Int. No. 1406

By Council Member Espinal

A Local Law to amend the administrative code of the city of New York, in relation to requiring certain security measures at nonbank ATMS

Be it enacted by the Council as follows:

Section 1. Chapter 4 of title 20 of the administrative code of the city of New York is amended by adding a new subchapter 13 to read as follows:

SUBCHAPTER 13

Nonbank ATMs

§ 20-699.7 Definitions

§ 20-699.8 Placement agreement

§ 20-699.9 Security measures

§ 20-699.10 Exemptions

§ 20-699.11 Banking regulations

§ 20-699.12 Penalties

§ 20-699-13 Rules and regulations

§ 20-699.7 Definitions. For purposes of this subchapter, the following terms have the following meanings:

ATM. The term “ATM” stands for automated teller machine and means a device that is linked to the accounts and records of a banking institution, and enables consumers to conduct banking transactions, including but not limited to account transfers, deposits, cash withdrawals, balance inquiries and loan payments.

Skimming device. The term “skimming device” means a device made to affix to any part of an ATM to secretly read and record or transmit any information on banking transactions made at the ATM, including credit card number, debit card number, personal identification number, withdrawal amount, bank balance or any other information exchanged or communicated between the ATM and the person using the ATM. The term “skimming device” includes any magnetic strip, camera, touchscreen overlay, keypad overlay, and any other device installed to capture data.

Distributor. The term “distributor” means a person who owns, invests in or leases a nonbank ATM that is installed at a location or premises and made available to the public. A distributor who owns or leases the location or premises where a nonbank ATM is installed and made available to the public is both the distributor and the merchant with regard to that nonbank ATM.

Merchant. The term “merchant” means an owner or lessee of a location or premises where a nonbank ATM is installed and made available to public. A merchant who owns, invests in or leases a nonbank ATM that is installed and made available to the public on a location or premises owned or leased by the merchant is both the merchant and the distributor with regard to that nonbank ATM.

Nonbank ATM. The term “nonbank ATM” means an ATM that is not under the dominion and control of any federally or state chartered bank or lending institution. The term “nonbank ATM” includes ATMs that are commonly found in convenience stores, grocery stores, gas stations and other commercial establishments.

Placement agreement. The term “placement agreement” means a written contract between a distributor and a merchant, and signed by all parties, concerning the placement, operation and security measures of a nonbank ATM. For a person who is both the distributor and the merchant of the same nonbank ATM, the term “placement agreement” shall mean a written procedure, signed by that person, concerning the placement, operation and security measures of that nonbank ATM.

§ 20-699.8 Placement agreement. a. A placement agreement must detail the following information:

1. Parties to the agreement. The placement agreement shall list the name and business address of all parties to the agreement. The placement agreement may also list the business telephone, business e-mail and business website, as such are available, of all parties to the agreement.

2. Placement of nonbank ATM. The placement agreement shall identify the specific point within the location or premises where the nonbank ATM is installed with sufficient detail to allow easy identification of the nonbank ATM.

3. Security measures. The placement agreement must detail the terms of the agreement between parties for maintaining compliance with the security measures contained in section 20-699.9 of this code. Such details must include the apportioning of responsibility for any failure to maintain security measures. If such details are not sufficiently defined in the placement agreement, the distributor shall be liable for any failure to maintain security measures.

4. A signed copy of the placement agreement shall be kept on file by all signatories of the placement agreement and shall be produced upon request by the commissioner.

                     b. A placement agreement is required for each non-bank ATM.

                     1. No distributor may allow a nonbank ATM to be made available to the public without entering into a placement agreement with the merchant of the location or premises where the nonbank ATM is installed and made available to the public.

2. No merchant may allow a nonbank ATM to be installed on their location or premises without entering into a placement agreement with the distributor of the nonbank ATM.

3. No person who is both the merchant and the distributor of a nonbank ATM may allow a nonbank ATM to be installed on their location or premises without first completing a placement agreement.

