Even credit unions without a social media presence onsites like Facebook or Twitter must comply with the FederalFinancial Institutions Examination Council's proposed social media guidance, CSI Regulatory ComplianceCustomer Relationship Manager Lee Thomas said in an Aug. 28Credit Union Times ­webinar.

“Whether you are on social media is irrelevant,” Thomas said inresponse to a question from the webinar audience. “You need tomonitor social media activity, whether it's direct or what othersare saying about you.”

That means all credit unions must develop an oversight processfor monitoring social media, a task that Thomas said could beoutsourced. He added that some credit unions told him they'rehaving an employee print all comments they find on Facebook, Twitter, YouTube and othersites, but called that process time consuming and painful.

In January, the FFIEC set a 60-day comment period on proposedguidance that would require all financial institutions and ConsumerFinancial Protection Bureau-supervised non-bank entities to developformal social media policies and a risk governance program thatincludes how social media contributes to strategic goals, policiesand procedures, third-party due diligence, employee training,oversight, audit and compliance functions.

Related: Check out this webinar on social media marketing andmonitoring.

The FFIEC's 60-day comment period ended in March, but theregulatory group has yet to issue final guidance. When the FFIECreleased the proposed guidance, it said in a release it would notimpose additional obligations on financial institutions, but ratheroutline steps institutions should take to manage potential risksassociated with social media, as they would with any new process orproduct channel.

Thomas presented examples of how the guidance would integrateexisting regulations into social media. For example, social mediaposts that promote products such as credit cards must include alink to a website that includes disclosures required by Truth inSavings regulations.

Thomas also suggested credit unions make very clear to employeeswhat they are prohibited from posting on their personal accounts.While he stressed that he hasn't heard of personal posts made byemployees coming up in safety and soundness exams, he said thetopic could potentially be addressed by regulators.

“Your employees have access to a lot of member information,” hesaid. “Make sure loose lips don't sink ships.”

Employee personal accounts on social media sites such asLinkedIn and Facebook may include work colleagues and personalfriends, further increasing risk for employers.

“You don't want your employee to post something on theirpersonal site that could be viewed as negative or slander theinstitution,” Thomas said.

While state or federal regulators might not target specificemployee posts, Thomas said they might ask if the credit union hasshared a formal social media policy with employees regarding theirpersonal accounts.