Compendium of effective approaches for financial consumer protection

Financial consumer protection should be an integral part of the legal, regulatory and supervisory framework, it should comprehensively cover all types of financial products and services and should reflect the diversity of national circumstances and global market and regulatory developments within the financial sector.

Regulation should reflect and be proportionate to the characteristics, types, risks and variety of the financial products and services, providers and consumers. Regulation should account for the various rights and responsibilities of the relevant actors and be responsive to new products, services, designs, technologies and delivery channels. Approaches should be developed to address new delivery channels for financial products and services, including through digital distribution, while preserving the potential benefits of these channels for consumers. Strong and effective legal and judicial or supervisory mechanisms should exist to protect consumers from and sanction against misconduct, financial frauds, abuses and errors.

The legal, regulatory and supervisory framework should provide regulators and supervisors with an appropriate regulatory toolkit which is flexible so they can adapt to emerging risks as required, including to changes at the regulatory perimeter. Where relevant, to complement approaches relating to conduct and processes, the framework could include promoting appropriate outcomes for consumers to contribute to their financial well-being.

Financial services providers and intermediaries should be appropriately and proportionately regulated and/or supervised, with account taken of relevant service and sector specific approaches.

Relevant non-governmental stakeholders – including industry (including small business) and consumer organisations, professional bodies and research communities – should be consulted when policies related to financial consumer protection and education are developed or reviewed. Access of relevant stakeholders and in particular consumer organisations to such processes should be facilitated and enhanced.

• The legal and regulatory framework should, among other things, uphold the principle of technological neutrality, not favouring or discriminating against any specific technology, while maintaining an appropriate level of financial consumer protection to address risks specific to the digital ecosystem. It should also be adaptable amid rapid change and innovation, particularly in the context of digitalisation.
• Policymakers should actively monitor market trends and changes brought in retail financial services by digitalisation to ensure the legal and regulatory framework is up-to-date and appropriately protects consumers. Particular attention should be paid to how changes in the market are impacting consumers' behaviour, and potential risks associated with these trends.
• Policymakers should operationalise a process to review whether existing regulatory policies, rules or practices may may hinder or create barriers to competition and financial innovation. For example, regulation can be complex, hard to understand and slow to adapt to new business models or innovation. Regulatory uncertainty or complexity in licensing processes can potentially deter businesses from entering the financial services market. Therefore, regulations in this regard should be proportionate and flexible, while also maintaining appropriate consumer and investor protection requirements.
• Policymakers should ensure that regulation and supervision allows for innovation, competition, and the challenging of established firms and business models without putting consumers at unacceptable risk. Where relevant, policymakers should explore ways of promoting competition, enhancing interoperability and simplifying the exchange of and access to data.
• Oversight bodies (i.e. domestic public authorities responsible for the oversight of financial consumer protection) should adopt a risk-based approach to digital financial products, focusing on areas of highest risk to consumers. This approach should also be flexible enough to adapt to changes in business and distribution channels enabled by technology. Importance should be given to cybersecurity issues, as appropriate, to ensure security of and promote trust in digital financial products and services.
• Oversight bodies should co-operate among themselves and with relevant stakeholders in developing and applying the legal, regulatory and supervisory framework for digital financial consumer protection.
• Oversight bodies should consider effective methods for communicating directly with consumers about relevant digital financial consumer protection issues such as emerging risks associated with new products or distribution channels. This may include the use of mass media channels (e.g. websites, traditional and social media), the publication of informative and educational materials, and the organisation of public engagement events (i.e. conferences or town hall meetings).

There should be oversight bodies (dedicated or not) explicitly responsible for financial consumer protection, with the necessary authority to fulfil their mandates. They require clear and objectively defined responsibilities and appropriate governance; operational independence; accountability for their activities; adequate powers; resources and capabilities; defined, effective and transparent enforcement framework and clear and consistent regulatory processes. Oversight bodies should observe high professional standards, including appropriate standards of confidentiality of consumer and proprietary information and the avoidance of conflicts of interest.

Oversight bodies should have the capability, flexibility and the appropriate range of tools and powers to carry out their role. This may mean adapting market monitoring, for instance relating to technological or sustainable finance developments, or the power to intervene in specific, high-risk products to protect consumers from harm where appropriate. Oversight bodies should regularly assess the effectiveness of supervision tools and enforcement mechanisms. Effective enforcement mechanisms may include, for example, penalties, sanctions, licence revocation, variations in permissions to trade, publicising enforcement outcomes, compensation, restitution and other remedies.

The oversight approach should ensure that policy, regulatory and supervisory actions that promote financial innovation, stability, integrity, inclusion or other objectives appropriately account for their effects on financial consumer protection and consumer outcomes.

Co-operation with other financial services oversight authorities and between authorities or departments in charge of sectoral issues should be promoted. A level playing field across financial products and services should be encouraged as appropriate. International co-operation between oversight bodies should also be encouraged, while specific attention should be considered for consumer protection issues arising from international transactions, including cross-border payments, marketing and sales, and risks arising from digitalisation and automation of financial products and services.

