UK Public Authorities (Fraud, Error and Recovery) Bill: Banks and EMIs face detailed new information and account direct deduction obligations

The relevant proposed provisions in the Bill would apply to authorised deposit takers (banks) and e-money issuers (EMIs). 

However, there would also be power to extend the provisions to other types of financial services providers (including products or services/accounts that operate by reference to cryptoassets or any similar product/service or asset) via future secondary legislation.

There are proposed new powers for the Minister for the Cabinet Office (Minister)/Public Sector Fraud Authority (PSFA) that can be used before bringing proceedings in a court or tribunal for a claimed amount on behalf of another public authority against the person from whom the Minister reasonably believes the amount is recoverable (the “liable person”). Broadly, a ‘recoverable amount’ is (a) a payment made as a result of fraud or error that (i) the Minister has identified or confirmed during the course of an investigation into suspected fraud against a public authority, and (ii) the public authority is entitled to recover, (b) any other amount that a public authority is entitled to recover in respect of fraud, and (c) any interest that a public authority is entitled to recover in respect of an amount within (a) or (b) (s1(2)).

There are also proposed amendments to the DWP’s legislative framework to enhance its ability to recover debts due without having to apply via the courts.

The below refers to provisions in the main Bill relating to the new powers for the Minister for the Cabinet Office/PSFA. Largely equivalent provisions for the DWP are in Schedule 5 to the Bill, which inserts a new Schedule 3ZA to the Social Security Administration Act 1992.

Account information notices and general information notices

• There are powers to issue: 
  • ‘account information notices’ which would impose a requirement on banks and EMIs to provide account statements; and 
  • ‘general information notices’ which would impose a requirement to provide details of every account that a liable person holds with the bank or EMI. 
• The explanatory notes to the Bill suggest that the account information notices are designed to ensure the protection of vulnerable customers; direct recoveries via ‘direct deduction orders’ (see below) ‘will only happen once affordability and vulnerability checks have been carried out, including through the debtor’s bank statements’.
• Banks may be issued with more than one account information notice, or general information notice, in relation to the same recoverable amount and more than one account information notice in respect of the same account. A bank may be liable to a penalty if it fails to comply with an account or general information notice ‘without reasonable excuse’ (see further ‘Penalties’ below).
• There is no restriction on the volume of information that can be requested in such notices, or the period for which the information must be provided.
• Banks and EMIs cannot request amendments to the notice (e.g. to correct inaccuracies such as the name of the legal entity on which the notice is being served), but there is a limited right for the bank or EMI to appeal the notice.
• There is a “tipping off” type provision which would prohibit the bank from notifying the liable person or any joint account holder that a notice has been given.   This will effectively prevent the affected customer from challenging or appealing the affordability and vulnerability assessment performed by the Minister or the DWP.
• Banks and EMIs will need to consider the impacts of these notices on their policies, procedures and controls, including:
  • Assessment of the accuracy and/or complexity of the requirements of the notice and the ability of the bank or EMI to comply within the timeframe prescribed in the notice. 
  • Consideration as to whether an appeal needs to be raised to amend or clarify the requirements of the notice, or to extend the prescribed deadline.

Direct deduction orders

• The information notices are preparatory to ‘direct deduction orders’ to recover sums wrongly paid to the liable person. 
• Direct deduction orders can be varied by the Minister, including so that the order applies to another account held by the liable person (including an account administered by a different bank).
• Direct deduction orders can also be revoked or (if they are regular, rather than lump sum, orders) suspended and restarted.
• Restrictions would apply to a bank’s or an EMI’s actions in relation to an account immediately on receipt of a notice of a proposed direct deduction order or the order itself. For example, there could be no closure of an account at the request of the customer, and if the order is a lump sum direct deduction order the bank or EMI would have to make sure that the balance didn’t fall below the lump sum amount.
• A bank can also be required to comply with a ‘further information notice’ (effectively a hybrid account/general information notice) in relation to any decision to vary or revoke a direct deduction order.
• Direct deduction orders can be applied to joint accounts where the liable person does not hold sufficient funds in their sole account that would enable recovery within a reasonable period of time.
• The Bill creates a civil offence of fraud that can be enforced by the Minister without first proving their case in court. The Minister can impose a penalty where the Minister is satisfied on the balance of probabilities that another person has fraudulently helped the liable person to receive payments in circumvention of the direct deduction order. The penalty enables the Minister to recover 100% of the payments that, in the Minister’s opinion, would have been recoverable under the order but for the circumvention.  
• Banks and EMIs will need to consider the impacts of these orders on their policies, procedures and controls, including:
  • Amendments to their account terms and conditions to reflect these restrictions.
  • Their processes and controls for managing risks arising in respect of these orders, including those relating to: 
    • applying inhibits immediately upon receipt of the order, and 
    • managing relationships with vulnerable customers. 
  • The effectiveness of their complaints handling procedures to manage customer conversations relating to sensitive or severe financial hardship arising from direct deduction orders.  

