14.2 Social media advertising, complaints and records

Apply existing law to a new channel

The FFIEC social media guidance explains how existing consumer laws and risk-management principles apply to interactive electronic communications. It does not create a separate social-media statute or excuse a bank because a post is informal. A short post can be an advertisement, a complaint channel, a misleading insurance representation or a disclosure of private information. Identify its purpose and audience, then apply the governing law.

The risk profile depends on the bank’s use. A bank that accepts applications or communicates with customers through a platform has different operational needs from one using a limited recruiting account. Even a bank without an official account can face impersonation, customer complaints and employee statements appearing to speak for the institution. The guidance calls for a risk-management approach proportionate to those activities rather than a requirement that every bank join every platform.

Governance and review before publication

An effective program identifies ownership, approved channels, authorized speakers, review responsibilities and escalation routes. Marketing, compliance, information security and customer service should understand where their roles meet. Policies address employee use where it can affect the institution, including endorsements, confidential information and representations about products. Training should use actual examples of posts, replies and links rather than merely asking employees to acknowledge a policy.

A useful publication record includes the draft, legal review where needed, approved final wording, destination links, publication date and the audience selected. Paid targeting can create fair-lending concerns if it excludes protected groups from credit opportunities. Review who will receive a promotion as well as the words appearing in it. A compliant message sent only to an unlawfully selected audience can still present a compliance defect.

Vendor contracts and due diligence should address content approval, access credentials, monitoring, record retention, incident handling and termination. A platform’s default settings can change without a legal review. If a vendor modifies an advertisement or inserts an inaccurate endorsement, the bank should investigate, preserve evidence and correct the consumer-facing material. Outsourcing campaign execution does not remove the bank’s responsibility for its own regulated activities.

Product disclosures and misleading claims

Character limits do not automatically waive disclosure requirements. Evaluate whether a permitted link or format satisfies the particular rule, whether it is conspicuous and functional and whether the headline itself is misleading. A correct landing page does not necessarily cure an unqualified false statement in the original post. Avoid advertising a temporary rate as permanent or saying a nondeposit investment is government guaranteed because a bank distributes it.

UDAAP analysis examines the full message and likely consumer understanding. A deposit product advertised as free may charge routine usage fees; a lending promotion may imply guaranteed approval while applying undisclosed limits. Check the material representation, omission or practice against the actual product and consumers’ likely interpretation. Do not infer an automatic statutory violation merely because a post receives criticism; validate the facts and apply the legal standard.

Complaints and sensitive information

A public reply about an account can disclose nonpublic personal information. Move sensitive conversations to an authenticated channel without asking consumers to publish account numbers or credentials. Maintain a process to recognize complaints, route them to qualified staff and check whether the message triggers an applicable legal error-resolution duty. A social-media message can raise a Regulation E error issue even when the bank’s preferred complaint form is elsewhere.

The guidance does not require a bank to monitor every outside discussion or every employee’s personal activity. It does support deciding how to handle complaints and reputation risks arising through the bank’s actual channels. Document the scope and rationale. Account impersonation, phishing and unauthorized credential access require coordination with security, not just a marketing response.

Test the complete campaign

Consider a bank hiring a firm to advertise a checking account at a promotional APY. The firm posts the rate without stating its duration and tells respondents that no fees can apply. A compliance review should compare the rate, term and fee claims with the approved account disclosures, check applicable advertising requirements, stop inaccurate statements and identify consumers who received them. It should also review targeting, replies and any complaint pattern suggesting misunderstanding.

Evidence should include screenshots or retained electronic records sufficient to reconstruct the communication, but the retention period comes from the applicable law and policy rather than a universal FFIEC social-media period. Periodic monitoring should test deleted posts, changed links, mobile presentation and vendor access. Report material exceptions, consumer impact and correction status to management. Monitoring only the final bank website misses the channel where the misleading claim actually occurred.

FFIEC social media guidance published by FDIC connects these controls to existing bank laws. Use it as a risk-management framework, then consult the underlying rule for a specific advertising disclosure, complaint deadline or retention duty.