• Oversight bodies should ensure they have and maintain adequate knowledge of the financial services market. They may accomplish this by:
  • conducting market reviews or research to understand and monitor developments e.g. in terms of new products or services, distribution channels, and providers and market participants.
  • engaging proactively and regularly with businesses (both existing and new) regarding innovative products, services or channels.
  • engaging with industry representatives and other relevant stakeholders to gather information in relation to technological developments, and trends and emerging issues in the market, including in converging and connected markets. Such issues may include preparing for cyber incidents or other risks arising from digitalisation.
  • engaging with other relevant financial and non-financial oversight bodies to ensure market developments and key trends are communicated, facilitate information sharing or co-ordinate monitoring activities in areas of mutual interest.
• Oversight bodies should ensure existing regulatory, supervisory and enforcement tools are adapted to, and explore new avenues for operating effectively in, the digital environment. Actions could include:
  • establishing or upgrading systems and processes to collect, store and analyse relevant data to inform regulatory decisions and supervisory efforts and understand the behaviour of market participants, including consumers
  • ensuring access to, or being able to gain access to, such data as is necessary to allow for effective off-site monitoring.
  • exploring the use and application of technology (i.e. RegTech or SupTech) to support the supervision of financial services providers and to identify and monitor risks arising in the financial system.
• Oversight bodies should have the proper resources and capabilities to operate effectively and flexibly in the digital environment, for example by:
  • ensuring that staff have the necessary skills and capabilities to identify and understand potential risks arising from the design and distribution of digital financial services.
  • ensuring staff training and development is up to date with latest technological developments and applications.
• Oversight bodies should be capable of addressing technological innovation issues and developments in an effective and multidisciplinary way, while ensuring key consumer protections are maintained. In relation to licensing or authorisation requirements, this can be done by establishing mechanisms or adopting proportionate approaches which allow businesses to be innovative, while maintaining relevant safeguards and protections for consumers.^[1]
• Approaches may include, for example, establishing “regulatory sandboxes” or “innovation hubs” to allow for innovation and the testing of new business models in a controlled environment. Where such testing methods are established, they should be governed by clear rules or principles to ensure fairness, transparency, consumer protection and open access to existing and new market participants.
• Other approaches may include proportionate regulatory approaches or the provision of regulatory support to promote better understanding of existing regulations from the outset, thereby improving their ability to comply.
• Creating internal multidisciplinary working groups to deal with innovation issues (i.e. responding to requests for information from businesses and evaluating compliance of products and services with the existing legal and regulatory framework) with the participation of relevant units or departments and, where relevant, oversight bodies responsible for data protection, competition and other cross-cutting matters.
• Providing advice or guidance to new market entrants on the application of the regulatory framework to innovative approaches or business models that may deliver benefits to consumers. Such advice or guidance could include lessons from initiatives such as regulatory sandboxes or innovation hubs. Offering guidance to all market participants can also enhance understanding, promote compliance from the outset, and support consistent consumer protection outcomes.
• Regularly evaluate existing regulations and, where necessary, redesign, adapt, or clarify them to ensure they remain effective, proportionate, and responsive to innovation while safeguarding consumer protection outcomes.
• The provision of financial services through digital channels can facilitate cross-border transactions, which can present particular risks, e.g. in terms of the ability to seek redress or take enforcement action if required. Given this, oversight bodies from different jurisdictions should co-operate to ensure that consumers remain adequately protected. Such co-operation may include:
  • sharing information with the oversight bodies from other jurisdictions that is relevant for an effective supervision of cross-border marketing and sale of financial products and services.
  • where possible, ensuring that consumers’ complaints arising from cross-border transactions are redirected to the relevant competent authority for effective handling and resolution.
  • co-operating, through international standard setting bodies and other relevant forums to promote consistency, prevent opportunities for regulatory arbitrage and support cross-border enforcement.

Governments, oversight bodies and financial services providers and intermediaries should seek to support consumers’ access to and use of financial products and services where possible and promote an inclusive financial system. Achieving these objectives requires both addressing barriers that prevent consumers from accessing and using financial products and services in the formal, regulated financial system, as well as ensuring consumers remain included in the financial system, for example, in the event of financial hardship or other circumstances giving rise to financial exclusion. To support this, policymakers and oversight bodies should consider embedding financial inclusion and financial consumer protection objectives in policies and strategies relating to innovation.

Governments, oversight bodies, and financial service providers should leverage digitalisation where relevant, including the use of interoperable systems. At the same time, it should be recognised that consumers may have different needs and levels of digital skills that affect financial access and usage, for instance, access to cash and traditional forms of financial services may be important for some consumers.

• Consumers should have access to a range of formal and regulated financial products and services (e.g. basic bank accounts, mobile money accounts, savings, insurance and investments products, etc.) that help them meet their financial goals and objectives and ultimately contribute to their financial well-being. Access and inclusion should be facilitated for all consumers, including those in vulnerable circumstances.
• Financial service providers and intermediaries should endeavour to promote and support financial inclusion and financial well-being, including for consumers experiencing vulnerability, through internal policies and procedures. This could include, for example, conducting suitability assessments when offering financial products and services, identifying when consumers are experiencing financial hardship and offering debt counselling services. Additionally, safe and affordable access to products and services should be promoted in a manner that contributes to a range of positive consumer outcomes, including their capacity to manage expenses, be resilient to financial shocks, meet their financial objectives and be satisfied and confident in their financial lives.
• The use of new technologies and digital means to improve access to financial products and services, as well as access to traditional financial service providers and intermediaries, should take into account differing needs, digital capabilities and preferences of consumers, and should avoid risking financial exclusion. For example, financial service providers and intermediaries should continue to facilitate access to cash, and other traditional means of distribution, as reduced cash and banking infrastructure could risk increasing financial exclusion.
• National strategies and/or action plans, developed by policymakers, regulators and supervisors, to promote access and inclusion in the financial system should be evidence-based and have clear, specific objectives and monitoring and evaluation frameworks including, as relevant, metrics. 
• Policymakers, regulators and supervisors should support consumers to be able to remain included in the financial system, through policies and programmes that promote consumers’ financial well-being. For example, in line with the OECD Recommendation on Financial Literacy, policymakers should develop financial literacy programmes to support decision-making about saving, investment, retirement and pensions, which can in turn facilitate more empowered engagement with financial services.
• Policymakers, regulators and supervisors should establish and promote policies, standards and regulatory requirements that aim to ensure the continued participation of consumers experiencing vulnerability or financial hardship in the financial sector. These measures could include mandating access to debt counselling services, supporting consumer associations and setting guidelines for inclusive financial products and practices.
• In line with the stated objectives of the Global Partnership for Financial Inclusion (GPFI), policymakers, regulators and supervisors should undertake initiatives to understand factors contributing to low levels of consumer usage of financial products and services, despite having access to them. This may include a variety of factors, such as low-quality products and services that do not offer value for money, insufficient incomes that limit consumers’ ability to maintain accounts or meet minimum balance requirements, or a mistrust of financial institutions based on negative experiences.
• As referenced in the G20 High-Level Principles for Digital Financial Inclusion (2016), policymakers, regulators and supervisors should seek to leverage digitalisation to support inclusive innovation, while monitoring and mitigating the potential risks associated with innovation. One way to address this is by explicitly embedding objectives related to inclusion and consumer protection within innovation facilitation schemes, such as regulatory sandboxes.

