This subpart applies to a national bank's use of technology to deliver services and products consistent with safety and soundness.

In addition to the electronic activities specifically permitted in § 7.5004 (sale of excess electronic capacity and by-products) and § 7.5006 (incidental non-financial data processing), the OCC has determined that the following electronic activities are incidental to the business of banking, pursuant to § 7.1000. This list of activities is illustrative and not exclusive; the OCC may determine that other activities are permissible pursuant to this authority.

(a) Website development where incidental to other banking services;

(b) Internet access and email provided on a non-profit basis as a promotional activity;

(c) Advisory and consulting services on electronic activities where the services are incidental to customer use of electronic banking services; and

(d) Sale of equipment that is convenient or useful to customer's use of related electronic banking services, such as specialized terminals for scanning checks that will be deposited electronically by wholesale customers of banks under the Check Clearing for the 21st Century Act, Public Law 108-100 (12 U.S.C. 5001-5018) (the Check 21 Act).

(a) Use of electronic means and facilities. A national bank may perform, provide, or deliver through electronic means and facilities any activity, function, product, or service that it is otherwise authorized to perform, provide, or deliver, subject to § 7.5001(b) and applicable OCC guidance. The following list provides examples of permissible activities under this authority. This list is illustrative and not exclusive; the OCC may determine that other activities are permissible pursuant to this authority.

(1) Acting as an electronic finder by:

(i) Establishing, registering, and hosting commercially enabled web sites in the name of sellers;

(ii) Establishing hyperlinks between the bank's site and a third-party site, including acting as a “virtual mall” by providing a collection of links to web sites of third-party vendors, organized by-product type and made available to bank customers;

(iii) Hosting an electronic marketplace on the bank's Internet web site by providing links to the web sites of third-party buyers or sellers through the use of hypertext or other similar means;

(iv) Hosting on the bank's servers the Internet web site of:

(A) A buyer or seller that provides information concerning the hosted party and the products or services offered or sought and allows the submission of interest, bids, offers, orders and confirmations relating to such products or services; or

(B) A governmental entity that provides information concerning the services or benefits made available by the governmental entity, assists persons in completing applications to receive such services or benefits and permits persons to transmit their applications for such services or benefits;

(v) Operating an Internet web site that permits numerous buyers and sellers to exchange information concerning the products and services that they are willing to purchase or sell, locate potential counter-parties for transactions, aggregate orders for goods or services with those made by other parties, and enter into transactions between themselves;

(vi) Operating a telephone call center that provides permissible finder services; and

(vii) Providing electronic communications services relating to all aspects of transactions between buyers and sellers;

(2) Providing electronic bill presentment services;

(3) Offering electronic stored value systems;

(4) Safekeeping for personal information or valuable confidential trade or business information, such as encryption keys; and

(5) Issuing electronic letters of credit within the scope of 12 CFR 7.1016.

(b) Applicability of guidance and requirements not affected. When a national bank performs, provides, or delivers through electronic means and facilities an activity, function, product, or service that it is otherwise authorized to perform, provide, or deliver, the electronic activity is not exempt from the regulatory requirements and supervisory guidance that the OCC would apply if the activity were conducted by non-electronic means or facilities.

(c) State laws. As a general rule, and except as provided by Federal law, State law is not applicable to a national bank's conduct of an authorized activity through electronic means or facilities if the State law, as applied to the activity, would be preempted pursuant to traditional principles of Federal preemption derived from the Supremacy Clause of the U.S. Constitution and applicable judicial precedent. Accordingly, State laws that stand as an obstacle to the ability of national banks to exercise uniformly their Federally authorized powers through electronic means or facilities, are not applicable to national banks.

Unless otherwise prohibited by Federal law, a national bank may engage in an electronic activity that is comprised of several component activities if each of the component activities is itself part of or incidental to the business of banking or is otherwise permissible under Federal law.

(a) A national bank may, in order to optimize the use of the bank's resources or avoid economic loss or waste, market and sell to third parties electronic capacities legitimately acquired or developed by the bank for its banking business.

(b) With respect to acquired equipment or facilities, legitimate excess electronic capacity that may be sold to others can arise in a variety of situations, including the following:

(1) Due to the characteristics of the desired equipment or facilities available in the market, the capacity of the most practical optimal equipment or facilities available to meet the bank's requirements exceeds its present needs;

(2) The acquisition and retention of additional capacity, beyond present needs, reasonably may be necessary for planned future expansion or to meet the expected future banking needs during the useful life of the equipment;

(3) Requirements for capacity fluctuate because a bank engages in batch processing of banking transactions or because a bank must have capacity to meet peak period demand with the result that the bank has periods when its capacity is underutilized; and

(4) After the initial acquisition of capacity thought to be fully needed for banking operations, the bank experiences either a decline in level of the banking operations or an increase in the efficiency of the banking operations using that capacity.

