Proposed Amendments to the Requirements on Promotions of Financial Products and Services

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 1 of 19 General Comments: Comments REF CBB Response A bank inquired: Is there any CBB pre-approval requirements prior launching such promotions and advertisements? GR1 No pre-approval required.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 2 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response BC-1.1.2 Conventional retail bank licensees must ensure that all the following requirements are met with regards to promotion of products or services: (a) They do not involve a breach of Bahrain law or any other relevant applicable law or regulation; (b) All documentation concerning promotions is in Arabic and English and, if relevant, any other language necessary for customers to fully understand and appreciate the products or services; (c) Customers to whom promotions are directed must enjoy equal opportunity in terms of access to, and treatment within, such schemes; (d) The communication concerning promotions must be clear, concise, truthful, unambiguous and complete to enable customers to make a fully informed decision; and (e) Where the promotion involves communication of earnings potential or benefits associated with the products or services promoted, all costs, charges or levies and risks are also disclosed. A bank inquired: is there any definite law or / and regulation we need to follow / comply? SP1 Licensees must follow Commercial Companies Law, CBB Law, CBB Rulebook. A bank stated that banks sometimes announce loyalty draws for select customers (example debit or credit card usage locally and overseas), with more chances for overseas transactions. The raffle terms and conditions usually states such treatment in advance. Going forward, trust this methodology would be evaluated to be in compliance with the clause wordings "must enjoy equal opportunity". SP2 Noted. The Terms and Conditions must disclose this element as appropriate. A bank recommends removing the word “all” from point (b) and keep it open based on the target audience of the promotional material. Due to the very international profile of customers served by the bank, we would prefer to keep Marketing communications in English and have Arabic as optional based on the nature of the promotion. SP3 The rule will be amended as follows: All documentation concerning promotions is in Arabic and English and, if relevant, any other a language necessary for customers to fully understand and appreciate the products or services;