Financial literacy and awareness should be promoted by all relevant stakeholders as part of a wider financial inclusion and/or literacy strategy. Appropriate mechanisms should be developed to help consumers gain the knowledge, skills, behaviours and attitudes to be aware, understand risks and opportunities, make informed choices, know where to go for assistance, and take effective action to support their financial well-being and resilience. Such mechanisms may also involve enhancing digital financial literacy skills, raising awareness of digital security risks and promoting safe online and digital transactions.

Financial literacy programmes, including clear and timely information on consumer protection, rights and responsibilities, should be easily accessible by all consumers and should be promoted, especially for relevant target groups, for example, those experiencing vulnerability.

Taking into account national circumstances, financial literacy and awareness programmes should be delivered through diverse and appropriate channels, including digital ones where relevant. Financial literacy programmes should begin at an early age and be accessible for all life stages, and should include mechanisms to evaluate and improve their effectiveness. Further, national and international comparable information on financial literacy and awareness should be collected in order to assess and enhance the effectiveness of approaches to financial literacy. All relevant stakeholders should be encouraged to implement the international principles, guidelines and methodologies on financial literacy developed by the OECD International Network on Financial Education (INFE).

For implementation guidance relating to this Principle, refer to the OECD-INFE work: International Network on Financial Education (INFE) | OECD.

Fair, efficient and competitive markets should be promoted in order to provide consumers with greater choice amongst financial products and services, create competitive pressure on providers to offer quality and competitively priced products, enhance innovation, foster inclusion and maintain high service quality. Policy makers should aim to ensure that competition between providers meets these objectives without compromising consumer outcomes. Consumers should be able to search, compare, share data and, where appropriate, switch between products and providers easily and at reasonable and disclosed costs, for instance by leveraging interoperable systems. 

• The approach by jurisdictions in relation to competition laws/regulations and authorities tends to vary, with some having specific financial consumer protection related completion rules, others tending to have economy‑wide competition rules and some jurisdictions have a mixture of both. As part of the 2021-22 review of the Principles, jurisdictions reported that about half have Dedicated Competition Authority(ies) and the other half have a shared responsibility between Financial Consumer Protection Oversight Bodies and a Dedicated Competition Authority(ies), highlighting the importance of effective co-ordination between relevant agencies.^[1]
• Further, due to the increasing attention paid to competition in digital markets and the accelerating digitalisation of the financial sector, it is critical that financial consumer protection frameworks maintain a strong link to competition law and policy.
• Specific implementation guidance relating to this Principle has not been developed by the Working Party. For market-wide resources refer to the OECD Competition area: https://www.oecd.org/competition/.

The following OECD instrument/s is/are relevant:

• OECD Recommendation of the Council on Competition Assessment (2019)
• OECD Recommendation of the Council on Competitive Neutrality (2021)

All financial consumers should be treated equitably, honestly and fairly at all stages of their relationship with financial services providers. Treating consumers fairly should be an integral part of the good governance and corporate culture of all financial services providers and intermediaries. The enhanced use of digital technology to support decision making by financial services providers should not lead to inappropriate or discriminatory outcomes for consumers.

Special attention should be paid to the treatment of consumers who may be experiencing vulnerability. Approaches may take into account that consumer vulnerability can manifest differently and be applicable in different circumstances and may be due to a combination of personal characteristics, economic situations and market conditions. Approaches could include, for example, the provision of impartial debt advice for consumers suffering financial hardship due to over-indebtedness. 

• Policymakers should seek to understand, and where appropriate, address the issues and barriers hindering consumers, particularly consumers who may be vulnerable, from fairly and equitably accessing different financial markets, products and services.
• Firms should ensure that digital technology or algorithms underpinning digital financial services, such as digital financial advice, are designed to produce outcomes which are objective, consistent and fair for financial consumers. These systems should take account the financial capabilities, situation and needs of their customers, including their level of digital literacy, and should avoid discriminatory or inappropriate outcomes for consumers who may be vulnerable. The methodology and assumptions underpinning such programmes should be transparent, understood by the firm and capable of being explained.
• Firms should approach algorithms and the potential risks in the same way they approach risks arising from other financial models. This includes ensuring proper documentation, governance oversight, and testing the underlying assumptions, with clear processes and expert and independent validation of the outcomes they produce. Firms should also ensure that such validation assesses potential impacts on consumers, which includes risks for vulnerable groups.

