The FMA has produced a suite of documents setting out what financial institutions need to have in place to be licensed under the new Conduct of Financial Institutions (‘CoFI’) regime.

This Financial Law Fact Sheet looks at the FMA’s licensing requirements and what must be covered by a financial institution’s fair conduct programme in order to comply with the CoFI regime.

What is a financial institution?

Registered banks, licensed insurers, and licensed non bank deposit takers – being entities supervised by the Reserve Bank of New Zealand – are financial institutions under CoFI if they also offer ‘relevant services’, such as consumer credit contracts, call or term debt securities, or insurance.

What is the fair conduct principle?

The key to the CoFI regime is the new fair conduct principle that requires financial institutions to treat consumers fairly. This broad principle means financial institutions need to pay due regard to consumers’ interests, act in good faith, and assist consumers to make informed decisions. The principle also requires financial institutions to ensure consumers are not subjected to unfair pressure, tactics, or undue influence.

The fair conduct principle applies whenever a financial institution designs a service or product, provides or offers to provide that service or product to a consumer, and when dealing or interacting with a consumer in connection with that service or product. Importantly, the fair conduct principle also applies to a financial institution when an intermediary is involved in the provision of that institution’s relevant services or products to a consumer.

Financial institutions must keep this principle at the forefront when developing their fair conduct programmes.

What is a fair conduct programme?

Various ‘policies, processes, systems and controls’ will make up a financial institution’s fair conduct programme, being the requirements an institution will have in place ensure they meet the fair conduct principle.

A fair conduct programme must be in writing – even if it simply provides an overview of the relevant system, process, or control. As such, it is unlikely that a fair conduct programme will be contained in a single document. Rather it will comprise various documents and include effective policies covering product design, ongoing product suitability assessment, poor value product review, and identifying and assisting vulnerable customers. Internal complaints procedures and systems will also form part of fair conduct programmes.

The FMA mentions that an overarching framework document might be useful where a financial institution has large or complex operations. This document should list the policies, processes, systems and controls that form the institution’s fair conduct programme and explain the overarching structure of the programme.

Minimum programme requirements

For a fair conduct programme to be effective, it needs to be relevant and proportionate to the institution’s business. It must reflect the unique factors that characterise the enterprise – nature, size, and complexity – along with the type of products and services offered and the types of consumers engaged.

The fair conduct programme must cover:

• compliance with legal obligations to consumers;
• designing and managing services and products;
• identifying and mitigating poor conduct;
• training and supervising employees;
• designing and managing incentives;
• consumer communications; and
• ongoing programme review.

Compliance with legal obligations to consumers

The fair conduct programme must enable the financial institution to meet all of its legal obligations to consumers, including under the Fair Trading Act 1986, Credit Contracts and Consumer Finance Act 2003, and Consumer Guarantees Act 1993. In other words, the programme cannot be inconsistent with other obligations and should, in practice, assist in enhancing compliance with those obligations.

Designing and managing services and products

The fair conduct principle requires financial institutions to ensure that services and products are likely to meet the requirements and objectives of the consumers likely to use the service or product. This aspect of product and service design must be covered in the fair conduct programme. This will necessarily include identification of the types of consumers the institution expects to deal with, such as how financially sophisticated they are or whether they may be in vulnerable circumstances.

The programme should set out clear distribution methods for the institution’s various products and services, i.e. state how they are provided to consumers – directly, through licensed intermediaries, or via third party non-financial service businesses.

The fair conduct programme must also provide for regular review of those distribution methods to ensure compliance with the fair conduct principle and to determine whether there are any distribution deficiencies that need addressing.

Identifying and mitigating poor conduct

Similarly, the fair conduct programme must allow a financial institution to identify, monitor, and manage the risks associated with poor conduct. And this includes mitigating any poor conduct identified.

Financial institutions will need to have clearly defined roles and responsibilities – both at management and operational levels – to facilitate monitoring and mitigation. Such roles may be standalone or incorporated into an existing job description.

Fair conduct programmes must also provide for the retention of appropriate records to assess ongoing compliance with the fair conduct principle. As part of this, the programme must also set out how regular reporting about conduct risks will take place, including timeframes and matters that need to be reported to management or the board.

Training and supervising employees

Employees need to be trained on the products and services they provide to consumers and, more generally, on the procedures they must follow to ensure the financial institution’s compliance with the fair conduct principle (agents must also follow these procedures). The fair conduct programme will therefore need to set out requirements for training on new products and services, induction of new employees, as well as ongoing ‘refresher’ training.

The fair conduct programme must also set out how the institution will actively check that employees have completed training and that they have developed a reasonable understanding of matters covered by that training. ‘Checking’ requires more than just performing ad hoc reviews – rather, institutions should obtain assurances that each employee has the necessary competency to carry out their respective tasks.

Designing and managing incentives

The provision of incentives based on volume or value targets are extensively prohibited under CoFI. Where incentives are allowable, the fair conduct programme must clearly provide a means for designing and managing those incentives to avoid or mitigate adverse effects on the interests of consumers – the interests of consumers must be prioritised.

Consumer communications

The fair conduct programme must also set out how communications are to be provided to consumers, primarily about the institution’s products and services. And the programme needs to detail how the institution ensures communications are provided in a timely, clear, concise, and effective manner.

