Pub. 2 2014 Issue 1

www.uba.org 10 A lthough social media is a relatively young force within U.S. culture, it has transformed the way businesses operate. As a result, no company can afford to neglect social media when it comes to conducting business, especially in advertising and marketing efforts. Even though banks and credit unions are often conservative, and are perhaps slower to jump on cultural bandwagons than some other industries, the time for holding back from this particular trend is now over. Most companies have an online website; most employees, especially management, are likely to use smart phones and tablets and will usually have accounts on major social media websites such as LinkedIn, Twitter, and Facebook. In short, you real- ly do need to have policies and procedures ready to provide much-needed guidance about social media usage for management and staff. The first step is studying what the experts have to say on the subject. Several guide- lines are available: • The Federal Financial Institutions Examination Council (FFIEC) recently (December 11, 2013) pub- lished a Financial Institution Letter report, “Consumer Compliance Risk Management Guidance,” on the use of social media by banks, savings institutions and credit unions. • The Financial Industry Regulatory Authority (FINRA) published Regu- latory Notice 10-06 in January 2010. • The Federal Trade Commission (FTC) published “Guides Concern- ing the Use of Endorsements and Testimonials in Advertising” in October 2009. All three of these documents are relatively short and may well be worth your time to read. The FFIEC document and the FTC document are both 12 pages for example, and the FINRA document is 10 pages (with the last bit of text appearing on page 9). The following sections provide a brief summary of the main points. FFIEC The FFIEC document has the following purposes: • Helping you to understand and man- age the risks of social media. • Educating you about your responsi- bilities under current requirements. Specifically, FFIEC has made it plain that consumer protection laws and compliance laws and regulations apply to activities conducted through social media for financial institu- tions. • Reminding you that you have a responsibility to address the risks associated with activity on social media. The FFIEC document does not contain any new requirements to be followed. It is organized as follows: • Purpose: Industry participants asked for this guidance because they wanted to know what the members of the FFIEC would suggest for cre- ating appropriate risk management programs. Final responsibility lies The New Social Media Guidelines Why You Need Social Media Policies and Procedures By Sophie B. Hanson, the newsLINK Group, LLC with U.S. financial institutions, not with the members of the FFIEC, but this document contains the current advice and recommendations from the FFIEC and has been adopted by its member agencies. • Background: This section provides a summary of current social media and ways in which financial institu- tions might make use of it. • Risk management programs: All financial institutions can benefit from having a risk management program. The size and complexity of that program depend on the financial institution’s involvement; logically enough, a regional bank with little or no social media involvement does not need as big a program as a bank that has developed a heavy reliance on social media. The section about risk management programs outlines program basics, such as governance structure, policies and procedures, employee training, oversight, and audits. • Risk areas: This is by far the longest section of the report and is essential- ly a laundry list to help financial in- stitutions assess what their own risks might be. It contains 33 footnotes and a short conclusion (the conclu- sion being that if you assess the risks and implement a program to reduce them, your financial institution will benefit from that). One of the risk areas listed in the FFIEC document is about employees who use social media websites, but it only consists of a single paragraph. The FINRA and FTC documents both deal with this subject in more detail. The FINRA document ad- dresses employee’s business use of social media, not their personal use. The FTC document fills in some of that gap. FINRA The FINRA document has information on social networking and blogs. It is orga- nized as follows: • Executive summary: The executive summary explains why this doc- ument was prepared (just like the FFIEC document, different busi- nesses had asked for guidance) and provides contact information so you can get answers to any addition- al questions you might have after reading it. • Background: This section explains that, as a result of increasing social-media usage throughout