CASS telephone mandates

Rather unhelpfully, CASS 8.2.3 G indicates that information which would allow an investment firm to give instructions to a third party 'could' amount to a mandate if retained - for example as a telephone recording. After careful consideration, we at PwC and some other firms have formed the view that such recordings are mandates, and must be treated as such; although a number of investment firms take a different view. We have written to the FCA explaining our view and the alternative interpretations. This analysis is provided below.

Scope of CASS Mandates for card transactions made via telephone

This note addresses how the rule and guidance in CASS 8.2.1 R and 8.2.3 G should be applied to telephone recordings of conversations with clients where credit or debit card details are provided in full for the purpose of making a single contribution of funds. We believe that there has been inconsistent application of this rule as a number of organisations have formed the view that, where instructions are taken over the phone (and retained) for the purpose of only one transaction, then this is not a mandate. Based on our reading of the CASS rules, we and some other firms have formed a view that these do constitute mandates. We have set out the arguments for and against this view further below.

Scenario

A client calls the firm to make a one-off contribution of cash in the course of investment business. The client provides to the firm all necessary debit/credit card information for the firm to make an instruction to the clients’ bank (‘another person’ or ‘other person’) and this is recorded in full (usually for quality and training purposes). The firm then makes the instruction to the ‘other person’ and this is acted upon or ‘given effect’.

Arguments for a mandate

We consider that the above scenario meets the definition of a mandate in CASS 8.2.1 R as follows:

·        CASS 8.2.1 R (1) – the client has consented to giving their debit / credit card information;

·        CASS 8.2.1 R (3) – this is retained by the firm in the form of a telephone recording; 

·        CASS 8.2. 1 R (4) – the firm can give the instructions based on the information retained by the firm; and

·        CASS 8.2.1 R (5) – “no further involvement” would be necessary for the instructions to be given effect.

We have interpreted “no further involvement” in CASS 8.2.1 R (5) to be met as the firm could issue instructions to ‘another person’ and that ‘other person’ would effect those transactions without additional instruction from the client to the ‘other person’ regardless of the whether the client has provided such an authorisation in the first instance. This may include situations where the use of this information constitutes fraudulent or another conduct of business issue. 

We believe that our interpretation is what is required of the rules as currently written and is also in line with the principles which were articulated in CP13/5 and which were given effect in PS14/9. The principle is extracted below:

‘If the firm retains this information, there is a greater risk that the information could be misused by the firm (for example fraudulently). The purpose of the mandate rules is to reduce the likelihood of a firm misusing the mandates.’

In the case where the firm does not know whether the ‘other person’ would require the client to have further involvement (for example, two-factor authentication), we also believe this should be treated as a mandate as we believe the potential ability should be subject to the same controls unless the firm is able to clarify the position.

We believe that CASS 8.2.3 G (2) provides further clarity that retention of information in the above scenario ‘could’ amount to a mandate regardless of the intention.

Arguments against a mandate

The views and technical analyses provided by various firms and industry bodies in regards to the above scenario focus the following points:

·        CASS 8.2.1 R (1) – the intent of the clients, which is only to authorise a single payment; and therefore the client has not 'consented' to any future transactions, a mandate does not exist;

·        CASS 8.2.1 R (5) – the client has not consented to future use, the ‘further involvement’ of the client would be required to authorise any future transactions. This reflects the operational processes that firms have in place to prevent inappropriate use. This is interpreting ‘further involvement’ to mean further authorisation from the client to the investment firm.

As such, the information in the above scenario which is retained for other purposes (for example, telephone recordings retained for quality and monitoring purposes), but not for future transactions, would be not be considered a mandate.