Secondary legislation on detailed requirements

• There is provision for the Minister to introduce secondary legislation on various aspects of direct deduction orders including: about how notices and orders are to be given by the Minister; about how notices and information are to be given to the Minister; about the duties of banks in relation to direct deduction orders, including before a direct deduction order is made; and about costs which a bank may recover in accordance with any provision to that effect which is included in a direct deduction order or from the Minister (all of which would be subject to consultation with relevant stakeholders).

Penalties

• There are penalties for non-compliance (£300 daily fine for failure to provide information or £300 fixed fine for any other compliance failures) and a right to appeal. There is also the potential for individuals at banks/EMIs to be liable for failure to prevent the bank’s/EMI’s non-compliance with a requirement. 
• In relation to the equivalent powers of the DWP (Schedule 5 to the Bill), there is a penalty of (up to) £500 for a bank’s/EMI’s non-compliance and no ‘failure to prevent’ liability for individuals.

Code of practice

• The DWP must issue a code of practice about, among other things, the giving of notices to banks/EMIs requiring the provision of information under Schedule 3ZA. The DWP must first publicly consult on the draft code of practice and lay it before Parliament.

Eligibility verification notices

• The Bill would establish a power (via further amendments to the Social Security Administration Act 1992) for the DWP to require information by way of an ‘eligibility verification notice’ to support it in verifying eligibility for ‘relevant benefits’ (defined as universal credit, employment and support allowance, and state pension credit). 
• The power would apply to authorised deposit takers (banks) and EMIs who, in the course of that activity, provide ‘relevant accounts’ (defined as a current, savings or investment account) held within the UK into which a relevant benefit may be paid. As mentioned above under ‘Scope’, there is power to extend the power via secondary legislation to capture other persons who provide accounts which are, or correspond to, relevant accounts (including accounts that operate by reference to cryptoassets or any similar asset).
• The eligibility verification notice will require the person receiving it:
  • firstly to identify relevant accounts which (a) the person provides, and (b) are accounts (i) into which a specified relevant benefit has been paid, or are other accounts held by such person, and (ii) which meet specified criteria (“eligibility indicators” - which indicate that the specified relevant benefit may have been, or may be, incorrectly paid) whether alone or with other such accounts; and
  • secondly to give to the DWP: specified details about the account (for example, sort code and account number); specified details about the account holders (for example, their names and dates of birth); and specified details about how the account meets the eligibility indicators.
• "Eligibility indicators” are not limited to information that appears on the face of the account.  For example, eligibility for universal credits includes a requirement that the claimant lives in the UK.  Given its common meaning, this means the customer has a home in the UK and spends 91 consecutive days in the UK (including 30 days in the relevant tax year).  It is unclear the level or extent of the checks that a bank or EMI will be expected to perform to identify whether or not their customer ‘lives’ in the UK.
• A “periodic eligibility verification notice” may require a person to take the above steps at specified intervals within a maximum 12-month period from the date of the notice.
• Information that amounts to transaction information or special category data (a) may not be required by the DWP by way of an eligibility verification notice, and (b) must not be given to the DWP in response to such a notice. However, the prohibition against the requiring and giving of special category data does not prohibit the requiring and giving of data to establish that an individual is in receipt of the specified relevant benefit.
• An eligibility verification notice may: 
  • require a person to provide the date that an account which meets an eligibility indicator first began to meet that indicator;
  • require information: to be compiled or collated in a specified manner; to be provided in a specified way (including by electronic transmission to a specified address or portal).
• The DWP may vary or revoke an eligibility verification notice by giving notice to the person to whom it was given.
• Banks and EMIs will need to consider: 
  • how they will be able to comply with these requirements in practice, and
  • how the information identified through these checks impacts existing financial crime control frameworks. 

Penalties

• Failure to comply with an eligibility verification notice without a ‘reasonable excuse’ could result in a fixed penalty not exceeding £1,000 (or multiple such fixed penalties in respect of periodic eligibility verification notices). There is also a daily rate penalty (not exceeding £40) for continuing failure to comply which could be increased for ongoing non-compliance. The provision of inaccurate or prohibited information is also subject to a penalty.
• There are procedures for applying for a review of the decision to give the eligibility verification notice and for appealing against the notice and any penalty notice.

Code of practice

• The DWP must issue a code of practice about eligibility verification notices before giving the first notice, but must first publicly consult on the draft code of practice and then lay it before Parliament.

Interaction with POCA

• The Proceeds of Crime Act 2002 (POCA) would be amended to introduce carve-outs to the offences in sections 330 and 331 of POCA (which relate to the failure to disclose knowledge or suspicion of money laundering in the regulated sector) in relation to information obtained solely as a result of complying with an eligibility verification notice.  However, the amendments do not exempt individuals from their ongoing duty to report any other knowledge or suspicions of money laundering that arise independently of the information obtained as a result of an eligibility verification notice.