Financial services providers and intermediaries should provide consumers with key information on the fundamental benefits, risks and terms of the product, including for cross-border payments and other transactions and regardless of the distribution channel. They should also provide information on conflicts of interest associated with the intermediaries through which the product is sold.

In particular, appropriate information should be provided on material aspects of the financial product at all stages of the relationship with the consumer. All financial promotional material should be accurate, honest, understandable, transparent and not misleading. Standardised pre-contractual disclosure practices (e.g. forms) should be adopted where applicable and possible to allow comparisons between products and services of the same nature. Specific disclosure mechanisms, including possible warnings, should be developed to provide information commensurate with the complexity and riskiness of products and services. The use of digital channels may provide innovative opportunities to engage consumers with disclosure information via different formats.

Where possible, consumer research should be conducted and behavioural insights used to help determine and improve the effectiveness of disclosure requirements, acknowledging the limits to disclosure by itself in terms of ensuring consumer understanding and engagement. Improved transparency may help consumers make more informed choices and encourage financial institutions to address these factors. For example, as sustainable finance becomes increasingly important to consumers and financial services providers, transparency on methodology will be important to help consumers understand their investments and counter the risk of greenwashing.

Consumers should also be made aware of the importance of providing financial services providers with relevant, accurate and available information.

• Disclosure and transparency requirements should be applicable and adequate to the provision of information through all channels relevant to digital financial services and covering all relevant stages of the product lifecycle. For example, policymakers should ensure that proportionate requirements are in place for the clear, simple and comparable disclosure of terms, fees and commissions.
• Consumer communications should be clear and simple to understand across all channels of communication, including digital channels.
• Existing disclosure requirements should be evaluated in the context of digital financial services, and where necessary, new requirements may need to be developed that take into account disclosure via digital delivery methods (e.g. minimum scroll-down time for reading pre-contractual information).
• An understanding of consumer decision-making and the impact of behavioural biases should be embedded in the development of policies relating to disclosure requirements and/or alternative approaches, to ensure policies are customer-centric and allow for informed decision-making.
• Financial services providers should be encouraged to test digital disclosure approaches to ensure their effectiveness, taking into account factors such as screen size, communication format, etc. and recognising that there may be consumers in the target audience for the product or service who are not sufficiently digitally literate.
• Providers should test new ways of making disclosure more effective for consumers through more targeted, proportionate and customer-centric approaches, in both digital and traditional delivery channels.
• Regulators and supervisors should monitor financial services providers’ disclosure practices in their provision of services through digital means, as well as the disclosure practices of third parties involved in offering digital financial services. Examples of actions to be taken include:
  • Reviewing financial institutions’ disclosure practices for products and services delivered through digital channels, including what information is disclosed, how it is disclosed, the timing and timeframe of disclosure, how customers can confirm they have access to the information, how customers can revisit the disclosure material provided in a digital format, and how consumers can request additional information or clarification if needed, etc. Such reviews could be conducted through methods such as mystery shopping exercises.
• Regulators and supervisors should assess the information disclosed to clients when they contract products or services through websites, apps and restricted platforms (e.g. online banking).
• Advice, including digital financial advice, should be objective and based on the customer’s profile, objectives, financial literacy and experience, as appropriate. For example, algorithms used to generate digital advice should be objective, consistent and transparent.
• Financial services providers should ensure that the methodology underpinning digital advice services is clear and transparent, that options for recourse are available and that these services lead to fair consumer outcomes.
• Financial services providers should consider how technological developments and the increasing availability of and access to data creates opportunities to test and develop alternatives to traditional forms of disclosure. Examples include the publication of particular indicators relating to a financial product or service (e.g. consumer complaints) to support decision making, introducing “cooling on” periods to give consumers additional time to confirm their purchasing decision, using “smart defaults” to ensure consumers are automatically defaulted to the best option for them, and enabling “personalised friction” tools that allow consumers to create steps (such as tailored log-ins) for breaks in spending.
• Requests for consent should be as clear, understandable and not misleading as possible in the disclosure of policies relating to the collection, storage or use of personal data and relying on consumer consent.  Consideration also may be given to alternative or supplementary approaches, such as “privacy by design” (whereby data protection is embedded in the design of a product or system from the outset) or “data minimisation” (whereby only the minimum amount of data is collected and stored for the minimum amount of time). It is noted that not all public authorities responsible for financial consumer protection regulation have direct responsibility for data protection issues in their jurisdiction.

Quality financial products are those that are designed to meet the interests and objectives of the target consumers and to contribute to their financial well-being. There should be appropriate product oversight and governance by financial services providers, and where appropriate, by intermediaries, to ensure that quality financial products are designed and distributed. This may include requirements for appropriate systems to design, approve, manage and monitor financial products through their life cycle to ensure that they meet the interests and objectives, and aim to contribute to the financial well-being, of consumers that the products and services are designed for, as well as the relevant regulatory requirements.

In order to promote quality financial products that offer value to consumers, financial services providers may be required to define a target market for a financial product, conduct research and consider behavioural insights to understand the target market and, depending on the type, complexity and risk of the product, carry out testing before launching the product.

