BY Jessica Blumenthal , Roy Gillespie , Wilmari Strachan AND Talia Cullinan
Electronic contracting for CIS investors and CIS managers
The recently released Draft Exemption of Managers of Collective Investment Schemes (“CIS”) from certain requirements in Board Notice 92 of 2014 (“BN 92”) will exempt CIS managers to the extent that Electronic Communications and Transactions Act, 2002 (“ECTA”) could be interpreted to require investors to use an advanced electronic signature (“AES”) when signing an application form to purchase participatory interests in a CIS or to increase, switch or redeem their investments. An AES is one which results from a process accredited in terms of ECTA, but which is not readily available to the South African public.
But is an AES even required?
ECTA provides that where a signature is required by law, and such law does not specify the type of signature, an AES must be used.
CIS managers have grappled with this when interpreting paragraph 18 of BN 92 (the board notice governing advertising, marketing and information disclosure requirements for CIS) which requires that a manager of a CIS must obtain a signed application form or contract from an investor which will constitute the agreement with the investor. While this paragraph refers to “signed” it does not expressly reference electronic signatures, and so, applying a wide interpretation of the relevant section of ECTA, CIS investors may be constrained to use AES when wishing to contract electronically in respect of their CIS investments.
This interpretation of ECTA would effectively mean that electronic contracting is not possible, given the inaccessibility of AES. This is a strange outcome, given that other financial services law permits ordinary electronic signatures to be used by financial customers when contracting.
This is the case under the Code of Conduct for Discretionary FSPs, which permits a financial customer to sign a mandate with an asset manager electronically. Even in the CIS context, electronic transacting is permitted, for example in respect of the balloting of investors in terms of the deed of a CIS. Draft legislation published in respect of the advertising and marketing of CIS proposes removing this reference to “signed” which would in any event mean that an AES would not be required by ECTA when a client completes an application form electronically.
Alternatively, the requirement of ECTA could be interpreted more narrowly and in support of business-like outcomes to only require an AES where the law requires signature in the sense that in the absence of signature, the document or contract would be void. This is, for example, the case in respect of donations and suretyships which are required by law to be reduced to writing and signed in order to be valid. Such law attributes a consequence to non-signature. Arguably, this position is distinguishable from law such as BN 92 which provides no consequence of invalidity if an application form is not signed by a financial customer.
Does the exemption fix everything?
Be that as it may, the draft exemption now clarifies the position by specifically exempting CIS managers from obtaining an AES to electronic application forms or contracts from investors to the extent that one may have been required. CIS managers are not exempted from having to obtain the investor’s signature, but an ordinary electronic signature will suffice.
The FSCA has invited comment on the draft exemption before the end of June 2021 and hopefully thereafter the exemption will be published. When in force, the exemption will apply to managers of collective schemes, but in our view the exemption should also apply in respect of the signature of the financial services provider (usually a financial advisor) who is also required to sign an application form in terms of BN 92 if that financial services provider will receive fees as a result of the financial customers CIS investment.
Interestingly, the exemption has been proposed for a period of two years. This may be due to the regulatory change underway which, given the FSCA mandate to support digital innovation and financial inclusion, may make the exemption redundant after that period as new legislation and conduct standards may have provided for digital contracting.
Conditions to the exemption
Most importantly, CIS managers should note that the exemption is conditional upon certain requirements. Should a CIS manager not meet these requirements, the exemption will not apply to such manager. These requirements are:
- an investor must sign the electronic application by way of an electronic signature (as defined in ECTA);
- a manager must verify the identity of an investor and implement processes to authenticate each transaction of the investor;
- an application form must provide for:
- the conditions of and procedures for submitting the electronic application;
- the terms and conditions applicable to the submission of an electronic application and the legal implications thereof;
- any disclaimers of liability on the part of the manager;
- any limitations of liability applicable to the manager;
- the security risks and risk of interception inherent to electronic transacting, as well as related precautionary or security measures; and
- a confirmation by the CIS manager that its website complies with relevant legislative requirements applicable within the Republic of South Africa; and
- the terms and conditions under which an electronic application may be submitted must be displayed on the screen of the digital platform being used to submit the application.
What must a CIS manager do to get ready?
CIS managers should review their application forms, digital platforms (websites and apps), terms and conditions and internal policies to ensure that they meet the conditions to the exemption and other legal requirements (such as under ECTA and the Protection of Personal Information Act, 2013).
Particularly, when considering the security risks and the risk of interception inherent in electronic contracting as required by the conditions to the exemption, CIS managers will need to reckon with the exponential global increase in cybercrime and the recent enactment of the Cybercrimes Act, 2020.
CIS managers, as well as financial institutions, need to pay careful attention to their obligations under the Cybercrimes Act and manage the risks associated with electronic contacting through appropriate disclaimers and limitations of their liability (to ensure that they understand their share of the risk), as well as through the security measures they have in place internally.
Is there a real risk of interception inherent in electronic transacting?
We have seen an increase in matters where CIS managers and their financial customers have been victim to business email compromise (“BEC”) attacks, often referred to as man-in-the-middle attacks.
These cyber-attacks usually stem from a phishing incident and involve the attackers secretly intercepting and altering, modifying or manipulating the communications (and attachments) between two parties who believe that they are directly communicating with each other.
The attackers initially change client static details such as contact and bank account information and then initiate fraudulent repurchase or redemption instructions in order to funnel payments into nominated bank accounts. This occurs without the client’s knowledge and the financial institution believes that the instructions emanate from the legitimate client. These BEC attacks can be particularly devastating often resulting in large financial losses for organisations with limited prospect of recovery and few prosecutions.
It is critically important for electronic communications service providers and financial institutions to understand the reporting and other obligations imposed on them under the Cybercrimes Act. These obligations include the reporting of offences involving their electronic communications service or electronic communications network to the police no later than 72 hours after an incident has occurred, preserving any information that relates to the incident and providing technical and other assistance to the police.
Implementing well thought out protocols, policies, operational procedures and terms and conditions become critical in this context.
If you need any help in navigating these risks, our multi-disciplinary team of specialists are available to support you.
Banking and Finance | Executive
+27 82 788 0352
Banking and Finance | Associate
+27 67 419 2631
Technology, Media and Telecommunications | Executive
+27 82 926 8751
Forensics | Executive
+27 82 787 9893