(c) Types of electronic capacity in equipment or facilities that banks may have legitimately acquired and that may be sold to third parties if excess to the bank's needs for banking purposes include:

(1) Data processing services;

(2) Production and distribution of non-financial software;

(3) Providing periodic back-up call answering services;

(4) Providing full Internet access;

(5) Providing electronic security system support services;

(6) Providing long line communications services; and

(7) Electronic imaging and storage.

(d) A national bank may sell to third parties electronic by-products legitimately acquired or developed by the bank for its banking business. Examples of electronic by-products that banks may have legitimately acquired that may be sold to third parties if excess to the bank's needs include:

(1) Software acquired (not merely licensed) or developed by the bank for banking purposes or to support its banking business; and

(2) Electronic databases, records, or media (such as electronic images) developed by the bank for or during the performance of its permissible data processing activities.

(a) It is part of the business of banking under 12 U.S.C. 24(Seventh) for a national bank to act as a certificate authority and to issue digital certificates verifying the identity of persons associated with a particular public/private key pair. As part of this service, the bank may also maintain a listing or repository of public keys.

(b) A national bank may issue digital certificates verifying attributes in addition to identity of persons associated with a particular public/private key pair where the attribute is one for which verification is part of or incidental to the business of banking. For example, national banks may issue digital certificates verifying certain financial attributes of a customer as of the current or a previous date, such as account balance as of a particular date, lines of credit as of a particular date, past financial performance of the customer, and verification of customer relationship with the bank as of a particular date.

(c) When a national bank issues a digital certificate relating to financial capacity under this section, the bank shall include in that certificate an express disclaimer stating that the bank does not thereby promise or represent that funds will be available or will be advanced for any particular transaction.

(a) Eligible activities. It is part of the business of banking under 12 U.S.C. 24(Seventh) for a national bank to provide data processing, and data transmission services, facilities (including equipment, technology, and personnel), data bases, advice and access to such services, facilities, data bases and advice, for itself and for others, where the data is banking, financial, or economic data, and other types of data if the derivative or resultant product is banking, financial, or economic data. For this purpose, economic data includes anything of value in banking and financial decisions.

(b) Other data. A national bank also may perform the activities described in paragraph (a) of this section for itself and others with respect to additional types of data to the extent convenient or useful to provide the data processing services described in paragraph (a), including where reasonably necessary to conduct those activities on a competitive basis. The total revenue attributable to the bank's data processing activities under this section must be derived predominantly from processing the activities described in paragraph (a) of this section.

(c) Software for performance of authorized banking functions. A national bank may produce, market, or sell software that performs services or functions that the bank could perform directly, as part of the business of banking.

It is part of the business of banking for a national bank to offer as a correspondent service to any of its affiliates or to other financial institutions any service it may perform for itself. The following list provides examples of electronic activities that banks may offer correspondents under this authority. This list is illustrative and not exclusive; the OCC may determine that other activities are permissible pursuant to this authority.

(a) The provision of computer networking packages and related hardware;

(b) Data processing services;

(c) The sale of software that performs data processing functions;

(d) The development, operation, management, and marketing of products and processing services for transactions conducted at electronic terminal devices;

(e) Item processing services and related software;

(f) Document control and record keeping through the use of electronic imaging technology;

(g) The provision of Internet merchant hosting services for resale to merchant customers;

(h) The provision of communication support services through electronic means; and

(i) Digital certification authority services.

A national bank shall not be considered located in a State solely because it physically maintains technology, such as a server or automated loan center, in that state, or because the bank's products or services are accessed through electronic means by customers located in the state.

For purposes of 12 U.S.C. 85, the main office of a national bank that operates exclusively through the Internet is the office identified by the bank under 12 U.S.C. 22(Second) or as relocated under 12 U.S.C. 30 or other appropriate authority.

National banks that share electronic space, including a co-branded web site, with a bank subsidiary, affiliate, or another third-party must take reasonable steps to clearly, conspicuously, and understandably distinguish between products and services offered by the bank and those offered by the bank's subsidiary, affiliate, or the third-party.