• As referenced in Principle 8, quality financial products are those that are designed to meet the interests and objectives of the target consumers and to contribute to their financial well-being. To achieve this, firms should have adequate mechanisms and well-defined methodologies in place to design financial products that are aligned with the relevant interests, characteristics, and objectives of the target consumers and contribute to their financial well-being, accounting for the specific needs of consumers who may be vulnerable. These mechanisms should be adapted as needed in proportion to the potential for harm and the complexity of the product. To establish the interests and objectives of the target consumers, firms should conduct research to define the target market of the financial products and carry out testing of said product, under relevant scenarios as necessary. This process of knowing the target market improves the likelihood of designing a product that meets the needs of the consumers, fostering a successful distribution strategy. Pricing structures should be created to reflect the benefits of the product and the costs borne by providers, to achieve fair value for money. Firms should evaluate these mechanisms on a regular basis and update when necessary.
• In approving new products and reviewing existing products, the approval should be given by a designated group with the requisite authority within the firm. In instances where products are designed as part of a third-party arrangement, the firm should have sufficient oversight on the product design process.
• In distributing financial products, including through digital channels, firms should consider the suitability of the financial product for their target consumers, considering the target consumers’ financial situations, characteristics, and needs, including vulnerable circumstances. When distributing financial products digitally, firms and intermediaries should consider how the design of the online choice environment can support suitability and targeting. Similarly, firms should provide intermediaries with the necessary information in order to have an adequate knowledge of the product and market it properly. Firms and intermediaries should align a distribution strategy to the target market to facilitate adequate targeting and prevent distribution outside the target market, ensuring that consumers can understand the features and risks of a product. Additionally, if it is clear that a product is not suiting consumer needs, firms should take necessary steps to change the distribution strategy, and the product. There should be mechanisms in place to ensure that consumers can easily switch to products and services that better fit their needs.
• Throughout the life cycle of a financial product, firms should monitor and evaluate the suitability of the financial product to guarantee they continue to meet the interests and objectives of target consumers, including the evaluation of whether the distribution strategy works effectively and prevents distribution outside the target market. As addressed further in Principle 9, outcomes should be driven from the top, with strong senior championing and oversight, running all the way to product teams designing products. Firms should take the necessary steps, which could include changing, modifying or withdrawing the product, where appropriate, to mitigate and address consumer harm.
• Policymakers should ensure product governance requirements are in place to mitigate and avoid consumer detriment. Consequently, oversight bodies should have comprehensive evaluation measures in place to ensure that firms comply with the regulatory requirements to support quality financial products. These supervisory measures should adopt an outcomes and risk-based approach, rather than focus on procedural compliance and box-ticking. Authorities may issue supervisory guidance (e.g. letters, guidance notes, warnings, regulatory guides) to complement existing regulation and assist firms in understanding and applying regulation, including communicating their expectations regarding what constitutes a quality financial product. In addition to supervisory guidance, authorities can also collaborate and engage with self-regulatory organisations and industry associations to help enhance best practices and support industry standards for new products. Firms and intermediaries should be able to explain their product governance procedures, in addition to how their product meets the interest and objectives of the consumer, and should provide these to regulators upon request.
• In the case of noncompliance of firms with the product governance requirements and/or poor product design, inappropriate product distribution, or products deemed to be harmful to consumers, policymakers, regulators and supervisors may consider using product intervention powers. This can include the use of the broad regulatory and supervisory toolkit, in addition to a mechanism that provides regulators with the ability to intervene when a financial product risks resulting in serious consumer detriment. 

Financial services providers and intermediaries should have as an objective to work in the best interest of consumers and be responsible for upholding financial consumer protection. Financial services providers should also be responsible and accountable for the actions of their intermediaries.

The conduct and culture of financial services providers and their intermediaries should be aligned to promoting the fair treatment of consumers and achieving appropriate consumer outcomes that contribute to their financial well-being.

Depending on the nature of the transaction and based on information primarily provided by consumers, financial services providers and intermediaries should assess the related financial capabilities, situation and needs of consumers before agreeing to provide them with a product, advice or service. They should recommend to consumers suitable products or services that aim to deliver appropriate outcomes and ultimately contribute to their financial well-being.

Financial services providers and intermediaries (especially those who interact directly with consumers) should be properly trained and qualified. Financial services providers and intermediaries should endeavour to avoid conflicts of interest, for example, from remuneration or other incentive structures. When such conflicts cannot be avoided, financial services providers and intermediaries should mitigate the impact by having in place internal mechanisms to manage such conflicts, ensure proper disclosure or decline to provide the product, advice or service. Disclosure as a means of effectively managing conflicts of interest may be limited due to consumer understanding and behavioural responses, and behavioural insights should be used, where relevant, to test and inform approaches.

The provision of advice, regardless of the distribution channel, should be objective, in the best interests of the consumer and should be based on the consumer’s profile considering the complexity of the product, the risks associated with it, as well as the consumer’s financial objectives, knowledge, capabilities and experience.

The remuneration structure for both financial services providers and intermediaries should be disclosed and made transparent to consumers, and be designed to encourage responsible business conduct, fair treatment of consumers and to avoid conflicts of interest.

