Cross-border marketing in the digital age: 3 key regulatory themes

Overview

Innovations in technology are having a huge impact in the way financial products and services are marketed and distributed. In response to this, we are noticing certain themes in regulator initiatives focused on safeguarding investor protection specifically where some part of the marketing/selling process occurs within or is linked to a digital environment. In this article, we consider the following 3 key themes that we have identified:

• the importance of having appropriate controls in place to track marketing communications conducted digitally, particularly where these are done by a third-party such as a finfluencer;
• a focus on how marketing content is presented and delivered in a digital environment to ensure that important information is not obscured and that digital features are not used in a way to potentially mislead investors; and
• robust approaches to enforcement.

Implementing controls

At aosphere, we have observed a heightened regulatory focus on the need for firms to implement controls in the digital marketing process to protect investors, particularly where digital marketing is conducted by third parties such as finfluencers and is aimed at retail investors. For example:

• In Ireland, the CBI’s proposed changes to the Consumer Protection Code in March 2024 included new requirements that where digital platforms (and any computer programmes/algorithms it uses) are used by firms to engage with consumers, such platforms must first be tested to ensure they are easy to use, understand and navigate.
• In the EU more broadly, the Commission’s May 2023 Retail Investment Package is explicitly aimed at adapting existing EU frameworks (including MiFID II, AIFMD, UCITSD and the PRIIPs Regulation) for new forms of digital marketing and distributions channels aimed at retail investors. For example, the amendments would:
  • extend firms’ responsibilities for their marketing communications to capture promotional content of third parties, including “finfluencers”, regardless of whether the third party has been paid or simply incentivised to create the content;
  • introduce new obligations applicable to “marketing practices”, which is defined broadly and includes any strategy, use of a tool or technique applied by an investment firm, or by a third party paid or incentivised by such firm, to disseminate, accelerate or improve the reach of marketing communications promoting the firm, investment services or products; and
  • mean an influencer’s online video promoting a firm could be considered a marketing communication, for which the firm will be responsible (for example, to ensure such communication is clearly identifiable as such and clearly identifies the firm as responsible for its content and distribution).

These changes would require firms to introduce more controls around their relationships with third party marketers and distributors. The ECON Committee’s draft October 2023 report also contained provisions which would specifically require firms to establish a written agreement with the finfluencer determining the nature and scope of the activity to be carried out on behalf of the firm. The Parliament’s February 2024 report goes even further in requiring firms to provide competent authorities with the details of their finfluencers on request and extending competent authorities’ new obligations to prevent unauthorised activities (see discussion of developments in enforcement powers below) to cover finfluencers promoting a firm’s services/products via social media.

• Early in 2023 ESMA announced that it would be conducting a common supervisory action with national competent authorities over the course of the year on the application of MiFID II disclosure rules with regards to marketing communications, including consideration of investment firms’ and credit institutions’ online marketing practices and collaborations with affiliates such as influencers.
• The UK’s FCA published final guidance on financial promotions made via social media in March 2024, which included considerations relating to the use of finfluencers and also social media platforms. The UK’s financial promotions regime is applicable to all communications capable of having an effect in the UK, and the guidance includes examples of the sorts of steps that non‑UK firms might take with a view to complying, including implementing proper systems and controls to prevent UK consumers from engaging in investment activity to which a communication relates.
• In Singapore, in April 2023 MAS published a consultation proposing requirements that financial institutions (including foreign firms that are ‘exempt financial institutions’) introduce additional controls when engaging in digital prospecting and marketing activities. These include requirements to assess the limitations of digital media and address risks (e.g. through prominent disclaimers and guidance/training to representatives/third-party service providers) and monitor such activities.

