Certain geographic areas have more instances of debit card fraud than others. Can we change our rules to require customers living in those areas to use a PIN when using a debit card as a credit card? If so, do we need to disclose the change?

Requiring the use of debit cards PINs only for customers residing in particular geographic areas (here, areas with higher crime rates) could raise concerns under the fair lending laws. Although residents located in specific geographic areas are not per se protected classes based on their locations, a practice singling out particular geographic areas could result in a disparate impact on one or more protected classes.

While this practice would apply only to debit cards, and the fair lending laws apply only to credit products, it is readily conceivable that the Department of Justice, the CFPB, the prudential regulators or affected persons could press for a disparate impact analysis in this context. For example, if the debit cards incorporate overdraft features, then the Equal Credit Opportunity Act and other fair lending laws would directly apply.

Even without any credit features, it is conceivable that a clearly established result of disparate impact could be argued to be a UDAAP violation. We recommend consulting with your bank counsel, and at least being sensitive to the potential for disparate impact scrutiny of this practice. The FFIEC Interagency Fair Lending Procedures include a helpful explanation of the disparate impact concept and how institutions can mitigate the risks of a disparate impact finding. The FFIEC procedures state that a policy resulting in a disparate impact can be justified by a “business necessity,” with documentation of any factors that went into deciding the policy. The FFIEC’s approach could be helpful in understanding disparate impact in this context.

If your bank does proceed with this contemplated change, we recommend providing at least 21 days advance notice of the change. Regulation E requires the delivery of written notice to consumers at least 21 days before making changes that restrict the “types of available electronic fund transfers” for an account. By limiting certain customers to PIN-based transactions, we believe that this practice would trigger the 21-day advance notice requirement. Additionally, we recommend checking for disclosure requirements stemming from the Visa or MasterCard rules, if applicable.

For resources related to our guidance, please see:

Equal Credit Opportunity Act, 15 USC 1691 (“It shall be unlawful for any creditor to discriminate against any applicant, with respect to any aspect of a credit transaction—(1) on the basis of race, color, religion, national origin, sex or marital status, or age (provided the applicant has the capacity to contract); (2) because all or part of the applicant’s income derives from any public assistance program; or (3) because the applicant has in good faith exercised any right under this chapter.”)

Equal Credit Opportunity Act, 15 USC 1691a(d) (“The term ‘credit’ means the right granted by a creditor to a debtor to defer payment of debt or to incur debts and defer its payment or to purchase property or services and defer payment therefor.”)

FFIEC Interagency Fair Lending Procedures, page iv (“When a lender applies a racially or otherwise neutral policy or practice equally to all credit applicants, but the policy or practice disproportionately excludes or burdens certain persons on a prohibited basis, the policy or practice is described as having a ‘disparate impact.’ . . . The fact that a policy or practice creates a disparity on a prohibited basis is not alone proof of a violation. When an Agency finds that a lender’s policy or practice has a disparate impact, the next step is to seek to determine whether the policy or practice is justified by ‘business necessity.’ The justification must be manifest and may not be hypothetical or speculative. Factors that may be relevant to the justification could include cost and profitability. Even if a policy or practice that has a disparate impact on a prohibited basis can be justified by business necessity, it still may be found to be in violation if an alternative policy or practice could serve the same purpose with less discriminatory effect.”)

Regulation E, 12 CFR 1005.8(a)(1)(iii) (“A financial institution shall mail or deliver a written notice to the consumer, at least 21 days before the effective date, of any change in a term or condition . . . if the change would result in: . . . (iii) Fewer types of available electronic fund transfers; . . .”)