NYSAIS | Webinar | May 11, 2011 Electronic Signatures and Red Flag Rules Presented by: Donald J. Mosher Partner Schulte Roth & Zabel LLP Jessica Sklute Special Counsel Schulte Roth & Zabel LLP

Electronic Signatures and Red Flag Rules | 1 Disclaimer This information and any presentation accompanying it (the "Content") has been prepared by Schulte Roth & Zabel LLP (“SRZ”) for general informational purposes only. It is not intended as and should not be regarded or relied upon as legal advice or opinion, or as a substitute for the advice of counsel. You should not rely on, take any action or fail to take any action based upon the Content. As between SRZ and you, SRZ at all times owns and retains all right, title and interest in and to the Content. You may only use and copy the Content, or portions of the Content, for your personal, non- commercial use, provided that you place all copyright and any other notices applicable to such Content in a form and place that you believe complies with the requirements of the United States' Copyright and all other applicable law. Except as granted in the foregoing limited license with respect to the Content, you may not otherwise use, make available or disclose the Content, or portions of the Content, or mention SRZ in connection with the Content, or portions of the Content, in any review, report, public announcement, transmission, presentation, distribution, republication or other similar communication, whether in whole or in part, without the express prior written consent of SRZ in each instance. This information or your use or reliance upon the Content does not establish a lawyer-client relationship between you and SRZ. If you would like more information or specific advice of matters of interest to you please contact us directly. © 2011 Schulte Roth & Zabel LLP. All Rights Reserved.

Electronic Signatures and Red Flag Rules | 2 Overview Electronic Signatures –E-Sign Act and New York’s Electronic Signatures and Records Act Requirements Practical Considerations Red Flags Rule –Background and Scope –Requirements –Practice Points

Electronic Signatures and Red Flag Rules | 3 E-Sign Act - Generally Key Provisions –an electronic signature or record may not be denied legal effect solely because it is in electronic format –electronic records “Electronic Signature” –(1) sound, symbol or process, (2) attached to or logically associated with an electronic record, and (3) made with the intent to sign the electronic record –Examples “In writing” –If information is required to be “in writing,” then consumer protection provisions apply

Electronic Signatures and Red Flag Rules | 4 E-Sign Act – Consumer Protection Provisions Consumer protection provisions include: –consent; statement of hardware and software requirements –right to receive non-electronic form, scope of consent, ability to withdraw consent (and consequences), how to update contact information, how to receive paper copy –demonstrate access to electronic records

Electronic Signatures and Red Flag Rules | 5 E-Sign Act – Practical Considerations Applicability –Online student enrollment, financial information, permission slips –Payment Transactions Additional considerations, e.g., include ACH Rules and “similarly authenticated” standard Service Providers –Products and services being used –Representations

Electronic Signatures and Red Flag Rules | 6 New York’s Electronic Signatures and Records Act (ESRA) ESRA –validity of electronic signatures and records –“electronic signature” E-Sign and Preemption –E-Sign versus ESRA –not settled Practical Consideration –whether E-Sign’s consumer protection provisions apply

Electronic Signatures and Red Flag Rules | 7 Red Flags Rule - Scope Background Scope –“financial institutions” and “creditors” that maintain “covered accounts” –Applicability to schools FTC’s FAQs Red Flag Program Clarification Act of 2010 Enforcement –compliance risk

Electronic Signatures and Red Flag Rules | 8 Red Flags Rule - Requirements Identity Theft Prevention Program –written and board-approved –detect, prevent, mitigate identity theft –Program requirements Identify Red Flags Develop Policies and Procedures to detect Red Flags Prevent and mitigate identity theft update program periodically –Implementation of program, training employees, oversight of service providers

Electronic Signatures and Red Flag Rules | 9 Red Flags Rule – Practical Considerations Do-It-Yourself Prevention Program (for low risk organizations) –Evaluate whether organization is at low risk We know parents, students, employees personally –Designing Program Identify red flags – notice from customer Detect red flags – whose attention? Respond to red flags – confirm claim Administering Program – Who approved program? Who will administer program? –Training –Service Providers

Electronic Signatures and Red Flag Rules | 10 THANK YOU! Questions and Answers