The efficacy, including the commercial reasonableness, of an attribution procedure is determined by the court. In making this determination, the following rules apply: An attribution procedure established by law is effective for transactions within the coverage of the statute or rule. Except as otherwise provided in paragraph (1) of this section, commercial reasonableness and effectiveness is determined in light of the purposes of the procedure and the commercial circumstances at the time the parties agreed to or adopted the procedure. An attribution procedure may use any security device or method that is commercially reasonable under the circumstances.