Kingston Smith Financial Services Update October 2011
By Mark Child, Technology Risk Management Partner
Changes to the Financial Services Authority (FSA) taping rules are coming into force.
Since 6 March 2009, the FSA’s rules have required firms to tape and retain records of certain calls on landlines, as well as certain electronic communications, made or taken by staff members.
From 14 November 2011, this obligation will be extended - firms will also be required to take reasonable steps to record and store relevant telephone conversations and relevant electronic communications made with, sent from, or received on mobile devices issued by firms for business purposes. However, it is important to note that a new rule will be introduced at the same time for privately-owned equipment which the firm is unable to record or copy.
Firms which have not yet made arrangements to ensure that relevant conversations and communications are recorded should take steps immediately in order to be in compliance with the FSA’s rules from 14 November 2011.
What is changing?
From 14 November 2011, the Mobile Device Exemption will be deleted.
This means that firms will be required to take reasonable steps to ensure that relevant telephone conversations and relevant electronic communications made with, sent from or received on mobile devices are recorded and stored in accordance with the FSA Conduct of Business Sourcebook (COBS) 11.8.5 and 11.8.10. This new requirement will only apply to mobile devices issued by firms for business purposes, and a new rule will be introduced requiring a firm “to take reasonable steps to prevent an employee or contractor from making, sending or receiving relevant telephone conversations and electronic communications on privately-owned equipment which the firm is unable to record or copy”.
What are “relevant” telephone conversations and electronic communications?
Relevant telephone conversations and electronic communications include any conversation or communication between an employee or contractor of a firm with:
- A client or with another person (such as a third party broker) which concludes an agreement by the firm to carry out the receipt, execution, arrangement or placement of client orders (or orders made on behalf of clients) in certain qualifying and related investments;
- A professional client or an eligible counterparty, or with another person (when acting on behalf of a professional client or an eligible counterparty) which is carried on with a view to the conclusion of an agreement by the firm to carry out the receipt, execution, arrangement or placement of client orders (or orders made on behalf of clients) in certain qualifying and related investments (even if such conversations or communications do not lead to the conclusion of an agreement).
The term “electronic communication” should be viewed broadly - in its policy statement PS 08/1, the FSA stated that the term includes fax, email, Bloomberg mail, video conferencing, SMS, business to business devices, chat and instant messaging. However, the FSA has intentionally not provided a prescriptive list of the types of communication covered due to the rapidly developing nature of electronic communications.
As a minimum, the FSA has stated that it expects firms to:
- Ensure that their employees are made aware of their responsibilities under the new rules through adequate training; and maintain proper audit trails so the firm is alerted to any “relevant” conversations that have occurred outside of any taped lines, but which have resulted in a client order or conclusion of a transaction.
The FSA has also indicated that reasonable steps taken by firms in complying with these rules may include implementing policies which either (i) prohibit or (ii) restrict (together with an appropriate recording solution) the use of mobile phones and other electronic devices provided by the firm to engage in relevant communications.
In addition, the FSA has said that "in exceptional circumstances" (for example, in the event of a technology failure) it may be acceptable to make/receive conversations on a mobile device that are not recorded whilst still complying with the “reasonable steps” requirement.
The rules and their interaction with privacy laws
The FSA has considered the legality of the new rules in light of national, EU and international privacy laws.
The FSA does not believe that either national or EU laws prevent it from imposing the COBS taping rules. It does, though, acknowledge that if these rules were to be applied to communications made with, sent from or received on private (i.e., non firm issued) mobile devices, then the risk of recording non-relevant, non-business communications is increased and this may raise privacy law issues in the UK and other EU member states.
When considering the legality of international privacy laws, the FSA has stated that it would only expect a firm to record an employee’s mobile phone outside the UK if that employee frequently conducted relevant conversations or communications from his or her mobile device in other jurisdictions. The FSA has also confirmed that the “reasonable steps” standard in COBS 11.8.5 would not compel a firm to act in breach of any local laws that may apply to such communications and/or prohibit their being recorded.
Please note that the FSA has stated that firms are responsible for determining that they are complying with the relevant privacy laws when recording communications from their employees’ mobile devices.
Practical steps to help you comply
If you consider whether your business activities and employees or contractors would be caught by these rule amendments, please see below a number of practical steps to help you comply with the new rules. Where relevant, existing compliance policies and procedures should be updated to include:
- Maintaining a list of staff who will be subject to mobile phone taping. The number of staff on this list should be limited as far as possible to those who are involved in the business of receiving, executing, arranging and placing client orders (or orders made on behalf of clients) in relevant qualifying and related investments;
- Informing such staff members that their mobile devices will be taped and ensuring that they receive adequate training on the key issues and requirements of the COBS taping requirements and the firm’s policies and procedures;
- Ensuring that new joiners receive training on the COBS taping rules and restrictions/prohibitions on the use of personal mobile devices to make relevant communications; advising staff that personal contact details (such as home phone number, personal mobile number, home email address) should not be issued to clients for business purposes;
- Ensuring that the compliance and/or IT teams periodically review the mobile recordings; check that the mobile devices of all relevant staff are being recorded and stored; check that the recording and storage systems are working correctly (for example, that the recording is actually taking place and that the stored data meets the FSA’s conditions with respect to accessibility and prevention of alteration);
- Ensuring that staff understand that they may be held personally responsible for any lack of disclosure of an unrecorded communication and that such failures may result in disciplinary action; restricting/prohibiting the use of private mobile phones and unrecorded firm issued mobile devices for relevant communications.
