Record-keeping requirements of an FSP - Part 2
Financial Advisory and Intermediary Services Act
We were recently approached by a client who acted as a representative for a Financial Services Provider(FSP). The representative has since left the employ of the particular FSP and now, 8 years later, the representative was approached by a former client requesting information of the financial services rendered and more specifically the record of advice and fees the representative earned. In part I of the series of articles we answered the question whether a representative of an FSP is also bound by the recordkeeping duties imposed on the FSP and we had a look at what the responsibilities of keeping client advice records.
In part II of this series, we shall unpack the time period for which an FSP is required to keep such records.
1. When do record-keeping duties expire?
In the scenario sketched by our client, it states that the FSP's client approached him 8 years after the financial services had been rendered. What time period was the FSP required to keep records of the client?
Section 3(2)(b) of the General Code of Conduct for Financial Services Provider and representatives, states that client advice records listed in section 3(2) must be kept for a period of five years after termination, to the knowledge of the provider, of the product, concerned or, in any other case, after the rendering of the financial service concerned. A provider is not required to keep the records themselves, this function may be outsourced, however, records must be available for inspection within seven days of the registrar's request.
The FAIS Act is not the only legislation an FSP has to consider when determining the time period it is required to keep client records. Since the FSP is considered an accountable institution it will be required to consider the provisions of the Financial Intelligence Act ("FIC Act") when determining the period records must be kept.
2. What are the record-keeping duties in terms of the FIC Act?
In terms of Section 22 of the FIC Act "when an accountable institution is required to obtain information pertaining to a client or prospective client pursuant to sections 21 to 21H the institution must keep a record of that information." An accountable institution, which includes an FSP, has a duty to keep records obtained during the customer due diligence process. In terms of Section 22A, an accountable institution is required to keep a record of every transaction that is necessary to reconstruct a transaction.
2.1 What records are the FSP required to keep in terms of FIC?
a) Customer due diligence records which include but is not necessarily limited to
The identity of the client;
If a client is acting on behalf of another person – the identity of the person on whose behalf the client is acting as well as the client's authority to act on behalf of that other person;
If another person is acting on behalf of the client – the identity of that other person and the other person's authority to act on behalf of the client;
All client verification records;
The nature of the business relationship or transaction;
Source of funds;
Information on the business relationship; and
b) All records relating to the transaction records which may include the following:
The amount involved, currency, date of transaction, nature of the transaction and the parties to that transaction;
Any business correspondence; and
All accounts that are involved in transactions concluded by that accountable institution in the course of that business relationship; and that single transaction.
2.2 When does the record-keeping requirements expire in terms of FICA?
According to Section 23 of the FIC Act, the above-mentioned documents must be kept by an accountable institution for the following periods:
In the case of establishment of a business relationship, for at least 5 (five) years from the date on which the business relationship is terminated;
For a transaction concluded, for at least 5 (five) years from the date on which that transaction is concluded;
Records of a transaction or activity which gave rise to a report contemplated in section 29 of FICA, for at least five years from the date on which the report was submitted to the Centre
It is however further recommended that, if the institution is aware of an ongoing investigation which relates a transaction, to keep those records until the authorities confirm that the case has been closed.
A further consideration the FSP will have to take into account is the Protection of Personal Information Act. An FSP may be regarded as a responsible party in terms of the POPI Act.
3. What are the record-keeping duties in terms of the POPI Act?
Section 14 of the POPI regulates the retention and restriction of records and states "that records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless—
retention of the record is required or authorised by law;
the responsible party reasonably requires the record for lawful purposes related to its functions or activities;
retention of the record is required by a contract between the parties thereto; or
It also states that "Records of personal information may be retained for periods in excess of those contemplated in subsection (1) for historical, statistical or research purposes if the responsible party has established appropriate safeguards against the records being used for any other purposes."
Personal information, in short, is any information relating to an identifiable, living natural person or information of an identifiable existing juristic persons and include information such as race, gender, sec pregnancy marital status, addresses, employment history, opinions or view of a person to name but a few.
The POPI Act however further places a responsibility that a responsible party must destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after the responsible party is no longer authorised to retain such record.
In summary, taking into account the various legislation, an FSP has a duty to keep a record for the period of 5 years after termination, to the knowledge of the provider, of the product, concerned or after the rendering of the financial service concerned. If a suspicious report was however filed with the Financial Intelligence Centre in relation to the client the FSP has to keep records of the transaction or activity which gave rise to a report, for at least five years from the date on which the report was submitted to the Centre. Once the statutory time period to keep the records have lapsed the FSP shall have the duty to destroy or delete the records of personal information in such a manner that it prevents the reconstruction of the information in an intelligible form.