Sec. 408.
(1) A domestic credit union wishing to utilize automated information processing services of a vendor shall enter into a written contract, lease, or licensing agreement with the vendor. The credit union board shall review the contract, lease, or licensing agreement to ensure the interests of the domestic credit union are protected. Approval of the contract, lease, or licensing agreement is required before any automated information processing services are performed or provided to the domestic credit union.
(2) The written contract, lease, or licensing agreement described in subsection (1) shall provide at least all of the following:
(a) That the vendor will furnish the written assurance described in subsection (4) to the commissioner.
(b) That the domestic credit union will retain permanent and exclusive ownership of all internal information and member information in the possession of the vendor, that the vendor may not disclose any of that information to third parties except as explicitly authorized in writing by the domestic credit union, and that the vendor may not use any of that information for the vendor's own purposes except as explicitly authorized in writing by the domestic credit union.
(c) That the vendor will provide contingency planning and disaster recovery provisions to reconstruct the transactions of the domestic credit union and to resume automated information processing within a reasonable time after a failure of the automated information processing services.
(d) That upon termination of the contract, lease, or licensing agreement, the vendor shall return copies of all internal information and member information in an electronic form usable to the domestic credit union, and disclose any fees related to the return of the information in electronic form.
(e) The extent to which the vendor is liable for nonperformance, breach, or fraud or other dishonesty.
(f) That each employee of the vendor with access to internal information or member information is sufficiently bonded against fraud or other dishonesty.
(g) A statement of each service the vendor will perform, the frequency of each service, and the fees charged in connection with performance of each service.
(h) A description of the ownership of the hardware, software, or systems utilized in the performance of the automated information processing services.
(i) An allocation of responsibility for delivering internal information or member information to the vendor, and liability for loss of internal information or member information before it is delivered.
(3) If automated information processing services are donated to a domestic credit union by a sponsor, the domestic credit union shall make available sufficient off-premises storage and duplication of internal information and member information to enable the sponsor or the sponsor's vendor to reconstruct the transactions of the domestic credit union and resume automated information processing within a reasonable time after a failure of the automated information processing services.
(4) A domestic credit union shall not purchase automated information processing services from a vendor unless the domestic credit union and the vendor, and any subcontractors of the vendor, furnish the commissioner with an assurance in writing that the performance of the services is subject to examination and regulation to the same extent as if the services were performed by the domestic credit union on its own premises.
(5) As used in this section:
(a) “Automated information processing” means automated processing, updating, and storage of internal information or member information.
(b) “Internal information” means the accounts, books, and records of a domestic credit union maintained in any form.
(c) “Member information” means the share, deposit, loan account balances, or other information related to any member of a domestic credit union maintained in any form.
(d) “Sponsor” means an entity around which all or part of a domestic credit union's field of membership is formed.
(e) “Vendor” means a person who supplies hardware, software, or systems used for automated information processing services to a domestic credit union or performs automated information processing services for a domestic credit union. The term includes a subcontractor of a vendor.
History: 2003, Act 215, Eff. June 1, 2004
Last modified: October 10, 2016