Proposed Int. No. 80-A
By Council Members Gioia, Gentile, Nelson, Sanders Jr., Stewart, Weprin and Liu
A Local Law to amend the administrative code of the city of New York, in relation to registering private ATM machines.
Be it enacted by the Council as follows:
Section 1. Legislative declaration.
The Council finds that acts of identity theft are plaguing New Yorkers. Federal Trade Commission statistics indicate that identity theft is the single most common consumer fraud complaint in the nation. The Federal Trade Commission reported that between 1998 and 2003, 27.3 million Americans were wronged by identity theft. Nationwide, identity theft costs businesses and consumers roughly $50 billion per year. In New York City in 2003, there were more than 10,000 reported victims of identity theft. New York City has the ninth highest per capita incidence of identity theft among major metropolitan areas nationwide, and approximately two-thirds of the reported cases of identity theft in New York State originate in New York City.
Identity thieves are constantly developing new methods to harm consumers. One disturbingly easy method of obtaining personal identifying and financial information involves “skimming,” or swiping an Automated Teller Machine (“ATM”) card or credit card in a device programmed to steal the data encoded in the card. Skimming is often accomplished with a hand-held device or through an instrument installed in a seemingly innocuous ATM. A significant cause of the problem is that, unlike bank-operated ATMs, private ATMs located in places such as grocery stores, nightclubs and gas stations are not regulated by federal or state law, and therefore are vulnerable to manipulation by unscrupulous machine operators or third parties. In addition, because no permit is required for private ATMs, their operators are currently largely untraceable and law enforcement efforts to investigate potential sources of identity and monetary theft are severely handicapped.
In 2003, approximately $1 trillion was transacted through the country’s approximately 375,000 Automated Teller Machines. Of that $1 trillion, roughly $50 million was stolen. A recent City Council investigation found that there are more than 1,500 unlicensed, unregistered and unregulated ATMs in New York City’s delicatessens and convenience stores alone, and that private ATMs can be leased for as little as $75 a month and purchased for as little as $1,000.
The Council finds that legislation requiring the registration of private ATMs, which are those leased to many businesses throughout the city but not regulated by the state or federal governments, would enable law enforcement to better monitor their use and would deter the manipulation of these machines by wrongdoers. County governments in the New York City area have enacted similar legislation.
§2. The administrative code of the City of New York is amended by adding a new subchapter 13 to chapter 4 of title 20 to read as follows:
SUBCHAPTER 13
AUTOMATED TELLER MACHINES
§20-699.7 Definitions.
§20-699.8 Registering private ATMs.
§20-699.9 Terms; Applicable fees.
§20-699.10 Requirements for registered ATMs.
§20-699.11 Contracts between ATM distributors and operators.
§20-699.12 Electronic fund transfers.
§20-699.13 Exemptions.
§20-699.14 Banking regulations.
§20-699.15 Penalties.
§20-699.16 Severability.
§20-699.7 Definitions. Whenever used in this subchapter:
a. “Private Automated Teller Machine” (“private ATM”) means any device linked to the accounts and records of a banking institution that enables consumers to carry out banking transactions, including, but not limited to, account transfers, deposits, cash withdrawals, balance inquiries, and loan payments, that is not subject to federal or state banking regulations and that is not under the dominion and control of any federally or state chartered bank or lending institution, including, but not limited to, any trust company, savings bank, savings and loan association or credit union.
b. “Private ATM provider” means any person, organization, firm, partnership or company offering a private ATM for public use. This term shall not include any electronic funds transfer network or any federally or state chartered bank or lending institution.
c. “Distributor” means a person, other than a private ATM provider, who owns, invests in, or leases a private ATM, or enters into a private ATM placement agreement with a merchant and subsequently contracts with a private ATM provider for operating the private ATM.
d. “ATM placement agreement” means any contract between a merchant and a private ATM provider, or between a merchant and distributor representing a private ATM operator, concerning the operation of a private ATM at a specified site, including the merchant’s place of business.
e. “Bank account” means any fund, account or other entity into which an individual may deposit money where it is governed by state and/or federal banking laws and exchange commission rules.