Ongoing programme review

Finally, financial institutions are required to regularly review their fair conduct programme to ensure it continues to be relevant and proportionate to their business, e.g. Has the business grown? Have products and services changed? Has a systemic conduct risk been identified that needs addressing? Methods should be in place, via the fair conduct programme, to identify any deficiencies and to promptly address them.

The FMA’s CoFI licence application allows institutions to select a review frequency. Yearly should suffice in most cases with smaller institutions, or those with simple service or product offerings, able to review their programmes less frequently.

Applying for a CoFI licence

All financial institutions must have a fair conduct programme in place before applying to the FMA for a CoFI ‘conduct’ licence. Although the programme does not need to be fully implemented at the time of application it must have been approved by the financial institution’s board of directors.

Online application

Applying for a CoFI licence must be done online via the FMA’s website. For most institutions it will simply be a case of confirming that, ‘yes’, the particular licensing requirement is satisfied. ‘No’ answers will result in a ‘please explain’ prompt.

Publicly available programme summary

Financial institutions are required to make a summary of their fair conduct programme publicly available for consumers – published on the institution’s website and available to any consumer who requests a copy. The FMA simply asks licence applicants to confirm they have a fair conduct programme summary and that the summary will be made publicly available before the institution’s licence goes live.

Minimum programme requirements

The FMA asks extensive questions of financial institutions to confirm that they have developed a fair conduct programme that satisfies the various minimum requirements. This includes processes regarding approvals and review of the programme.

If an institution has stepped through the express requirements of the new regime, as set out in this Fact Sheet, then this should be straightforward, i.e. a simple ‘yes’ in response to most application questions.

Services and products provided

Financial institutions will need to identify all services and products provided to consumers in New Zealand that are to be covered by the licence. ‘Services’ will be auto generated from the institution’s FSPR registration details. ‘Associated products’ need to be selected from a list and sublists provided by the FMA, e.g. consumer credit – mortgages, credit card, loans. Products removed from sale but still held by consumers must be included in the application.

The FMA is also seeking information about the number of existing associated products held by consumers. The online form will provide various ranges for institutions to select from: ‘1 to 5,000’, ‘5,001 to 25,000’, and so on, through to ‘more than 1,000,001’. Numbers should be determined on a product rather than consumer basis using the most recent data available.

Distribution methods

The application form also seeks details of the distribution channels used. A simple list is provided with institutions able to select ‘direct to consumer’ (either in person or by phone or digital methods); via ‘intermediary’ (such as through another licensed financial institution or financial advice provider) or ‘third-party’ (which in practice will include non-financial service providers).

Consumer care and handling conflicts

Incentive regulations will restrict an institution’s ability to provide commissions or benefits. The FMA expects policies and procedures for designing and managing incentives to expressly address potential or actual conflicts of interest – managing conflicts in a way that is fair to consumers and pays due regard to their interests. This will need to be confirmed as part of the application process.

Outsourcing

The FMA’s licensing process seeks information about the extent to which financial institutions outsource aspects of their licensed business. As per Standard Condition 4 for Financial Institution Licences, outsourcing arrangements are only relevant if an institution relies on the outsource provider to meet an aspect of their CoFI conduct licence obligations.

The application provides a list of possible ‘outsourced’ activities including customer service, record keeping, training, and product design. Institutions must confirm to the FMA that contractual arrangements are in place with each outsource provider and that appropriate due diligence was undertaken on each provider.

Business continuity plan

A business continuity plan is required under Standard Condition 5 for Financial Institution Licences. The FMA expects business continuity plans to be reviewed and tested annually (although this testing requirement is not a strict requirement of Standard Condition 5). Financial institutions will therefore need to confirm that they have an approved and documented business continuity plan in place. And confirm when that plan was last reviewed and tested and when it is next scheduled for review and testing.

Operational resilience

The FMA also expects financial institutions to have an operational resilience policy alongside their business continuity plan. As with continuity plans, licence applicants will need to confirm that they have an approved and documented policy in place, when it was last reviewed, and when it will next be reviewed.

Record keeping

Finally, the FMA asks institutions whether they have approved and documented record keeping processes. And, again, when these processes were last reviewed and when they will next be reviewed. 

Record keeping requirements are set out in Standard Condition 6 for Financial Institution Licences. The key focus of record keeping is demonstrating that the institution is taking all reasonable steps to comply with its fair conduct programme and the fair conduct principle.

Conclusion

The FMA will accept CoFI conduct licence applications from 25 July 2023. The CoFI regime is expected to be in full force from early 2025. With the FMA suggesting it takes around 3 months to process applications, we suggest financial institutions have their licence applications submitted by no later than September 2024.

Overall, an effectively designed fair conduct programme will ensure financial institutions can readily meet the FMA’s licensing requirements. The design of programmes will need to take into account the requirements of the Financial Markets (Conduct of Institutions) Amendment Act 2022, and any prescribed regulations, as well as the Standard Conditions for Financial Institution Licences and FMA guidance – the Licence Guide, Information Sheet on Fair Conduct Programmes, and the Guidance Note on Intermediated Distribution. 

Start a conversation 

If you would like to discuss CoFI licensing and fair conduct programmes please contact Catriona Grover on +64 4 498 0816, David Ireland on +64 4 498 0840, or Mark Schroder on +64 9 375 1120, on +64 4 915 0785 or email the team at bankingandfinancialmarkets.nz@dentons.com.