§ 20-699.9 Security measures. The distributor and the merchant of a nonbank ATM must maintain the following security measures for the nonbank ATM:

a. Surveillance camera. A surveillance camera shall view and record all persons entering a nonbank ATM located within the interior of a building, or shall view and record all activity occurring within a minimum of three feet in front of a nonbank ATM located outside a building and open to the outdoor air. Such camera shall not record banking transactions made at the nonbank ATM. The quality of video surveillance must be sufficient to allow identification of persons recorded. The recordings made by such cameras shall be preserved by the distributor or merchant, as agreed in the placement agreement, for at least 60 days.

b. Adequate lighting. A light source shall provide adequate lighting at a nonbank ATM in accordance with the following:

1. For a nonbank ATM located within the interior of a building, lighting that is sufficient to permit a person entering such location or premises to readily and easily see all persons occupying such location or premises, and sufficient to permit a person inside such location or premises to readily and easily see all persons at the entry door of such location or facility. Adequate lighting required by this paragraph must be provided on a 24-hour basis.

2. For a nonbank ATM open to the outdoor air, including a nonbank ATM that is accessed by a person from a sidewalk or parking lot, lighting that is sufficient to provide:

(a) A minimum illuminance of five lumens per square foot maintained on a horizontal plane, measured at a point five feet outward from and five feet above the ground surface from the nonbank ATM;

(b) A minimum illuminance of two lumens per square foot maintained on a horizontal plane, measured at ground level, at a point 30 feet in all unobstructed directions from the nonbank ATM; and

(c) A minimum illuminance of one lumen per square foot maintained on a vertical plane, measured at five feet above ground level with the normal to the plane of measurement aimed at a light source, at a point 60 feet in all unobstructed directions from the nonbank ATM.

(d) A nonbank ATM as described by this paragraph that is not in compliance with the standards set forth in subparagraph (b) or (c) of this paragraph, a minimum illuminance of two lumens per square foot, measured on a horizontal plane at five feet above ground level, maintained at 50 feet in all unobstructed directions from the nonbank ATM.

Adequate lighting required by this paragraph shall be provided during the period starting 30 minutes before sunset until 30 minutes after sunrise.

c. Periodic inspection for a skimming device. A nonbank ATM shall be periodically inspected to ensure there are no skimming devices installed on the nonbank ATM. The placement agreement shall detail the frequency of such inspections and the person responsible for performing the inspections, except that the minimum frequency of inspection must be once per every 24-hour period. If a skimming device is found, the person who finds it shall make a record of the time and date of discovery, and shall immediately report the discovery to the local police precinct. Record of the discovery and report to local police precinct must be kept for at least 60 days.

                     § 20-699.10 Exemptions. The following are exempt from the requirements of this subchapter:

a. Any financial institution regulated by federal or state banking laws.

b. Any person providing ATM services to a financial institution regulated by the federal reserve board, the federal deposit insurance corporation, the comptroller of the currency, the United States office of thrift supervision, the national credit union administration, or the state of New York or any of its agencies where the state enforces security requirements similar to this subchapter.

§ 20-699.11 Banking regulations. This subchapter does not affect bank accounts or modify, amend, suspend, supersede or cancel any federal or state banking procedure or regulation.

§ 20-699.12 Penalties. Any person who violates any provision of this subchapter or any rule promulgated pursuant thereto is subject to a civil penalty of not more than $200 for a first violation and not more than $500 for each subsequent violation within 24 months of the first violation. All proceedings authorized pursuant to this section shall be conducted in accordance with rules promulgated by the commissioner. The remedies and penalties provided in this section shall be in addition to any other applicable remedy or penalty provided by law.

§ 20-699-13 Rules and regulations. The commissioner is authorized to promulgate such rules and regulations as necessary to implement the provisions of this subdivision.

§ 2. This local law takes effect 120 days after enactment, except that the commissioner may take any action necessary for the implementation of this local law, including the promulgation of rules, prior to that date.

LUR
LS 6929
11/7/2016