We have created our own website compliance checklist based on a list provided by the CUNA Marketing Council and Chris Collver of the Credit Union Digest, the publication of the California and Nevada Credit Union Leagues. As with all checklists, they are only as good as your in-house legal counsel - so run it by them first!

Logos and Photos

• Do any pages have materials with copyrights, trademarks, or service marks (including photos or drawings)? Make sure you have appropriate approvals to use or link to these materials. This is more important than you think. I have a client who is a law firm that was fined $5,000 for one picture on their website that they couldn't prove that they had rights to use. All of our photos that we provide, are backed by a licensing agreement that we keep on the premises.
• Is the NCUA advertising statement—or its short version, accompanied by the NCUA logo—on all pages advertising deposit account products? (§740.5 of NCUA Rules and Regulations).
• Is the Equal Housing logo on all pages advertising real estate-related loans? Even better, just put it on all pages in case you have an ad or a new page created - you don't have to worry about it.
• Subliminal Discrimination? Look at tall the images of your site for the possibility of encouraging some types of applications and discouraging others on any prohibited basis (§701.31 of NCUA Rules and Regulations and §202.5 of Regulation B). 

Disclosures and Notices

• Is your privacy notice conspicuous and easy to find? Does it match the board-approved notice/policy? We like to place these at the footer of all the pages. Never make your member search for privacy notice or other disclosures.
• Review any pages offering loan products to ensure compliance with Regulation Z requirements. Be on the lookout for the use of any trigger terms that require the need for additional disclosures (e.g., any reference to a loan term on a closed-end loan triggers the requirement to include the terms of repayment). Also, make sure any related disclosures are noticeable, either by including them on the same screen, or providing a clearly marked link to them (§226.16 and §226.24 of Regulation Z).
• Review any pages promoting deposit accounts to ensure compliance with Truth-in-Savings requirements. Pay particular attention to triggering terms, as well as use of the word “free.” (§707.8 of NCUA Rules and Regulations)
• Be sure your site advertises terms that will actually be available, especially when rates are increasing or decreasing. The easiest way to do this is by maintaining your rates yourself! Our CMS product allows that quickly and easily.
• Does your site have a separate children's area or does your credit union have a separate children's site.? The portion of your website that collects information from children under 13 must be compliant with the Children's Online Privacy Protection Act (COPPA). 
• Are non-deposit investment products advertised? If so, make sure the disclosures required by NCUA Letter to Credit Unions No. 150 are followed. This is another item to just place at the bottom of all pages. Better safe than sorry!
• Are other disclosures presented in a clear and conspicuous manner? Have a disclosures section of your site as a clearing house for all disclosures in text or PDF format.

General

• Are there links to third parties? If so, do the links imply endorsement of third-party products or services? Have you reviewed the security and privacy policies of the linked third parties? We use a "speed-bump" type linking notification window. This forces your member to acknowledge that they understand that they are visiting a 3rd party vendor and leaving the credit union website and sphere of influence.
• Do calculators and links operate accurately? Are they from a trusted source? Are they accurate? Are errors in calculations covered by a disclosure statement?
• Has all information been through an advertising clearance process (review) before posting? This means Marketing, Legal AND the department directly responsible for the advertising piece have all signed off on it.

If you are running online transactional services through your website (e.g., home banking, online applications, remote deposit capture), then you must be aware of compliance issues such as Bank Secrecy Act (e.g., Member Identification Program, Suspicious Activity Reports), OFAC, rules regarding accepting applications, delivery of account or loan disclosures, compliance with E-Sign provisions, and providing check hold notices. Not to mention that good old Patriot Act.

Chris Collver is a legislative and regulatory analyst with the California and Nevada Credit Union Leagues and not affiliated with Andermahr & Company or this website or it's products.