bank\'s own server;
    registering merchants with search engines and obtaining Universal
    Resource Locators; providing an electronic communication pathway for
    product ordering and payment; maintaining merchants\' data
    associated with the web sites on its server (e.g., price
    information, product descriptions, and images); providing merchants
    with software to create web sites; providing reports on
    transactions, web site "hits," and sales data; and processing credit
    card transactions. OCC Interpretive Letter No. 856 *reprinted in*
    \[1998-1999 Transfer Binder\] Fed. Banking L. Rep. (CCH) ¶ 81-313
    (March 5, 1999) (providing or maintaining an Internet web site for
    merchants is one device that national banks may use as finders to
    provide information to the merchants\' customers).

[^5]: OCC Corporate Decision No. 99-50 (Dec. 23, 1999) and OCC Corporate
    Decision No. 2000-08 (June 1, 2000) (national bank may process for
    its merchant customers purchases made over the Internet); OCC
    Interpretive Letter No. 856, *supra*. *See also* OCC Conditional
    Approval Letter No. 289 (Oct. 2, 1998) (national banks may acquire a
    minority interest in a firm that, among other things, provides
    accounts receivable processing and accounts payable processing); OCC
    Conditional Approval Letter No. 282 (July 7, 1998) (national bank
    may acquire an interest in a firm that would, among other things,
    engage in payments processing for the health care firms); OCC
    Conditional Approval Letter No. 248 (June 27, 1998) (national bank
    operating subsidiary may acquire a minority interest in an entity
    that provides merchant credit and debit card processing services);
    and OCC Interpretive Letter No. 731 *reprinted in* \[1995-1996
    Transfer Binder\] Fed. Banking L. Rep. (CCH) ¶ 81,048 (July 1, 1996)
    (national banks as part of the banking business may collect and
    process accounts relating to an electronic toll collection system).

[^6]: Likewise, the fact that some of the Bank's web sites will enable
    end clients to purchase rights to attend events, rather than goods
    or conventional services, does not change the permissibility of the
    activity. OCC has found that national banks can process orders and
    payments for event and attraction tickets. See OCC Interpretive
    Letter No. 718 *reprinted in* \[1995-1996 Transfer Binder\] Fed.
    Banking L. Rep. (CCH) ¶ 81-033 (March 14, 1996). There is no reason
    why the bank's electronic finder authority should not include
    bringing together buyers and sellers of events, which really are a
    form of services.

[^7]: As we noted in a prior letter: "In the finder analysis, no
    distinction should be drawn between bringing together with a
    government agency those who wish to *purchase* goods or services
    from that agency and those who wish to *consume* goods or services
    from that agency. The latter, most likely individuals seeking forms,
    benefits, or other information from the agency, are not "buyers" in
    the traditional sense; however, as taxpayers, they are essentially
    buying information or other goods or services for which their taxes
    have paid. As such, they qualify as legitimate subjects for finder
    activities by national banks. *See* Corporate Decision No. 98-13
    (Feb. 9, 1998) (national bank operating subsidiary, acting as
    finder, could bring together individuals who wished to enroll in
    government-sponsored health insurance program with appropriate
    government agency)." Id. at p. 7.

[^8]: *See* J. Bloom, *Vendor Groups Woo Banks into Net Services*,
    American Banker, May 27, 1999, at 14 (reporting that vice president
    of the National Retail Federation says merchants of all sizes prefer
    to outsource the building of virtual stores).

[^9]: Experts say that without these packages, most smaller companies
    lack the budget and manpower to do a thorough job of creating and
    maintaining a commerce-enabled web site. Bloom, *supra*.

[^10]: In reaching this conclusion the court said: "The record of this
    proceeding amply demonstrates, if any demonstration is needed, that
    banks regularly develop and process for their customers large
    amounts of banking, financial and economic data, and that they do so
    (and will presumably continue to do so) through the most advanced
    technological means." 745 F.2d at 689. Compare *National Retailers
    Corp. v. Valley Nat\'l Bank*, 411 F. Supp. 308 (D. Ariz. 1976),
    *aff\'d*, 604 F.2d 32 (9th Cir. 1979) (a national bank does not to
    have the authority to offer a data processing service to retailers
    involving the collection and compilation of information relating to
    their retail sales that had been collected by a special cash
    register). The district court in *National Retailers* held that no
    express provision of the National Bank Act authorized national banks
    to publicly market a retail information service ("RIS") and
    concluded that, since the RIS was not within the enumerated powers,
    the determining issue was whether the RIS was within the bank's
    "incidental powers." 411 F. Supp. at 313. Thus, by implication, the
    court held that the "business of banking" includes only the
    enumerated powers. This position has since been repudiated by the
    Supreme Court's ruling in *NationsBank v. Variable Life Annuity
    Co*., 513 U.S. 251 (1995), that the "business of banking" is not
    limited to the enumerated powers. The *National Retailers* court
    failed to consider that non-enumerated informational services can
    come within the "business of banking" and specifically that the
    processing of banking, financial and related economic data is part
    of the business of banking. *Ass'n of Data Processing, supra*. In
    light of these defects, the holding of *National Retailers* is not
    entitled to much weight.

