Until now, selling financial products online has required an understanding not just of the law in one country but of the law in every country in which a financial services company intended to operate. This situation will be considerably simplified by the EU's Electronic Commerce Directive (ECD). But the new legislation, for which the deadline for implementation was January 17 2002, could mean financial services companies find their activities falling under entirely different regulators from those they are used to.
The boundaries of the Electronic Commerce Directive
Geographically, the ECD applies to the members of the European Economic Area (EEA): EU members plus Norway, Iceland and Liechtenstein.
The legal scope of the Directive excludes market abuse issues such as misleading statements, prudential rules, taxation, the so-called passporting regime and requirements applicable to the delivery of goods. The range of laws affected is termed the coordinated field under articles 2(h) and 3(1) of the Directive.
Information Society Service (ISS)
The E-commerce Directive covers all forms of electronic business communication, including mobile telephones and interactive television. But its greatest impact will be on financial services contracted over the internet. The method of determining whether a service is caught by the Directive is whether it is an Information Society Service (ISS). The definition of an ISS is found in article 1(2) of Directive 98/34/EC, as amended by Directive 98/48/EC. In essence, an ISS is a service provided at a distance for consideration by electronic means, at the request of an individual.
The country of origin approach
Until August 21 2002 a consumer in the UK, for example, was protected by Financial Services Authority (FSA) rules when buying services over the internet from any EEA-based company. To use a real example, the Finnish investment bank Eficor, located in Helsinki, provides a share dealing service on the internet. Any share trading stemming from this Finnish website directed at the UK would have been subject to UK FSA rules.
The country of origin approach under the E-commerce Directive means the country from which the service was marketed, where the financial services company is based, provides the regulatory rules and consumer redress. If a UK-based company is marketing a financial service, the UK rules apply. If a Finnish-based company is marketing a financial service, the Finnish rules apply, and so on throughout the EEA.
Conduits are exempt, so the fact that a company may use an internet service provider (ISP) to host its website in a different country will not matter. This conduit exemption represents a substantial clarification of the law. In the short history of the internet, courts within the EEA have already diverged in their stance on ISP liability.
The provision of essential information
Under the Directive, EEA member states must ensure ISS companies provide information about the main features of a product or service. The "essential information" rule includes a description of the product or service, the total price, associated risks and the contract details of the party with whom the consumer would enter into a contract.
In the UK, specifically, the Directive is implemented through the FSA's new Electronic Commerce sourcebook (ECO). It is worth noting that the abbreviation ISS is not used in the sourcebook, because the UK regulator has chosen to use the more evocative name Electronic Commerce Activity (ECA) to describe the same type of service.
In the UK, outgoing ISS providers, meaning companies operating from an establishment in the UK, will have to supply the following essential information in relation to any ISS they supply:
the name of the provider;
the address in the UK at which it is established;
the provider's email address;
a statement that the provider is authorized or regulated by the Financial Services Authority;
a statement that the provider is entered in the FSA's Register and its FSA Register number; and
if applicable, the value-added tax identification number.
Higher risk products
In the Figure 1 example of share trading by CMC selling shares to a Finnish consumer, the ECO essential information requirements apply. With higher risk products there are further rules. For instance, the Finnish consumer may decide also to purchase from CMC, by electronic means, a derivatives product such as a put option to hedge against an adverse movement in the shares purchased. Before any business can take place, the Finnish customer would have to first sign their acceptance of a detailed risk warning notice.
ECO Table 1.2.13E sets out the specific risk warnings for derivatives, unregulated collective investment schemes, warrants and broker funds. Although no legal rule under the Directive requires the use of a language beyond the country of origin's own national language, common sense concludes there is a need for this.
Exceptions to the country of origin approach
The Directive allows for exceptions to the country of origin rule in two ways. First, by providing a list of general derogations as stated in article 3(3), article 3(1) and (2).
These include electronic money institutions, insurance companies, unsolicited business communications by email, consumer contract obligations and advertising by operators of Undertakings for Collective Investment schemes in Transferable Securities (Ucits). Under general derogations the EEA country where the recipient of the service is located determines the rules to apply, if any.
In the UK, the FSA has made clear that it intends to ignore the Ucits and unsolicited email derogations, so a UK-based company would be expected to comply with the country of origin approach when marketing Ucits or sending unsolicited emails.
The FSA will ignore the Ucits derogation because it believes the EU Ucits Directive already establishes the country of origin approach to qualifying collective investment schemes. The regulator will ignore the unsolicited emails derogation on the basis that the FSA already permits such communications.
The ECD also allows each country to deviate from the rule where it considers this necessary on a case-by-case basis. A member state can only derogate if the country of origin has failed to take action after the host state has requested the applicable member state to do so. On this inaction, the host state can serve notice to the European Commission that it intends to derogate. In the event of an emergency there is some scope to avoid this notice procedure.
Consistency between the treatment of electronic and paper-based business
The European Commission has set a target of the year 2005 for a consistent media-neutral approach to the marketing of financial services across the EEA. This consolidation will come from the Distance Marketing of Financial Services Directive, which will adopt the country of origin approach to non-electronic financial services activity.
In the UK, the Distance Marketing Directive has a planned implementation date of 2004. This means there will be anomalies in the treatment of electronic and paper-based commerce for at least the next two years. For instance, a UK consumer could buy shares from a foreign-based company by mail subject to the regulatory rules of the FSA, but the same purchase of shares over the internet would be governed by the country of origin approach.
Practical compliance
Lawyers need to check that the EEA countries on which they are advising have implemented the ECD. For example, the French legislature is unlikely to implement its version of the Directive in 2002. The Italian legislature is in the process of preparing a draft law. The UK rules became effective on August 21 2002. The UK transitional rules allow a firm three months after this date during which an ISS provider will not contravene any ECO rule if the company has taken reasonable steps to comply.
The ECD can only increase cross-border investment activity, assuming the core rules such as providing minimum information, are adopted throughout the EEA. Customers will become increasingly confident about investing with firms from all over Europe once they learn that financial products are governed by the same core rules.
Furthermore, the EU has not ignored the practical difficulties facing consumers seeking redress across borders that could cause consumer confidence to falter. The Commission has published a guide in 11 languages entitled Enforcing Your Rights in the Single European Market and this guide is available online. The Commission has also launched an out-of-court complaints network called Fin-Net that brings together 35 different national schemes with the aim of minimizing costly legal action.
Financial services companies will, at least in the long term, also benefit from lower legal costs when venturing across EEA borders because of the country of origin approach. This pan-European legislation should prove a welcome simplification of a complex area of regulation.