<<Back

NU rapped by the FSA to the tune of £1.3 million

Norwich Union Life has been fine £1.26 million by the Financial Services Authority for failing to protect customer's confidential details against fraudulent activities.

The fine was reduced from £1.8m when Norwich Union Life agreed to settle at an early stage of the FSA's investigation.

A 13-page document outlines the failing that led to 632 policies being fraudulently surrendered to the tune of £3.3m.

NUL were found in breach of Principle 3 of the FSA's Principles for Businesses by "failing to take reasonable care to ensure that it had effective systems and controls in place to enable it to respond in an appropriate and timely manner to potential and actual risks" particularly when weaknesses in the caller identification process were identified, but were allowed to remain in place "for a significant period of time." The company's compliance function had identified additional steps to reduce the release of customer data or funds shortly after the first successful frauds were unearthed, but "those steps were not implemented in a timely manner."

In addition it "failed to undertake an adequate assessment of the financial crime risks which it faced (in particular the risk to information security), failed to assess whether its existing controls were adequate to manage these risks, and failed to implement adequate and effective procedures to address these risks."

Fraudsters were given access to confidential, personal and financial details by simply contacting the company's call centres and using publicly available information to impersonate customers. In some cases fraudsters were able to amend existing data including bank details and instruct Norwich Union Life to surrender the proceeds of customer's policies.

One of the FSA's main criticisms of Norwich Union Life was the conduct of the company following the discovery of the frauds in July 2006, where company employees and current and former directors that were directly affected were informed and protected, but the other policyholders were not informed. Of the 74 policies surrendered, nine belonged to Directors of NUL's parent company, Aviva.

Talking about the fine, FSA Director of Enforcement, Margaret Cole said:

"Norwich Union Life let down its customers by not taking reasonable steps to keep their personal and financial information safe and secure.

"It is vital that firms have robust systems and controls in place to make sure that customers' details do not fall into the wrong hands. Firms must also frequently review their controls to tackle the growing threat of identity theft.

"This fine is a clear message that the FSA takes information security seriously and requires that firms do so too."

The full text of the Final Notice is available here: http://www.fsa.gov.uk/pubs/final/Norwich_Union_Life.pdf