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 3 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response BC-1.1.3 Licensees using character-limited media (e.g. social media platforms such as Instagram, Facebook etc.) as a means of promoting complex features of financial products or services should provide a reference or link to more comprehensive information available elsewhere. A bank inquired: is this requirement applicable to Short Message Services (SMS) messages, which is also character limited in nature? SP4 This Paragraph applies to the use of social media platforms and is not related to SMS. A bank stated that clarity is requested with respect to using Links, in light of OM-5.5.21 which prohibits the use of URLs in SMS. SP5 Please see SP4 above. BC-1.1.4 Conventional retail bank licensees must ensure that the following requirements are met with regards to raffles/lotteries: (a) Adequate systems and documented procedures are in place that describe the checks and balances to ensure fair play, impartiality and the inclusion of eligible participants as well as for informing participants of the results of a raffle/lottery within 5 business days of the draw; (b) They are subject to the rules and requirements (including prior authorisation/approval) laid down by the Ministry of Industry, Commerce and Tourism; (c) The raffle draws schedule is disclosed in advance to the public. Raffle dates must not be postponed unless a valid reason is stated/indicated; (d) The winner(s) report includes the winner's name, CPR number, mobile number and the number of chances (e.g. tickets/ certificates) in the A bank inquired with regards to point (a): are licensees required to inform individual winners, or to inform participants in general? SP6 Individual winners must be notified by the licensee in addition to publicly announcing the winners. A bank stated with regards to point (a) that the external auditor and internal auditor provide their clearance before management can arrange for the announcement of the raffle results. In some cases, it takes more than 5 business days until management obtains final clearance from external auditors. Therefore, we recommend that the announcement period is extended to 7 business days. SP7 The rule will be amended but the specified days will be removed. A Bank stated that for (b) kindly allow sufficient development time before mandating the same. SP8 Disagree, point (b) refer to complying with the rules and requirements laid down by the MOICT which were issued since a long time.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 4 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response draw; (e) Each draw of the raffle/lottery held as part of the bank’s promotional scheme is independently verified and monitored/witnessed by the bank’s external auditor and the internal auditor. The electronic system must be subject to external IT audit; (f) An annual check and a comprehensive audit on the “raffle draw” system is conducted by the external technical auditor. In addition, a detailed report in this regard from such auditor must be submitted to the CBB and a copy is sent to the consumer protection department in the Ministry of Industry, Commerce and Tourism; and (g) The internal auditor periodically reviews, at least annually, all promotions, raffles/lotteries in addition to the systems, procedures, processes and related operational risks. A bank stated that there is an annual comprehensive audit requirement in BC 1.1.4 (f), the requirement under sub-section (e) for the electronic system to be subject to external IT audit, may be removed, as it duplicates the requirement, noted in BC 1.1.4 (f). SP9 The second sentence of (e) will be deleted. (f) Will be amended to read as follows: (f) An annual check and a comprehensive audit on the “raffle draw” system is conducted by the external technical IT auditor. In addition, a detailed report in this regard from such auditor must be submitted to the CBB and a copy is sent to the consumer protection department in the Ministry of Industry, Commerce and Tourism; and A bank stated that Internal Audit adopts a Risk Based Audit planning approach, which is continuously assessed based on various Risk factors, including Operational, Regulatory and Reputation Risks, coupled with probability and impact assessments. Accordingly, we recommend that the requirement be amended to advise that Internal Auditor should periodically review, adopting a risk-based approach, instead of SP10 Disagree, this is to ensure the integrity of the raffle draw system, which is highly sensitive from a customer’s perspective.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 5 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response making it a mandatory annual audit requirement. A bank recommends with regards to point (f) to allow raffle dates to be postponed with prior notice. SP11 Raffle dates must not be postponed unless a valid reason is stated/indicated. A bank stated with regards to (f) the current practice being followed today is that any change in the system is audited at the time of implementing the change. The system may not be updated or changed every year and as a result, we recommend that an annual simple check by the external auditor indicating that no changes were made to the system to be applied, where if any changes to the system were done then the ad hoc external audit exercise would have been conducted earlier. SP12 The annual external audit exercise is needed to ensure that the controls are operating as intended and that the system has not been tampered with during the course of the year and cannot be tampered with prior to the draw. A bank stated with regards to point (g) that in light with 1.1.4(f) above and the internal controls applied where the draw equipment’s (hardware and software) are maintained in a safe under dual custody and are released at the time of the draw in the presence of internal and external auditors, we believe that there is no need to perform audits on the systems on an annual basis as this shall be SP13 See SP10 and SP12.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 6 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response subject to the risk assessment. Also, reliance can be placed on the external auditor work as explained in BC-1.1.4 (f), other control procedures are reviewed quarterly at each draw. A bank stated that with regards to point (c) clarification is required on whether this means that the entire schedule, for example for a year, needs to be announced in advance or to be done by each raffle. We suggest that this is reworded to “the raffle draw date of the announced prize/incentive/campaign is disclosed in advance to the public and that other subsequent announced prizes/incentives/campaigns follow the same approach”. This is because the bank and other banks as well may not announce all their prizes/plans of the year in advance and rather announce each prize with its draw date with each campaign as it is announced to the public. also, it is suggested to include a timeframe for uniformity in the announcement i.e. example - at least 90 days before the cutoff date. SP14 According to the MOICT the application to announce a raffle must be made 2 weeks prior to the promotional campaign. (c) will be amended as suggested.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 7 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response with regards to point (e):

1. Suggestion to clarify that web (virtual) meeting attendance is fine for all participants
2. Clarification is required on whether the “external IT audit of electronic system” can be performed by other consultants or only by external auditor.
3. Trust the sub clauses (e) and (f) make the same reference i.e. it is the same audit requirement though repeated in two different sub-clauses.
4. Reconfirmation on the continuation of the existing protocol of Ministry – MIOC representative supervision is required.
5. This sub clause requires an external auditor to attend the draw with the Bank’s internal auditor. We suggest that this is changed to that the external auditor witnessing the draw is only needed if the Ministry of Industry, Commerce and Tourism representative is not attending/witnessing the draw. Please note that all draws are attended by the Ministry of Industry, Commerce and Tourism representative and internal audit
6. Attendance should be physical.
7. It should be the external IT auditor.
8. See SP9.
9. Yes, still required.
10. External auditor must be present.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 8 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response as well as internal control, and hence we feel that there is no need for the external auditor to also witness the draws. 6. With regards to point (f) suggestion for this activity be a one-time activity check on the raffle system of the Bank and to be done on the system and not the actual draws. 7. With regards to point (g): while Internal Audit’s periodic review requirement is noted, clarification is required on whether the regulatory expectation of review of “systems” here also means technical audit of electronic system as per sub-clause (e) and the Internal Audit sub-clause (g). 8. There are small raffles that take place through our social media platforms with small prizes i.e. cash/mobile. Clarification is required if these raffles would be governed by clause BC-1.1.5 and BC 1.1.6. Otherwise clarity is sought if Internal Audit is expected to witness & 6. The requirement is for checking the raffle draw system itself. 7. See SP9 8. BC-1.1.5 applies.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 9 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response include these raffles in annual audit review as well. A bank suggested with regards to point (g) to have a coverage over promotions and raffles /lotteries on a risk-based approach rather than annual cycle given the volume and materiality/value of promotions and raffles /lotteries. To elaborate, it may be advisable to conduct such a review at least once every 3 years and more frequently, if the volume and value of promotions and raffles and lotteries increases. This will be determined as part of the annual risk assessment exercise to develop an audit plan. SP15 See SP10. A bank had the following inquiries:

