On January 23, the Federal Financial Institutions Examination Council (FFIEC) released “Social Media: Consumer Compliance Risk Management Guidance.” The FFIEC proposed the guidance to address how consumer protection laws apply to social media activities conducted by banks, saving associations, credit unions and nonbank entities supervised by the Consumer Financial Protection Bureau. The guidance highlights the fact that the use of social media by a financial institution can impact the risk profile of the institution. The risks can arise from poor oversight, inadequate due diligence and lack of proper risk management. After the FFIEC receives comments from the public regarding the guidance, the agencies that supervise the financial institutions will issue the guidance as supervisory to the institutions that they oversee. Thus, the guidance is intended to assist financial institutions with their risk management practices and is designed to address the legal, compliance and reputational risks arising out of the use of social media.

The Ways Social Media Is Utilized by Financial Institutions

The guidance highlights the fact that financial institutions utilize social media in a number of ways to interact with customers. For example, social media may be used for advertising and marketing initiatives, facilitating applications for new accounts and communicating with customers. Social media may also be used to respond to complaints or provide loan pricing. The varied use of social media by financial institutions implicates diverse regulatory regimes and also highlights legal, operational, reputational and security risks.

Methods Financial Institutions Can Use To Mitigate Social Media Risks

The guidance highlights a number of key steps that a financial institution can take to identify and mitigate the risks associated with social media.

• Have a Risk-Management Program 

First, the guidance emphasizes financial institutions utilizing social media should consider implementing a risk-management program to identify, measure, monitor and control the risks associated with social media. The complexity of the risk-management program should be directly related to the extent of the financial institution’s utilization of social media. The program should be designed with input from human resources, marketing, information technology, legal and compliance.

A good risk-management program would include a number of components. First, the program would provide a governance structure with clear roles and responsibilities in which the board would direct how social media contributes to institutional goals. Second, the program would have policies and procedures regarding how social media would be utilized consistent with current regulations. Third, the program would have a due diligence procedure in place for managing the relationship with the social media provider. Fourth, the program would include employee training regarding the proper use of social media. Fifth, the program would have an oversight process for monitoring information posted to the institution’s social media site. Sixth, an audit and compliance function should be put in place to ensure that the program complies with all applicable regulations. Finally, the program should have appropriate parameters in place to allow for reporting to the board of directors regarding the effectiveness of the social media program.

• Evaluate Compliance and Legal Risks

The guidance highlights how a financial institution can be exposed to legal risks for improperly using social media when interacting with customers. If a financial institution is utilizing social media to engage in lending, deposit services or payment activities, the financial institution should be aware of applicable laws and regulations and follow them accordingly. Such laws and regulations include the Truth in Savings Act, Fair Lending Laws like the Equal Credit Opportunity Act and Fair Housing Act, the Truth in Lending Act, the Real Estate Settlement Procedures Act, the Fair Debt Collection Practices Act and the Gramm-Leach-Bliley Act. To the extent that a financial institution is utilizing social media to communicate with its customers, it should consider putting in place a system to evaluate changing laws and regulations to try and ensure that its use of social media comports with applicable regulations.

• Manage Reputational Risks

A financial institution can be exposed to reputational risks when it engages in social media activities. The brand of a financial institution can be impacted by comments made by social media users and the acts of fraudsters posing as the institution. Thus, the guidance urges financial institutions to consider utilizing social media monitoring tools.

If a financial institution utilizes a third party to conduct its social media activities, it needs to be aware of the risks arising out of problems caused by the third party. The financial institution may be at fault where the third party causes a breach of protocol.

Reputational risks can also arise where consumers use social media to complain about the practices of the institution, post inaccurate information or initiate an error dispute. Monitoring software that can identify discussions concerning the financial institution is one way to help mitigate any reputational risks.

Finally, financial institutions should try to be aware of the fact that the use of social media by employees—even through personal accounts—could be viewed as the official activity of the institution. Therefore, financial institutions can consider having policies in place to address employee participation in social media that implicates the financial institution.

• Manage Operational Risks

Operational risks are created when a financial institution utilizes social media. The social media site could be hacked. The hacker could then use the social media site to distribute malware to customers of the institution. To minimize risk, financial institutions may also consider having appropriate security safeguards in place to protect systems from hackers and malware. Furthermore, the institution could develop an incident-response protocol in the event of a security breach.

Social media is a powerful tool that financial institutions can utilize to communicate with their customers, market new product lines and attract additional customers. While many financial institutions are embracing the use of social media as a powerful marketing and developmental tool, monitoring the changing regulatory environment is an important aspect of mitigating potential risk. Ensuring that the utilization of social media meets regulatory, security and operational risks will help financial institutions reap the benefits of social media while mitigating the liabilities.