There is no longer any grey area for financial services: financial institutions and insurers are covered by the National Opt-Out Registry regime. The NCC’s draft guidelines list them among the businesses that must register if they engage in direct marketing, from calls and SMSs to emails, messaging apps and other electronic communications used to promote or offer goods and services.
When the Consumer Protection Act’s new direct-marketing rules came into effect in April, it was not yet clear how far the new regime would reach into financial services.
Read: Direct marketers on notice as CPA spam rules become law
The draft guidelines now specifically include financial institutions and insurers, alongside retailers, call centres and other businesses that market directly to consumers.
The registry was the subject of a media briefing in Pretoria on 7 October, where Minister of Trade, Industry and Competition Parks Tau was joined by National Consumer Commissioner Hardin Ratshisusu and Information Regulator chairperson Advocate Pansy Tlakula.
Their presentations provided more detail on how the new system will work for businesses and consumers, and how the CPA requirements fit with POPIA.
The draft guidelines also place responsibility on the business whose products or services are being promoted, even when another company conducts the marketing on its behalf.
The clock is running
Registration for direct marketers opened on 15 September and will remain open until December. Ratshisusu said the NCC would then move into a five-month cleansing phase, running from December to April 2027. During this period, direct marketers will have an opportunity to submit their marketing lists and work through the cleansing process. The NCC will carry the cost during the initial five-month cleansing period. After that, the draft guidelines provide for a cleansing fee of 12 cents for each blocked consumer identified. The cleansed list is stated to be valid for one month in one part of the guidelines and 30 days in another.
Ratshisusu warned that a direct marketer that fails to register during the registration period may, after that period, be in contravention of section 11 of the Consumer Protection Act and the regulations.
Tau said the phased implementation would run until 15 April 2027, when the NCC would begin enforcing the operational requirements of the new regime.
“From the 15th of April 2027, the Commission will enforce the law.”
The enforcement framework allows the NCC to investigate complaints, issue compliance notices and refer matters to the National Consumer Tribunal. Administrative penalties can reach the greater of R1 million or 10% of annual turnover. The draft guidelines also provide for criminal prosecution in serious cases, with imprisonment of up to 12 months among the possible penalties.
Once registered, the real work starts.
Once the system is fully operational, a direct marketer intending to conduct marketing during a particular month must submit its consumer database for cleansing. The system will check the list against the Opt-Out Registry and identify consumers who have registered a pre-emptive block.
Those consumers must then be removed from the marketing list.
When a service call becomes marketing
The draft guidelines do not treat every communication with a consumer as direct marketing.
Service enquiries, account administration, appointments, statements, customer support and complaints are among the ordinary business communications that fall outside the registry where there is no promotional intent.
A service call can, however, become a marketing communication if the conversation turns to promoting or offering an additional product or service. The purpose and nature of the communication determine where that line falls.
The guidelines define direct marketing as communication with consumers for the purpose of promoting or offering goods or services through telephone calls, SMSs, emails, messaging applications, online platforms or other electronic communication.
For example, a call about an existing product or service remains an ordinary customer interaction. If the conversation moves into promoting an additional product or service, it becomes direct marketing.
A block overrides consent
The registry operates alongside the Protection of Personal Information Act (POPIA), rather than replacing it.
Tlakula said at the launch that consumers who have not registered a pre-emptive block remain protected by POPIA.
“POPIA must still be complied with,” she said.
Fasken notes that the Registry deals with a separate question from POPIA: whether a consumer has exercised the statutory right to block direct marketing. A lawful basis for marketing under POPIA does not remove the obligation to respect that block.
Depending on the circumstances, this may mean obtaining consent or relying on the existing-customer exception in section 69(3).
Once the block is registered, marketers can no longer simply rely on previous consent.
The NCC’s draft guidelines state that historical or existing consent becomes invalid once a consumer registers a pre-emptive block. Fresh consent does not override the block unless the consumer removes it.
As Tau explained, registering a block overrides any consent given in the past, including consent “buried in the fine print of a contract you signed years ago”.
The Information Regulator has also made it clear that POPIA continues to apply to consumers who have not registered a general block, and to communications from marketers that are not covered by a consumer’s specific block.
The two regulators have different roles when complaints arise. The NCC will deal with complaints where a consumer with a general pre-emptive block continues to receive marketing. The Information Regulator will deal with direct-marketing complaints where there is no general block, as well as cases involving a specific block against a particular marketer.
Using a third party does not change the obligation
The draft guidelines specifically deal with marketing conducted on behalf of another business.
The obligations apply where an agency, call centre or other third party conducts the marketing, and the direct marketer remains responsible for compliance.
The guidelines also extend responsibility to branches and franchises, with Tau reminding companies that use outside providers: “It is your brand that’s on the line.”
The communication itself must also be traceable. The guidelines require the business or marketer to identify itself and provide contact details, an email address and, where applicable, a physical address.
“No hidden numbers, no untraceable sources,” Tau said.
Consumers can choose where to draw the line
The registry allows consumers to make more specific choices.
A pre-emptive block can be general, but consumers can also register a block relating to a particular marketing channel, purpose, marketer or sector.
The draft guidelines require marketers to respect the scope of the block as registered. A specific block cannot be treated as either broader or narrower than the consumer intended.
For consumers, that means the registry is not necessarily an all-or-nothing decision.
At the launch, Tau said: “You can block a specific direct marketer or the entire industry.”
The registry is free to consumers. Tau described it as “a single, free, government-administered way to say no”.
Once a block has been registered, the marketer must remove the consumer from its lists. And if the calls continue, the NCC wants consumers to report them.
“If a marketer keeps contacting you, report it to the National Consumer Commission,” Tau said. “Every complaint helps us to enforce.”
A few practical problems remain
Ratshisusu said the NCC has found that some companies trade under names that differ from those registered with the Companies and Intellectual Property Commission (CIPC), which could make it harder for consumers to identify the company they want to block. The Commission is looking at a workaround and engaging with CIPC to address this.
Consumer registration itself may also take some time.
Ratshisusu said the NCC verifies consumers through their home address and has to match the relevant identity information before registration is completed. Consumers should therefore not expect registration to happen immediately.
The NCC plans consumer education initiatives around the country as the registry is rolled out.
Preparing the systems
The monthly cleansing requirement makes this an ongoing process rather than a once-off registration exercise.
A direct marketer that intends to conduct marketing during a particular month must submit the relevant consumer database to the registry. The system identifies consumers who have registered a pre-emptive block, after which those names must be removed from the marketing list.
The requirements will extend to the systems used to manage customer and prospect databases, as well as arrangements with external marketing providers.
Ratshisusu said the five-month cleansing period was intended to give businesses time to test the process and interface it with their systems.
“We want to give them an opportunity to test the systems, to interface with the system, so that when we get to enforcement, they are ready.”
ENS describes the requirement as an IT exercise as much as a legal one, pointing to the need for CRM, call-centre and other marketing systems to incorporate the cleansed lists.
Not a ban on direct marketing
Direct marketing has not been banned. The new regime is aimed at giving consumers a way to stop unwanted marketing while allowing legitimate direct marketing to continue.
“Direct marketing is a legitimate business activity,” Tau said at the launch. “We want this sector to grow, but it must grow on the basis of consent and respect.”
Businesses can still market directly to consumers, but they will have to register, cleanse their databases and respect the blocks consumers have registered.
The guidelines are still in draft form. The NCC has invited written comments within 15 days of their publication on 2 October. They are not binding on the Commission, the National Consumer Tribunal or the courts, although the guidelines state that they must be taken into account.
The final wording could still change.
