Improper authorizations: liability threat to online banking?

By now bankers are aware of the huge benefits of providing services by the exchange of electronic signals over the Internet instead of relying on the use of cash, physical checks or negotiated instruments.

As in all banking transactions, numerous laws, rules and regulations come into play. Any time there is a dispute between the customer and the bank, these laws, rules and regulations are applied in determining the rights and liabilities of the parties. Also, the written agreements between the customer and the bank are important in defining the rights and liabilities of the parties and can, in some permissible instances, modify the laws, rules and regulations.

The authorization requirement is an important part of these laws, rules and regulations. When dealing with business customers, banks must have the proper authorization to not only open traditional accounts but also to provide cash management services as well. A bank must always ensure that the person actually using online banking on behalf of the business customer is properly authorized.

Consider a case where a company has multiple accounts at a particular bank and only one is used for payroll purposes. The company has allowed Ms. Smith, the payroll clerk, to be the only authorized signor on that account, and she is not an authorized signor on any other accounts. It is later discovered that funds well in excess of the amounts needed to make payroll have been transferred from other company accounts into the payroll account through online banking and Ms. Smith has embezzled the excess. The company now wants the loss to be the bank’s liability. While many laws and regulations apply and may save the bank from liability, the company could gain advantage if it could prove that Ms. Smith or another unauthorized person used online banking to access the other accounts.

At the time a company opens a bank account, an account card is signed which states certain information about the company, including its federal tax ID number, the type of account, account number, the number of signatures required for withdrawals and who, with signatures, are authorized signors. The deposit terms and conditions are explained and attached. In addition, a company is required to provide some type of authorization resolution — although common usage is still “corporate resolution” — which verifies the company name and federal tax ID number and lists the agents authorized to exercise the powers set forth in the AR. These agents can then do a variety of other banking transactions and open other deposit accounts in the name of the company. Usually the AR only gives the specifically named agent specific powers and does not normally allow the agent to appoint other agents. However, many banks’ ARs do not address the need to ensure that the persons using online banking services on behalf of a company are properly authorized agents.

Times have significantly changed from the corporate-resolution days. Business people have a number of entities to choose from, such as limited liability companies, partnerships and limited partnerships. Therefore, new authorization forms and documentation are required:

• For a corporation the AR needs approval by the board of directors.
• In a limited liability company, if it is member managed, the AR is approved by all of the members, and if it is manager managed, the AR is approved by the manager.
• In a general partnership, the AR is approved by a partner authorized in the partnership agreement or the majority of partners.
• In a limited liability partnership, the AR is approved by the general partner.

Given the limited bank involvement in transactions made through online banking, a proper AR is even more important. When the business customer signs up for online banking services, he or she must sign new and additional service agreements and must have the proper authorization to do so. Where the services provided also entail additional persons being named to use them (administrators, users, etc.) they must also have the proper authorization. Unless prior ARs specifically name the persons who can use the services, new ARs are needed not only for transacting online banking services but also to name additional administrators or users.

In the online banking services agreement, terms and conditions are specified under which the services are to be used, persons are named as administrators and others are given the right to conduct online banking By now bankers are aware of the huge benefits of providing services by the exchange of electronic signals over the Internet instead of relying on the use of cash, physical checks or negotiated instruments.

As in all banking transactions, numerous laws, rules and regulations come into play. Any time there is a dispute between the customer and the bank, these laws, rules and regulations are applied in determining the rights and liabilities of the parties. Also, the written agreements between the customer and the bank are important in defining the rights and liabilities of the parties and can, in some permissible instances, modify the laws, rules and regulations.
The authorization requirement is an important part of these laws, rules and regulations. When dealing with business customers, banks must have the proper authorization to not only open traditional accounts but also to provide cash management services as well. A bank must always ensure that the person actually using online banking on behalf of the business customer is properly authorized.

Consider a case where a company has multiple accounts at a particular bank and only one is used for payroll purposes. The company has allowed Ms. Smith, the payroll clerk, to be the only authorized signor on that account, and she is not an authorized signor on any other accounts. It is later discovered that funds well in excess of the amounts needed to make payroll have been transferred from other company accounts into the payroll account through online banking and Ms. Smith has embezzled the excess. The company now wants the loss to be the bank’s liability. While many laws and regulations apply and may save the bank from liability, the company could gain advantage if it could prove that Ms. Smith or another unauthorized person used online banking to access the other accounts.

At the time a company opens a bank account, an account card is signed which states certain information about the company, including its federal tax ID number, the type of account, account number, the number of signatures required for withdrawals and who, with signatures, are authorized signors. The deposit terms and conditions are explained and attached. In addition, a company is required to provide some type of authorization resolution — although common usage is still “corporate resolution” — which verifies the company name and federal tax ID number and lists the agents authorized to exercise the powers set forth in the AR. These agents can then do a variety of other banking transactions and open other deposit accounts in the name of the company. Usually the AR only gives the specifically named agent specific powers and does not normally allow the agent to appoint other agents. However, many banks’ ARs do not address the need to ensure that the persons using online banking services on behalf of a company are properly authorized agents.
 
Times have significantly changed from the corporate-resolution days. Business people have a number of entities to choose from, such as limited liability companies, partnerships and limited partnerships. Therefore, new authorization forms and documentation are required:

• For a corporation the AR needs approval by the board of directors.
• In a limited liability company, if it is member managed, the AR is approved by all of the members, and if it is manager managed, the AR is approved by the manager.
• In a general partnership, the AR is approved by a partner authorized in the partnership agreement or the majority of partners.
• In a limited liability partnership, the AR is approved by the general partner.

Given the limited bank involvement in transactions made through online banking, a proper AR is even more important. When the business customer signs up for online banking services, he or she must sign new and additional service agreements and must have the proper authorization to do so. Where the services provided also entail additional persons being named to use them (administrators, users, etc.) they must also have the proper authorization. Unless prior ARs specifically name the persons who can use the services, new ARs are needed not only for transacting online banking services but also to name additional administrators or users.

In the online banking services agreement, terms and conditions are specified under which the services are to be used, persons are named as administrators and others are given the right to conduct online banking services. The bank may have liability if the persons using the services were never named as agents or authorized signors on any of the account agreements and there is no additional AR. Going back to my first example, as online banking services were used to transfer money into a payroll account, if the bank did not have a proper AR for the person making the account transfers, there could be increased risk of liability.

Now is the time for any bank that is in the process of developing online banking services to review its documents; update them, but also consider adding documents to ensure proper authorization to give the bank more protection in this area.

Tom Stahl is chairman of the corporate department at Lathrop & Gage L.C. He can be reached at tstahl(at)lathropgage.com or 816-460-5821.

Copyright © October 2007 BankNews Publications