Theday may come when all financial marketing is done through socialmedia.

Before that can happen, some financial institutions have a lotto learn about managing the risk and reward ratio as well complyingwith growing regulations designed to cover rapidly expanding socialmedia networks, according to Tom Garcia, president/CEO ofInfosight, an information security, risk and compliance managementcompany in Miami Lakes, Fla.

He shared his insights at an Infosight webinar Wednesday thatexamined social media from all angles.

The webinar, “New FFIEC Guidance on Social Media: What FinancialInstitutions Need to Know,” focused not only on regulatorycompliance for social media, but discussed the possible dangers forcredit unions and banks that may be stepping too gingerly into thegrowing cyber communications world without proper preparation.

Before taking a single step, Garcia said a financial institutionneeds a policy and procedures plan that outlines the dos and don'tsthat will govern the institution's social media presence. Suchguidance is not only common sense from an operational standpoint,but is also mandated by federal regulations, he noted.

“Socialmedia today has become social business,” Garcia said. “Fiveyears ago the industry was still gaining traction. Today, itcollectively accounts for two billion people trading informationonline and through social media platforms that are publicallytraded.”

With more financial institutions are moving into interactivesocial media, care should be taken to ensure posted information andcommunications are in full compliance with regulations from FFIECand other agencies, Garcia said.

An institution may inadvertently disclose personal informationprohibited by a number of banking laws, and that could endanger theconsumer and the institution.

As a matter of record, FFIEC described social media as “a form of interactive onlinecommunication in which users can generate and share content throughtext, images, audio, and/or video.” The council does not consideremail and text messages as part of the social media milieu.

“In summary, the FFIEC guidance does not impose any newrequirements on financial institutions, but instead is a guide tohelp financial institutions understand the applicability ofexisting requirements and supervisory expectations associated withthe use of social media,” Garcia said.

That guidance requires credit unions and banks to establish asocial media risk management program that includes all staff, boardmembers and third-party relationships, provides employee trainingfor appropriate social media usage, contains an oversight processwith audit and compliance functions, and defines parameters thatdefine appropriate reporting procedures to senior staff andboard.

“FFIEC guidance is descriptive but not prescriptive in definingwhat must be done,” Garcia said. ”Is FFIEC asking for an ROI on oursocial media efforts? No, but you must be able to measure programparameters at a basic level if only to show management that you'renot wasting time on this technology.”

The FFIEC also outlined compliance demands designed to protectboth institutions and consumers in compliance, legal, operationaland reputational areas as they relate to social media, Garcia said.All steps aim to protect the consumer by providing proper duediligence, oversight and controls to ensure proper disclosures andfair trade practices.

As financial institutions become more interactive in socialmedia plans that increasingly involve interactions with consumers,a growing number of regulations come into play involving securityof information, electronic transaction requirements, privacyconcerns and fraud.

There are other areas, too, that pose risks for institutionsthat may not necessarily be covered by regulation, Garcia said.

The institution may suffer reputational risk due to negativeexperiences and information posted by consumers who feel they havebeen mishandled by the credit union or bank. Those should beaddressed pro-actively and appropriately before the negativerhetoric spreads too far, Garcia said.

Negative impressions can also be spread from within, eitherdeliberately or inadvertently, by employees uninformed or untrainedin the ways social media usage is dictated by company policy.

As noted earlier, social media policies and procedures should beestablished and employees adequately trained as to what informationthey can and can't communicate while on the job.

“If they are using computers at work, those guidelines should beeasy to enforce,” Garcia said. “However, if they are saying thingson their own time using their own equipment yet still identifyingthemselves with the bank or credit union, then that become a matterfor HR.”

All social media emanating from the credit union or bank as wellas postings that mention the institution, either favorably orunfavorably, should be monitored, with the proper response made bythe person empowered by position to do so, Garcia suggested.

“Social media is not about selling, but about engaging yourcustomer or member,” he said. “If you have a social media presenceand are interacting with a consumer in any fashion, be sure toarchive the information.”

As mobile technology, the favorite of Millenials everywhere,becomes even more dominant, social media issues will likely becomeeven more compelling, Garcia said.

“The phrase 'Don't leave home without it' used to refer to acredit card. Now, it refers to your phone because your phone isyour credit card.”