f. “Books and records” means a private ATM provider registeree applicant’s most recent federal income tax return or, if the applicant has not previously filed tax returns, the tax returns of its principals, its general partners, or a majority of its shareholders. Said term shall also include a financial statement provided by the applicant, including a balance sheet and income statement.
g. “Consumer” or “customer” means a person or other entity conducting a transaction at a private ATM.
h. “EFT network” means one or more electronic funds transfer networks that are available to financial institutions, enabling the transfer of funds in and out of a patron’s bank account when the patron engages in a sale, return or similar monetary transaction.
i. “Enforcing agent” means the Department of Consumer Affairs, the office of the New York State Attorney General, the District Attorney’s Office and the New York Police Department.
j. “Financial institution” means a bank, savings association, credit union or any affiliate or subsidy thereof, which is recognized as such by the federal Gramm-Leach Bliley Act of 1999 (12 U.S.C. sec. 1811).
k. “Merchant” means an owner or lessee of the location or premises at which a private ATM is installed and made available to the merchant’s customers or invitees. A merchant may own or lease a private ATM without being deemed a distributor, provided that the private ATM is intended solely for use at that merchant’s location or premises and is used at the location specified on the merchant’s application.
l. “Monetary transaction” means accessing an account at a financial institution with a credit, debit or other bank card at a private ATM for the purpose of making cash withdrawals, balance inquiries, deposits, fund transfers between accounts, or any other account transaction.
m. “Operating an ATM” means maintaining or providing the connection of a private ATM to any EFT network, regardless of who holds legal or equitable title in and to the private ATM.
n. “PIN” means personal identification number, a series of numbers that identifies the individual account card holder and permits use of the ATM machine.
o. “Sponsorship agreement” means any agreement between a financial institution and the private ATM provider that governs the operation of a private ATM within an EFT network.
§20-699.8 Registering private ATMs.
a. Every private ATM provider, distributor, or merchant operating a private ATM available for other than private use, and every private ATM in service, shall register with the department, except as otherwise provided by section 20-699.13 of this subchapter.
b. If the private ATM provider or distributor is also registered with at least one EFT network through a sponsorship agreement with a financial institution that is a member of the EFT network, such EFT registration information shall accompany private ATM registration maintained by with the department. Every subsequent ATM registered with the department by an individual or business shall reference such sponsorship agreement, and shall contain any and all new information not presented with such prior registrations.
c. All registrations under this subchapter must contain all information as required by the department to effectuate and enforce the provisions herein.
d. Upon payment of the registration fee the commissioner shall issue a decal to the provider, distributor or merchant operating a private ATM to be securely affixed to a conspicuous and indispensable part of the ATM, on which shall be clearly set forth the registration number of the ATM and the date on which said registration expires. Such decal shall be of such material, form, design and dimension and set forth such distinguishing number or other identification marks as the commissioner shall prescribe. The commissioner upon renewal of the registration hereunder may continue the use of the decal for as many additional registration years as he or she in his or her discretion may determine, in which event he or she shall issue and deliver to the registeree a replaceable date tag as evidence of renewal of the registration, which shall be attached or affixed in such manner as he or she may prescribe by rule. The failure to affix or display such date tag in a manner prescribed by the commissioner shall constitute a violation of this section. In the event of the loss, mutilation or destruction of any decal or date tag issued hereunder, the owner may file such statement and proof of facts as the commissioner shall require, with a fee established by the department, and the department shall issue a duplicate or substitute decal or date tag.
e. Whenever a private ATM is moved from its current registered site to another location, the ATM provider must notify the department within five (5) business days of the change in location.
f. All private ATMs placed prior to the enactment of this law must submit the
appropriate application, in the form prescribed by the department, within ninety (90) days of the law’s effective date.
§20-699.9 Terms; Applicable fees.
a. The term of this registration shall be three (3) years.
b. All fees in relation to the registration for, and renewal of, registrations pursuant to this chapter shall be assessed and collected by the department pursuant to the rules promulgated hereto.