• The objective to work in the best interest of the consumer should be central to the purpose of a financial service provider and their intermediaries, irrespective of the channel(s) used to contract financial products or services.
• Financial services providers and their intermediaries should provide customers with assistance as appropriate when selling a financial product or service through, for example, explanatory notes attached to the pre-contractual information provided, FAQs specifically related to the product or service being sold, and/or providing the possibility of human interaction during the process (e.g. email, telephone). The provision of assistance, regardless of the distribution channel, should be objective, and take into account the consumer’s individual characteristics and needs, as well as the complexity of the products and risks associated with it.
• Consumers should receive explicit information on the true contractual party involved in the provision of the financial product or service through digital means, e.g. services provided by online aggregators or brokers. Where there are multiple entities involved, especially if one of them is not a financial institution, consumers should receive information on the identification and responsibilities of each party involved in the transaction.
• Financial service providers and intermediaries should endeavour to recommend suitable products or services that aim to deliver appropriate outcomes that align with a consumer’s financial objectives, and ultimately contribute to a consumer's financial well-being. Financial service providers and intermediaries should also take into account the potential differences in consumer behaviour when transacting through digital means versus more traditional methods, e.g. more frequent access of digital financial services, different levels of financial capability, and potentially shorter attention spans when transacting online.
• When using digital tools for decision-making, including those underpinned by artificial intelligence (e.g. automated credit scoring models), financial service providers and intermediaries should make sure they are robust, appropriately tested and provide consumers with the right to human intervention, where appropriate, to mitigate against irresponsible or unfair outcomes. Irrespective of whether digital technology was used, consumers should have the right to request and obtain a clear explanation of assessment or decisions made, to the extent that this information is not commercially sensitive.
• Recruitment processes should be tailored to identify employees that will embrace the firm’s culture and act in line with the firm’s purpose. Employees should be properly qualified and trained on a routine basis, especially for those who interact directly with consumers.
• Financial service providers and intermediaries should ensure that their internal policies and procedures/codes of conduct contain guidance, as appropriate, on responsible business conduct, best interests principles, sales processes etc. People-related policies and practices should be designed to promote and embed appropriate behaviours and deliver appropriate outcomes, and should endeavour to avoid conflicts of interest, for example, from remuneration or other incentive structures. In the event of a conflict of interest that cannot be avoided, financial services providers and intermediaries should have the proper procedures in place to manage the arising risks, including declining to provide the financial product or service. 

Relevant information, control and protection mechanisms should be appropriately developed and implemented by oversight authorities and financial services providers and with a high degree of certainty protect consumers’ deposits, savings, and other similar financial assets, including against fraud, scams, misappropriation or other misuses. These protection mechanisms should be readily adapted to the ways new technologies, such as digital assets, are used, as well as to online scams, fraud and misuse, and other digital security risks. They should include clear and transparent liability arrangements between financial services providers and consumers in the event of financial loss.

Policymakers and oversight authorities should work collaboratively with relevant stakeholders, including other government and regulatory agencies, digital security agencies, law enforcement agencies, financial services industry and utility companies, to raise public awareness of digital security risks and promote safe online and digital transactions.

• Policymakers and oversight authorities should ensure they have the necessary technological capacity, resources and supervisory tools to oversee the measures implemented by financial services providers to mitigate digital security risks and react to digital security incidents where the financial assets of consumers are at risk.
• Policymakers and oversight authorities should work collaboratively with foreign counterparts and relevant international organisations and networks to share information and intelligence about such frauds and scams that have cross-border aspects.
• Oversight authorities should conduct ongoing monitoring, including collecting data and information from industry, to ensure awareness of developments in the market and the main digital security risks, for instance, innovative payments’ solutions and precautionary measures to mitigate digital security risks. This could include mandatory reporting by financial services firms where necessary and appropriate. The OECD Recommendation on Digital Security Risk Management for Economic and Social Prosperity provides guidance for strategic approaches to the management of digital security risk aimed to optimise the economic and social benefits expected from digital openness.
• Policymakers and oversight authorities should work with industry, digital security and law enforcement agencies to explore role of technological innovation to detect and combat fraudulent behaviour targeting financial consumers, for example through the use of artificial intelligence to identify and block phone numbers used for voice phishing or identify potential harmful emails.
• Policymakers and oversight authorities should work with financial service providers to ensure that the application of arrangements for limitations on liability of financial consumers for fraudulent or unauthorised transactions extend to new types of mobile or online transactions (for example “push payments”).
• Policymakers and oversight authorities should work collaboratively with relevant stakeholders, including other government and regulatory agencies, digital security agencies, law enforcement agencies, financial services industry and utility companies, to run and/or participate in campaigns to raise public awareness of digital security risks and promoting safe online and digital transactions.
• Policymakers and oversight authorities should participate in or consider the establishment of networks or communities of practice among agencies and industry to promote sharing of experiences of digital security risks including threats, vulnerabilities, incidents and mitigation measures. Information sharing and monitoring arrangements that may support this include the Financial Services Information Sharing and Analysis (FS-ISAC) and various types of CERTs (computer emergency response teams).
• Policymakers and oversight authorities should participate in, or consider establishing, dedicated reporting channels for financial consumers to report frauds and scams. Where such channels exist, they should be kept up-to-date in terms of categorisation of online and mobile frauds and scams to support data collection and law enforcement, including cross-border activity where relevant. This should be done, where appropriate, in co-ordination with digital security and law enforcement agencies.
• Oversight authorities should use complaints handling data and analysis to identify potential security breaches/incidents, assess risks and identify the best practices adopted by financial services providers.
• Policymakers and oversight authorities should request that financial services providers report statistical data on fraud activity to oversight authorities, in particular concerning payment services, on an annual basis.
• Policymakers and oversight authorities should ensure that financial services providers are required to continuously assess the digital security risk to the services they provide, adopt appropriate security measures to reduce the risks, and inform financial consumers of the security procedures that should be adopted to minimise the risk of online fraud.
• Policymakers and oversight authorities should ensure that financial services providers have in place a digital security risk management framework, defining, for example, security objectives, roles and responsibilities. This framework should be documented, approved and periodically reviewed. The security risk framework should include appropriate evaluation of the cyber resilience of third-party providers, where financial service providers outsource activities or the provision of digital services to such third party providers.
• Policymakers and oversight authorities should ensure that financial services providers monitor threats and vulnerabilities and regularly review the defined risk scenarios (in other words, a cyclical risk management process). They should also ensure the consistent and integrated monitoring, handling and follow-up of security incidents, including security-related customer complaints.
• Financial services providers should ensure the implementation of sufficiently strong customer authentication mechanisms when contracting a digital financial product or service. This could include exploration of technological innovation to enhance customer authentication and security measures, for example use of two-factor authentication methods.
• Policymakers and oversight authorities should ensure that financial services providers have in place an effective and convenient process for financial consumers to report unauthorised or fraudulent transactions; any breaches of authentication mechanisms such as passwords; or loss of an access device or token.
• Policymakers, oversight authorities and financial services providers should consider use of digital channels to issue warnings to clients about identified threats or scams.