[^11]: Federal Reserve Board has approved as closely related to the
    business of banking a wide range of data processing services for
    businesses. Letter to Thomas A. Plant, from Virgil Mattingly (Nov.
    25, 1997) (data processing support for the bookkeeping, accounting,
    and recordkeeping of nonfinancial firms); Compagnie de Paribas, 82
    Fed. Res. Bull. 82 (1996) (data processing for payroll, accounts
    receivable, and billing services); The Bank of New York, et al., 80
    Fed Res. Bull. 1107 (1994) (electronic data capture an electronic
    data interchange services in which merchants are provided with
    information relating to inventory and the buying patterns of
    customers that could be used by the merchants for inventory control,
    targeted marketing, and other purposes); and Banc One Corp., et al.,
    79 Fed. Res. Bull. 1158 (1993) (same).

[^12]: An earlier version of 12 C.F.R. § 7.1019 stated that "as part of
    its banking business and incidental thereto, a national bank may
    collect, transcribe, process, analyze, and store for itself and
    others, banking, financial, or related economic data." OCC
    Interpretive Ruling 7.3500, 39 Fed. Reg. 14195 (Apr. 22, 1974).
    Although in its 1984 revision of the ruling, the OCC deleted this
    statement because it believed that "specific examples \[of
    permissible electronic activities\] are inappropriate given the
    imprecision of terms and rapid pace of change in the data processing
    industry," the "analytical framework" embodied in the ruling
    remained the same. 49 Fed. Reg. 11157 (Mar. 26, 1984). OCC has
    consistently expressed this view. *See* OCC Interpretive Letter No.
    677 *reprinted in* \[1995-1996 Transfer Binder\] Fed. Banking L.
    Rep. (CCH) ¶ 83625 (June 28, 1995). *See also* OCC Interpretive
    Letter No. 737 *reprinted in* \[1996-1997 Transfer Binder\] Fed.
    Banking L. Rep. (CCH) ¶ 81-101 (August 19, 1996) (national bank may
    provide transaction and information processing services to support
    an electronic stored value system); OCC Interpretive Letter No. 653
    *reprinted in* \[1994-1995 Transfer Binder\] Fed. Banking L. Rep.
    (CCH) ¶ 83,601 (Dec. 22, 1994) (national bank may act as an
    informational and payments interface between insurance underwriters
    and general insurance agents); and OCC Interpretive Letter No. 346
    *reprinted in* (1985-1987 Transfer Binder) Fed. Banking L. Rep.
    (CCH) ¶ 85,516 (July 31, 1985) (national banks may maintain records
    on commodities transactions).

[^13]: In connection with the Client Information services it provides to
    its Customers, the Bank will have access to personal information
    regarding its Customers' end clients. The OCC expects the Bank to
    limit its use and disclosure of the Customer\'s client information
    to that which is necessary to perform the services for the Bank\'s
    Customers. The OCC also expects the Bank to establish appropriate
    security measures for safeguarding this information. These issues
    should be addressed in the Bank\'s agreements with its Customers.

[^14]: Bank of New York, et al., *supra* (electronic data capture and
    electronic data interchange services in which merchants are provided
    with information relating to inventory and the buying patterns of
    customers that can be used by the merchants for inventory control,
    targeted marketing, and other purposes involve "banking, financial,
    or economic data") and Banc One Corp., et al., *supra* (same).

[^15]: *See,* *e.g.*, OCC Corporate Decision No. 2000-08, *supra*; OCC
    Conditional Approval No. 304 (March 5, 1999) (electronic bill
    payment and presentment services over the Internet); OCC
    Interpretive Letter No. 731, *supra* (operation of electronic toll
    collection system); OCC Interpretive Letter No. 836, *reprinted in*
    \[1996-1997 Transfer Binder\] Fed. Banking Law. Rep. (CCH) ¶ 81-290
    (March 12, 1996) (data processing and electronic data interchange
    system to assist in the billing and collection for medical
    services).

[^16]: The Supreme Court has held that the National Bank Act, in 12
    U.S.C. § 24(Seventh), contains a broad grant of the power to engage
    in the "business of banking." *See* *NationsBank of North Carolina,
    N.A. v. Variable Life Annuity Co.*, 513 U.S. 251 (1995) ("*VALIC*").
    Specifically, the Court has said that the business of banking "is
    not limited to the enumerated powers in § 24 Seventh and that the
    Comptroller therefore has discretion to authorize activities beyond
    those specifically enumerated." 513 U.S. at 258-59, N. 2. In
    exercising this discretion, the OCC is guided by several factors
    reflected in case law and followed by OCC precedent: (1) is the
    activity functionally equivalent to or a logical outgrowth of a
    recognized banking activity; (2) would the activity respond to
    customer needs or otherwise benefit the bank or its customers; (3)
    does the activity involve risks similar in nature to those already
    assumed by banks; and (4) whether the activity is expressly
    authorized by law for state-chartered banks.

[^17]: The advising bank would potentially be liable if it failed to
    render competent advice. Accordingly, we would expect advising banks
    to take suitable steps to control that risk, such as keeping
    adequate records of the advice rendered, obtaining appropriate
    insurance coverage, and ensuring that the staff rendering the advice
    is competent, trustworthy, and has appropriate professional
    credentials. Moreover, we would expect that generally a bank would
    only render advice on banking services that it has actual direct
    experience in performing adequately. This would not generally
    include, for example, a bank that has relied upon outsourcing for an
    activity. Additionally, when acting in an advisory or consulting
    capacity, a bank should not actually engage in a management role or
    exercise any form of operating control over the advisee. Finally,
    banks providing advisory services should be careful to define
    clearly in their engagement letters or agreements the scope of
    advice rendered and the bank's liability for that advice.

[^18]: In fact, as noted above, the Bank will be responsible for the
    security of this information during the time that it is in the
    Bank's environment and under its control.