1. With regards to point (e) Does it has to both external auditor and internal auditor? what is the difference between both scopes?
2. With regards to points (e) & (f) external IT auditor and the external technical auditor, what is the SP16 1. Yes, the internal auditor should exercise care in making sure the draw is conducted in accordance with the established procedures which have been subject to checks for integrity. The external auditor will observe adherence to procedures including involvement of internal auditor.
3. See SP9. No need for CBB approval.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 10 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response difference? Do we need CBB approval prior engaging with the external auditor on such? 3. With regards to point (f) when is the annual deadline for submitting the report? 3. Within 3 months from year-end. BC-1.1.5 The requirements of Paragraph BC-1.1.4 do not apply to promotions or giveaways generally offered and selected through draws to customers on an ad hoc basis (at no cost to the customer, implicit or otherwise). In such cases, there is no direct link between the acquisition of the products or services by the customers and the periodic raffle draw/lotteries. A licensee requested to explain more about those type of promotions that are excluded from the BC-1.1.4 requirements? What do you mean by no direct link between the acquisition of the product and the periodic raffle? SP17 These are ad hoc promotions that are offered to the customer being a customer of the bank. It is not linked to any specific product such as a savings certificate or any other product. A bank stated that clarification is required on whether social media contests such as "Mention and win" is not covered under BC￾1.1.4. SP18 It is not covered under BC-1.1.4 BC-1.1.6 Licensees may use small ‘gifts’ as an inducement to members of the public to use banks' services, provided such gifts are offered on a general basis and have a monetary value not exceeding BD 100. A bank suggested that the monetary value to be increased to BD 500. SP19 The rule will be deleted. A bank stated that our understanding is that the monetary value of the gifts as an inducement is per person and not a collective amount for a specific promotional campaign. Moreover, we understand these apply to cash SP20 Please see SP19 above

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 11 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response and cash vouchers. We propose that credit card cash back schemes used for client acquisition or spend campaigns are excluded. This may please be considered in the subsequent regulation. A bank suggested to raise the ceiling of small 'gifts' to at least BD500 as a giveaway such as a phone, tablet, etc. for example would cost more than BD 100.

• Clarification is required on whether the gifts referenced here fall under the exclusion referenced in BC-1.1.5. SP21 Please see SP19 above BC-1.2.1 Conventional retail bank licensees must obtain the customer’s consent whether in writing or electronically for sending promotional or advertisement material through e-mail, short messages (SMS), WhatsApp or other communication means. A bank recommends waiving this requirement for existing customers. SP22 The rule will be amended, to allow (opt￾out). A bank stated that the bank currently obtains confirmation through the client declaration, at the time of signing the application form. We trust this will suffice the requirement. It is recommended to please provide additional guidance in this regard. SP23 Please see SP22 A bank stated that marketing is a critical segment in terms of customer lifecycle and relationship building mechanism, where there are mutual benefits in terms of customer awareness of the Bank’s products SP24 Please see SP22

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 12 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response and services. In addition, banks have invested in systems with intelligence data￾and technology driven marketing tools that would allow us to better communicate with our customers with regards to their specific product or service needs, which is aimed towards delivering superior experience. As a global practice, after many discussions in customer forums, financial institutions have noted ‘customer opt-out’ to be the most effective, beneficial & practical approach for ensuring that customers receive communication that is relevant for them. Currently, the bank uses and Opt-out option, and we would like to continue this way. We therefore suggest that the customer consent may be acceptable through “opt-out option”. A bank stated the following:

1. This clause is proposing for an "opt in" approach, which is more-strict than the current requirement of PDPL. CBB is kindly requested to reconsider this proposed approach and to replace it with an "opt out" approach. This is in line with PDPL, under which we are only obliged to: (a) provide means for customers to opt out of receiving marketing messages; and (b) inform the SP25 1. See SP22.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 13 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response customer during his account opening process of his/her right to object to direct marketing. Hence, we highly recommend that the referenced Rule is rephrased as “Conventional retail bank licensees must allow a means for customers to opt out from receiving promotional or advertisement material through email, SMS, Whatsapp or other communication means should such customers want to Opt out. The Opt out can be in writing or electronically”. In this respect, reference is made to "Article 17 - Information to be provided to the data subject" and "Article 20 - Right to object to direct marketing purposes" of PDPL. This method is also being used by the current best practices mentioned in e-privacy laws (in particular; Privacy and Electronic Communications Regulations (PECR)). Otherwise, The implementation for the current existing customers to be clarified and the consequences of not obtaining the consent to be defined. 2. The requirement should clearly state if it applies to individual customers, corporate customers, or both. 2. Both.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 14 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response BC-1.2.2 The CBB may, at its discretion, require the licensee to withdraw the advertisement or any material thereof, if it believes that the advertisement is not compliant with the requirements of this Module or that it has a negative impact on the financial sector or on the society. A bank had also stated that this Paragraph is very vague and may attribute to subjective and debatable matters. There should be clear definition to make suspension/adv. material withdrawal to be limited to non-compliance to the said rules. SP26 The CBB will withdraw advertisement if it believes that the advertisement is not compliant with the requirements of this Module or that it has a negative impact on the financial sector or on the society. BC-1.2.3 Conventional retail bank licensees must ensure that advertisements: a) Are clear, fair, accurate and not misleading; b) Are simple to understand and presented in a way that is likely to be understood by the average person to whom it is directed;   c) Clearly state what the letters stand for if acronyms are used (for e.g. APR); d) Font size must be 12 or bigger, including footnotes; e) Terms and conditions are easily accessible by customers; f) Any concessionary offer/promotion in an advertisement contains the validity period of such offer/promotion; g) Clearly present any comparison or contrast (if any) in a fair and balanced way. Such comparison or contrast must be meaningful and presented in A bank inquired: with regards to point (d) Does the term "Advertisements" here include all forms of advertisements? including social media for example? as a font 12 may be too large for certain mediums. With regards to point (K) it mentions that links for more details of the draws/advertisements should be used. However, this contradicts with the CBB cyber security clause OM- 5.5.21 which mentions that URLs must not be used in SMS. Clarity is hence requested especially with regards when SMS is used to advertise for such campaigns/ads/draws. SP27 Font size must be clear and readable for all advertisements. (d) will be amended to reflect the same. A bank in the case of social media advertising, a font 12 is too large. Hence CBB's reconsideration is requested. SP28 See SP27.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 15 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response general terms, i.e. banks must avoid making direct comparisons of their products with those of their competitors; h) Are publicly announced by the licensee only; i) Clearly state the name of the bank, bank logo, and contact details; j) The name of the product and its details are clear to the customers; k) Include a proper link to the terms and conditions including fees and charges; l) Include a statement that the bank is licensed by CBB as a conventional retail bank licensee; and m) Do not make use of the name of CBB in any advertisement in such a way that would indicate endorsement or approval of its products or services. A bank stated with regards to Point (d): Some creatives, especially web banners etc., are already small canvases to work with and will prove difficult to implement font size 12 or bigger for footnotes etc. our guidelines state that footers etc. are no smaller than font size 9 - that would be our recommendation. SP29 See SP27. A bank stated that regarding the font size for footnotes, this might not be possible for Social media advertisements/comms due to the size of the artwork and the space we are limited to. This requirement should not include posts on Social media, however, the bank will make sure to use a readable and clear text size. SP30 See SP27. A bank inquired with regards to (h): does this requirement include third party endorsements and/or influencer marketing? SP31 Yes. A bank stated that with regards to point (f) the bank believes that the validity period of promotions should only be disclosed in social media posts as it may not be practical to update or change physical printouts or billboards if the validity period of a promotion is to be extended. SP32 Billboards must also disclose the validity period of the promotion. If the period is extended, the bank must be responsible for any changes to be made to the billboard.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 16 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response A bank stated that some advertisements are done jointly by the bank and its alliance partners. For all advertisements, the bank ensures proper branding guidelines are followed and the licensing status is properly disclosed in all promotional material. Our view is that the advertisements done jointly with alliance partners are exempted from this requirement. With regards to point k) the bank’s understanding is that the requirement does not apply to SMS messages and suggested that if this can be considered and made part of the final regulation. SP33 • Disagree, advertisements done jointly with alliance partners are not exempted from these requirements. • See SP4. A bank stated with regards to points “I” and “l”, would like to inform the CBB that marketing channels like Instagram/Facebook posts, e-mail and web pages will capture the name of the bank, bank logo, and contact details and will also capture a statement that the bank is licensed by CBB as a conventional retail bank licensee however the bank recommends to exclude SMS and Google Search channels due to the following reasons: SP34 Agree