The following OECD instruments are relevant:

• OECD Recommendation on Protecting Consumers from Fraudulent and Deceptive Commercial Practices across Borders (2003)
• OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy (2007)
• OECD Consumer Policy Guidance on Mobile and Online Payments (2014)
• OECD Recommendation on Digital Security Risk Management for Economic and Social Prosperity (2015)
• OECD Recommendation on Consumer Protection in E-Commerce (2016)
• OECD Recommendation on Artificial Intelligence (2019)

Consumers’ financial and personal information should be protected through appropriate control and protection mechanisms. These mechanisms should define the purposes for which the data may be collected, processed, held, used and disclosed (especially to third parties). The mechanisms should acknowledge the rights of consumers regarding consenting to data-sharing, accessing their data, being informed about breaches impacting their data, and seeking redress such as the prompt correction and/or deletion of inaccurate, or unlawfully collected or processed data. There should be co-operation among oversight bodies responsible for consumer data protection and privacy.

• Policymakers and oversight authorities should ensure that the legal, regulatory and supervisory framework for financial consumer protection includes appropriate safeguards and measures for the protection of consumer data and privacy as it relates to transactions with financial services providers. The framework should clearly define “personal data” and establish requirements for its lawful collection and use. In some jurisdictions, administration of this framework may be the responsibility of financial regulators national consumer protection bodies or other authorities, while in others the responsibility lies with dedicated personal data protection authorities, or both.
• Policymakers and oversight authorities should work with financial services providers to encourage them to (1) make their information on data collection, processing, disclosure and usage practices transparent, and (2) provide consumers with the ability to make informed decisions about their data at the relevant time and context.
• Policymakers and oversight authorities responsible for financial consumer protection should liaise with data protection authorities, where relevant, to ensure understanding and application of data protection laws and regulations to financial services providers. Such co-operation could include developing or issuing dedicated guidance to financial services providers to promote compliance.
• Policymakers and oversight authorities should establish arrangements for co-operation and information sharing with data protection authorities, where they exist. These arrangements may take the form of a memorandum of understanding, legislative provisions enabling such information-sharing, or both at the national and international levels.
• Where data protection laws are administered exclusively by data protection authorities (i.e. where the financial consumer protection authority has no direct oversight), information on breaches of data protection laws should nevertheless be taken into consideration when assessing the fitness and properness of financial services providers in meeting their obligations to financial consumers.
• Financial services providers should implement appropriate policies and adequate internal control measures to ensure compliance with personal data protection regulations and, where relevant, uphold consumers’ right to personal data privacy. This may include verifying that effective mechanisms are in place to safeguard personal and financial information, as well as ensuring adequate security mechanisms to protect financial transactions.
• Where applicable, financial services providers should ensure that requests for consent (including those put forward by their intermediaries) to collect, store, use or disclose personal data in relation to a financial product or service are clear, understandable and presented at a relevant time and in the appropriate context to. Such requests should avoid the use of overly legal language and technical or specialised terminology that may hinder consumer understanding and their ability to provide informed consent.
• Financial services providers and their intermediaries should be responsible for using consumer data only for legitimate purposes and in a manner that serves customers’ interests. This may include applying a legitimate purposes test, which limits the use of data to purposes that are compatible, consistent, and beneficial to consumers, while permitting the use of de-identified data to support the development of new and innovative products and services. It may also include a fiduciary duty requirement, which requires data collection and processing firms to always act in the interests of, and not in ways detrimental to, the subjects of the data.
• Policymakers and oversight authorities should work collaboratively with relevant stakeholders, including other government and regulatory bodies, law enforcement agencies and financial services providers, to promote safe online transactions and ensure the protection of consumer data and privacy.
• Policymakers and oversight authorities should work with financial services providers to establish arrangements that enable consumers to share their financial transaction data with authorised third parties, including fintech companies. While ensuring strong privacy and data security safeguards, privacy and data security concerns should not act as barriers to such innovation, which can promote development of innovative financial management services (such as Open Banking or other financial tools) and in doing so support greater financial inclusion.
• Policymakers and oversight authorities should monitor the use of consumer data by financial services providers in developing personalised financial product and services, or a personalised choice environment. While such personalisation can support greater tailoring of financial products and services to individual needs, policymakers and oversight authorities should monitor such developments to ensure they do not result in unlawful discrimination, unfair treatment or exclusion.
• Policymakers and oversight authorities should ensure financial services providers have robust and transparent governance, accountability, risk management and control systems for the use of digital capabilities such as AI, algorithms and machine learning. This includes ensuring that the methodology of algorithms underpinning digital financial services (e.g. digital financial advice) are clear, transparent, explainable and free from unlawful and exclusionary biases, and that mechanisms for consumer recourse are available. Financial services provides should provide easy-to-understand information to enable those adversely affected by algorithms underpinning digital financial services to challenge outcomes.
• For example, the OECD Recommendation on Artificial Intelligence (2019) includes a Principle on Transparency and Explainability, which stipulates that those who play an active role in the AI system lifecycle, including organisations and individuals deploying or operating AI, should commit to transparency and responsible disclosure regarding AI systems. To this end, they should provide meaningful, context-appropriate information that is consistent with the state of art methodology to:
  • foster a general understanding of AI systems,
  • make stakeholders aware of their interactions with AI systems, including in the workplace,
  • enable those affected by an AI system to understand its outcomes, and, to enable those adversely affected by an AI system to challenge its outcome based on plain and easy-to-understand information on the factors, and the logic that served as the basis for the prediction, recommendation or decision.
• Additionally, privacy representatives, whether persons or digital mechanisms, could be introduced to assess decision-making models for fairness, bias and exclusion. This can prevent exclusion from products that use AI and machine learning to assess who is eligible and on what terms products are introduced.
• Oversight authorities should ensure they have the technological capability, resources and tools necessary to oversee and understand the digital capabilities being deployed by financial services providers. These capabilities could be developed in-house or outsourced to different public authorities within the jurisdiction that possess the necessary expertise.
• Policymakers and oversight authorities should ensure that financial services providers using automated decision-making models, such as credit scoring, take measures to mitigate against irresponsible or inappropriate outcomes, such as automatic refusals. Measures could include appropriately weighting all the relevant variables and providing human intervention, where appropriate.
• Financial services providers should consider embedding personal data protection into the design of a financial product or system at the outset (i.e. “privacy by design”). This includes use of privacy-friendly default settings, and/or collecting and storing only the minimum amount of personal data for the minimum amount of time (i.e. “data minimisation”).