Presentation and delivery of marketing content

We have also seen regulators focus on the presentation and delivery of marketing content, including firms’ use of digital techniques to manipulate consumers (sometimes referred to as “dark patterns”). For example:

• Ireland’s CBI’s proposed changes to the Consumer Protection Code include a new standard for business to ensure that a firm’s products and services are not designed to unfairly exploit the behaviours, habits, preferences or biases of customers leading to customer detriment. While this standard applies generally, the consultation makes specific reference to its application in the context of digital services and delivery channels. Also, where a firm engages with a consumer via a digital platform to provide financial services, the proposal includes requirements to provide clear and effective step-by-step guidance on how to use and navigate the platform, display a prominent warning before providing a financial service and avoid providing the consumer with pre-selected options indicating that the consumer has read/understood information provided.
• In the EU, ESMA’s December 2023 discussion paper on the digitalisation of retail investment services set out draft recommendations on online disclosures and digital marketing practices. The recommendations mainly focus on the way information is presented to retail investors and include, for example:
  • taking care in relation to any layering of information - use of this technique should not obscure important information, and links to deeper layers should clearly indicate what information will be accessed;
  • firms should not be allowed to use social features of investment apps and gamification techniques that encourage investors to trade more in the case of risky products; and
  • firms should use the structure, design, function or manner of operation of their online interface in a way that encourages investors to make informed and sensible investment decisions and avoid dark patterns.
• In India, Guidelines for Prevention and Regulation of Dark Patterns came into force in November 2023 prohibiting the use of certain dark pattern practices. These guidelines apply to platforms (i.e. online interfaces such as a website or mobile app), including foreign platforms, systematically offering goods or services to individual consumers in India, as well as other advertisers and service providers. The prohibited dark pattern practices include techniques such as “interface interference”, which is a design element that manipulates the user interface for example to obscure information relative to other information and misdirect a user from taking an action as desired, as well as “disguised advertisements”, which involves masking advertisements as other types of content such as new articles to blend in with the rest of an interface to trick customers into clicking on them.

Developments in enforcement powers/obligations

The increasing provision of investment services via digital means and additional risks this gives rise to for investors has also led to developments in relation to regulators’ enforcement powers and obligations. For example:

• In the EU, new supervisory powers for Member States are proposed under the retail investment package where an unauthorised person provides (or is suspected of providing) investment services/activities online targeting clients within its territory, including enabling regulators to:
  • carry out mystery shopping activities;
  • suspend or prohibit, for up to 1 year, marketing communications or practices by an investment firm in the Member State; and
  • take all necessary measures, such as to remove content, restrict access to online interfaces and impose the use of risk warnings by investment firms in materials in certain circumstances, including by requesting a third party or other public authority to implement such measures.

The proposals also include changes to enhance supervisory cooperation and make it easier for competent authorities and European supervisory authorities to ensure rules are properly and effectively applied on a cross-border basis and to jointly fight fraud and malpractices.

• In relation to regulator’s enforcement activities, IOSCO’s December 2023 statement warning retail investors of “online harm” includes a call to action to regulators to respond vigorously to online harm, including by:
  • use of innovative prevention and enforcement activities to rapidly and decisively curb online misconduct, such as public warnings, promptly blocking access to fraudulent websites and working with other authorities such as criminal law enforcement;
  • adopting a bold and robust approach to assisting regulators of other IOSCO member jurisdictions proactively and in response to specific requests e.g. for assistance in securities and derivatives investigations; and
  • deploying sufficient resources, including funding, staff and technology, to undertake effective enforcement and cross-border cooperation programmes to protect investors from this rapidly expanding danger and to minimize consequent impact.

The EU’s retail investment package is already an example of proposed enhancements to enforcement powers that specifically envisage regulators working with third parties (e.g. public authorities) to take action against unauthorised investment activities targeting clients online. It will be interesting to see the extent to which other regulators react to IOSCO’s call to action and adopt any of the proposed measures.

Final thoughts - the benefits of online marketing/selling

While much of the regulatory focus has been on reducing the risks of online marketing/selling, we also wanted to note that many of the developments serve a dual purpose of ensuring that investors can enjoy the benefits. For example, the EC’s Retail Investment Package also includes proposed amendments to the PRIIPs Regulation that would give firms more flexibility to display information from the PRIIPs KID in a digital and user-friendly way. Firms would be required to provide the PRIIPs KID in an electronic format (unless a paper copy is requested) and this includes by means of an interactive tool and in a layered format. These changes are aimed at increasing the accessibility of information about investment products and empowering retail investors to make informed investment choices.