§20-699.10 Requirements for registered ATMs. All ATM operators, distributors and merchants shall:
a. Maintain and file such records as are required pursuant to the rules promulgated by the department to effectuate the provisions of this subchapter;
b. Comply with all EFT network operating rules and all local, state and federal regulations governing the operations of private ATMs;
c. Maintain inventory procedures identifying the location of the private ATMs that it operates or has distributed or possesses, that are available for use by the public;
d. Operate or distribute private ATMs only pursuant to a written agreement and only with merchants that are legally authorized to conduct business in the state of New York and New York City, and file a copy of such agreements, along with any modifications, with the department;
e. Conspicuously post on each private ATM the decal to be issued by the commissioner as required by §20-699.8(d) bearing the registration number of the ATM and the date on which said registration expires, and any additional information as may be required by the commissioner at his or her discretion.
f. Conspicuously post on each private ATM a notice in at least 20-point type setting forth:
1. the name of the merchant and private ATM provider or distributor;
2. the telephone number of the private ATM provider or distributor;
3. the telephone number of the department, or any other citywide hotline number by which complaints or inquiries can be registered with the department, presently 311;
4. a telephone number by which complaints or inquiries concerning identity theft can be registered with the Federal Trade Commission, presently 877-ID-THEFT;
5. the fee charged in connection with the use of the private ATM and the maximum dollar amount that may be withdrawn in a single transaction; and
6. the following statement: “Protect your identity: Safeguard your card and PIN and take your receipt.”
g. Provide each customer using a private ATM with the option to receive, immediately upon completion of each transaction, a printed receipt setting forth the exact address at which the private ATM is located; the registration number of the private ATM; the nature of the transaction completed by the customer; and the amount of money transacted by the customer.
§20-699.11 Contracts between ATM distributors and operators. A distributor must supply the private ATM provider with the following before the parties may enter a private ATM placement agreement:
a. The distributor’s full legal name and any trade name under which the distributor is conducting business;
b. the distributor’s federal and state income tax identification numbers and, if the distributor is a sole proprietorship, his or her social security number.
§20-699.12 Electronic fund transfers. Nothing in this local law shall be interpreted or construed to modify, amend, suspend, supersede, or cancel any EFT network rule or regulation.
§20-699.13 Exemptions. The following entities are exempt from the requirements of this local law, unless they are operating in the private ATM field:
a. Any financial institution regulated by federal or state governments.
b. Any subsidiary or affiliate of any financial institution regulated by federal or
state governments.
c. Any person providing ATM services to a financial institution regulated by the Federal Reserve Board, the Federal Deposit Insurance Corporation, the Comptroller of the Currency, the U.S. Office of Thrift Supervision, the National Credit Union Administration, or the state of New York or any of its departments where the state requires the information required by this local law.
§20-699.14 Banking regulations. This local law shall have no effect on bank accounts, federal and state banking procedures, or banking regulations.
§20-699.15 Penalties.
a. Notwithstanding any other provision of law, the department shall be authorized, upon due notice and hearing, to impose civil penalties for the violation of any provision of this subchapter. The department shall have the power to render decisions and orders and to impose civil penalties not to exceed the amounts specified in section 20-726 of the administrative code. All proceedings authorized pursuant to this paragraph shall be conducted in accordance with rules promulgated by the commissioner. The remedies and penalties provided for in this section shall be in addition to any other remedies or penalties provided for the enforcement of such provisions under any other law including, but not limited to, civil or criminal actions or proceedings.
b. All such proceedings shall be commenced by the service of a notice of violation returnable to the administrative tribunal of the department. The commissioner shall prescribe the form and wording of notices of violation. The notice of violation or copy thereof when filled in and served shall constitute notice of the violation charged, and, if sworn to or affirmed, shall be prima facie evidence of the facts contained therein.
§20-699.16 Severability. If any section, subsection, sentence, clause, phrase or other portion of this local law is, for any reason, declared unconstitutional or invalid, in whole or in part, by any court of competent jurisdiction, such portion shall be deemed severable, and such unconstitutionality or invalidity shall not affect the validity of the remaining portions of this law, which remaining portions shall continue in full force and effect.
§3. This local law shall take effect one hundred and twenty (120) days after it shall have been enacted into law; provided that the commissioner may take any actions necessary prior to such effective date for the implementation of this local law including, but not limited to, the adoption of any necessary rules.
LCC
6/5/08