The following OECD instruments are relevant:

• OECD Recommendation on Protecting Consumers from Fraudulent and Deceptive Commercial Practices across Borders (2003)
• OECD Privacy Guidelines (2013)
• OECD Consumer Policy Guidance on Mobile and Online Payments (2014)
• OECD Recommendation on Consumer Protection in E-Commerce (2016)
• OECD Recommendation on Artificial Intelligence (2019)

Jurisdictions should ensure that consumers have access to adequate complaints handling and redress mechanisms that are accessible, affordable, independent, fair, accountable, timely and efficient. Technology may be leveraged to facilitate the effective design of these mechanisms, which should not impose unreasonable cost, delays or burdens on consumers. The needs of consumers, including those experiencing vulnerability, should be considered when designing and publicising complaints handling and redress mechanisms.

In accordance with the above, financial services providers and intermediaries should have mechanisms in place for complaint handling and redress. Such mechanisms should allow providers to monitor and address systemic issues and support improved financial consumer outcomes.

Recourse to an independent redress process should be available to address complaints that are not efficiently resolved via the financial services providers’ and intermediaries’ internal dispute resolution mechanisms. At a minimum, aggregate information with respect to complaints and their resolutions should be made public. Information relating to consumer complaints should be available to oversight bodies to support their supervisory and/or enforcement functions.

• Oversight authorities should ensure that the requirements on complaints handling and redress apply consistently to all providers of financial products or services and intermediaries, irrespective of the distribution channel used.
• Consumers should be provided with clear, accessible and precise information on their right to complain and on the procedures to follow to make a complaint, including when contracting a financial product or services through digital means. This could include, for example, prominent and easy-to-follow links on a provider’s homepage, FAQs or mobile app menus, directing consumers to complaint procedures, or an external redress process.
• Complaints handling and redress mechanisms should be designed to deal with both traditional and new types of complaints, including those arising from the provision of digital financial services (e.g. account hacking, compromised account security or mistaken payments), in a manner that is fair, accountable, timely and efficient.
• Complaints should be accepted through digital means (e.g. website, e-mail, text, live-chat) and more traditional means (e.g. post, in-person, phone).
• The needs of consumers experiencing vulnerability should be considered when designing and publicising the complaints process.
• Consumers should be informed about, and have access to, an independent redress process, such as an alternative dispute resolution (ADR) service regardless of the channel used to contract a financial product or service. Furthermore, complaints to ADR services should be accepted through digital means (e.g. website, e-mail, text, live-chat)  and more traditional means (e.g. post, in-person, phone).
• Firms should collect and analyse complaints data to identify and address recurring or systemic problems and learn lessons that can facilitate improved financial products, services or processes (including for digital products and services).
• When the dispute resolution process uses digital tools or algorithms, including those underpinned by AI, firms, supervisors and ADR bodies should ensure that they are robust, transparent and produce outcomes which are objective, consistent and fair for financial consumers. Where appropriate, they should also provide the possibility of human intervention in complex or contested disputes.
• Oversight bodies should ensure they are regularly provided with, and have access to, information about complaints against financial services providers. Such information is valuable for supervisory purposes, including monitoring trends and risks in relation to digital financial services (e.g. security issues).
• To enhance transparency, digital means for complaints procedures should be used to facilitate the collection, aggregation and analysis of complaints data.
• Given the increasingly cross-border provision of financial services through digital channels, the following should be taken into consideration for effective complaints handling and redress mechanisms:
  • Consumers should be provided with clear and accessible information on the relevant jurisdiction for a cross-border financial product or service offered through digital channels.
  • Oversight bodies and ADR services across different jurisdictions should co-operate and exchange information to ensure that consumers have access to adequate, fair and efficient complaint handling and redress in relation to the cross-border provision of products or services through digital means.