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 17 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response

• Both channels do not allow banks to use graphic elements like logotype
• Both channels allow users to use only a limited number of characters e.g. Google Search ads headlines allow only up to 30 characters and descriptions up to 90 characters. Adding additional content, other than marketing message, will not allow banks to use this channel. With regards to point ’k’ we would like to inform the CBB that marketing channels like Instagram/Facebook posts, e-mail and web pages will capture a proper link to the T&C and SOC, however the bank recommends excluding SMS and Google Search channels due to the following reasons:
• In line with new Section OM-5.5 - Cyber Security Risk Management, banks are not allowed to send any links via SMS,
• Google Search ads headlines allow only up to 30 characters and descriptions up to 90 characters. Adding additional content, other than marketing message, will not allow banks to use this channel. See SP4.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 18 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response BC-1.2.4 Conventional retail bank licensees must ensure that advertisements do not: a) Include the expression ‘interest free’ or any similar expression when there is implicit interest embedded in the product or service; b) Include the descriptions of product or service as ‘free’ or ‘with no cost’ or any similar expression if any type of fee would be imposed; c) Include the descriptions of feature of a product or service as ‘guaranteed’ or ‘secured’ or use a similar expression unless the bank communicates all the necessary information, and present that information with sufficient clarity and prominence to make the use of that term fair, clear and not misleading; d) Contain any statement such as “the best in”, “the most competitive”, “the best rate in”, “the first in”, ‘the highest’ or ‘the lowest’ or ‘the best’ in the market unless it is fully supported by evidential documents; e) Emphasise any potential benefits of a product or service without also giving a fair and prominent indication of any relevant risks; and f) Disguise, omit, diminish or obscure important information, statements or warnings. A bank stated that for a) and b) it would be best to get an illustration from CBB to better understand the intention of these two rules. For illustration, if we promote a profit free loan but it has a late payment charge, will that be considered breach of this rule? In BC-1.2.4 (d What is the definition of evidential document? SP35 a) and b) Yes because that entails that there is an embedded charge that is not stated clearly in the advertisement/promotion. d) evidential documents that prove (back-up) the statement used in the advertisement/promotion. BC-1.2.5 Conventional retail bank licensees must A bank would recommend adding "with the exception of Google Search channel". SP36 See SP34.

Consultation: Proposed Draft Advertisement Rules Industry Comments and Feedback November 2021 Page 19 of 19 Specific Comments: Reference to the draft Directive: Comments REF CBB Response ensure that each digital advertisement through the internet/social media (e.g. Twitter, Instagram, WhatsApp, Facebook, web page, etc.) complies with the requirements in this Section. Google Search ads allow only a very limited number of characters e.g. headlines allow only up to 30 characters and descriptions up to 90 characters. Adding additional content, other than marketing message, will not allow banks to use the channel. This channel also does not allow to use any graphic elements like logotypes. BC-1.2.6 Where a licensee publishes customer feedback/review on the internet/social media, it must display both positive and negative feedback/review. A bank suggested that licensees should be allowed to delete offensive, personal or irrelevant customer comments. SP37 All comments must be displayed with no deletion. A bank suggests that this is reworded to “fair reviews/feedback”. SP38 See SP37. A bank stated that both positive and negative are kept displayed across our comments sections and are addressed with replies. No comments are hidden unless it contains vulgar language, hazard messages or harmful statements. SP39 Noted