Aviva Life & Pensions UK Limited

FCA action

fine

1

in fines

£1.26m

most recent

December 2007

• Fined £1.26m on 17 December 2007

  On 17 December 2007, the FSA imposed a financial penalty of £1.26m (the penalty) jointly on the following firms, together referred to as Norwich Union Life: - CGNU Life Assurance Limited (FRN 110382), - Commercial Union Life Assurance Company Limited (FRN 117651), - Norwich Union Annuity Limited (FRN 202991), - Norwich Union Life and Pensions Limited (FRN 185896) and - Norwich Union Life Services Limited (FRN 145452) The action was taken on the basis that Norwich Union Life had breached Principle 3 of the FSA's Principles for Business between 1 March 2005 and 30 November 2006 (the Relevant Period) Norwich Union Life agreed to settle at an early stage of the FSA's investigation and therefore qualified for a 30% (stage 1) discount under the FSA's executive settlement procedures. Were it not for this discount FSA would have imposed a financial penalty of £1.8 million on Norwich Union Life. In the Relevant Period, Norwich Union Life breached Principle 3 by failing to take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems. Norwich Union Life did not take reasonable care to establish and maintain effective systems and controls for countering the risks that the firm might be used to further financial crime, specifically the risks relating to the security of confidential customer information and the consequential risk of the surrender of customer policies to third parties impersonating its customers. In particular, Norwich Union Life failed to undertake an adequate assessment of the financial crime risks which it faced (in particular the risk to information security), failed to assess whether its existing controls were adequate to manage these risks, and failed to implement adequate and effective procedures to address these risks. Norwich Union Life's failures to assess these risks and to implement robust systems and controls to deal with them increased the risk that its business could be used for a purpose connected with financial crime and exposed its customers to the risk of being victims of financial crime. These failures were highlighted by a number of actual and attempted frauds committed against Norwich Union Life and its customers in mid 2006. The fraudsters used publicly available information (such as names, addresses and dates of birth) to impersonate Norwich Union Life customers and, in a series of telephone calls to Norwich Union Life's call centres, sought confidential customer information and in some cases succeeded in amending customer records such as address and bank account details. The fraudsters subsequently instructed Norwich Union Life to surrender the proceeds of customers' policies to bank accounts controlled by the fraudsters. Over 632 policies were targeted by the fraudsters and there were 74 fraudulent surrenders amounting to approximately £3.3 million in total. This loss was borne by Norwich Union Life which reinstated its customers' policies in full. In addition to its customers' funds, Norwich Union Life holds sensitive financial and personal information about its customers. Regardless of whether a policy was surrendered or not, confidential customer information regarding the policy was disclosed to the fraudsters in almost all of those 632 cases. In some cases, this included the customer's full bank account details. Where such information was disclosed, customers were exposed to an additional, ongoing and unquantifiable risk of identity theft. Norwich Union Life did not consider or assess this additional risk. Norwich Union Life also breached Principle 3 by failing to take reasonable care to ensure that it had effective systems and controls in place to enable it to respond in an appropriate and timely manner to the potential and actual risks arising from the series of actual and attempted frauds which occurred in mid 2006. As a result, the weaknesses in the caller identification procedures were allowed tomain in place for a significant period of time. Steps to prevent further release of customer information and/or funds were identified by Norwich Union Life's compliance function (Compliance) shortly after discovery of the first successful frauds, but those key steps were not implemented in a timely manner. Norwich Union Life did not give appropriate priority to the financial crime risks when considering those risks against competing priorities such as customer service. Had these steps been implemented immediately, it is likely that the majority of the breaches of customer confidentiality and the majority of the financial losses would have been prevented. The FSA considers these failings to be particularly serious because: (1) Norwich Union Life is one of the UK's largest life insurance businesses with 6.8 million customers in the UK. These customers are entitled to rely on Norwich Union Life to take reasonable care to ensure the security of customer information and funds entrusted to it. The failure to have appropriate financial crime procedures and controls had the potential to expose its customers to the risk of identity theft and financial loss. (2) Norwich Union Life was aware that fraud and identity theft were increasing problems for the financial services industry: (a) both fraud and identity theft had been identified as increasingly important by Norwich Union Life's parent organisation Aviva in 2005; (b) Norwich Union Life also received warnings from the internal compliance department that its systems and controls surrounding financial crime were not wholly adequate; and (c) the failures occurred following a period of heightened awareness of financial crime issues as a result of government initiatives, increasing media coverage and an FSA information campaign about the importance of financial crime within the financial services sector. (3) On discovering the frauds in July 2006, Norwich Union Life took specific action to identify, inform and protect all current and former directors of Norwich Union Life and the wider Aviva Group (Aviva Directors) who were policyholders. It did not take equivalent action at that time to inform and protect the policyholders who were not connected with the business. Of the 74 policies that were surrendered, nine belonged to Aviva Directors. (4) The cumulative impact of the failings represented a significant risk to the FSA objective of reducing financial crime. Norwich Union Life's failures therefore merit the imposition of a significant financial penalty. In deciding upon the level of disciplinary sanction, the FSA recognised the following measures taken by Norwich Union Life which have served to mitigate the seriousness of its failings: a) re-instating the value of any policies fraudulently surrendered; b) cooperating with other agencies, including supporting the police to assist them in identifying and arresting the criminals concerned; c) conducting an internal review to identify incidents of fraud and appointing a third party to carry out a review of Norwich Union Life's response to the fraud incidents and to review further the adequacy of caller identification procedures; and d) improving its anti-fraud procedures following that review. Norwich Union Life also co-operated fully with the FSA in the course of its investigation.

Ombudsman complaints

new complaints, January–June 2025

521

upheld, against a 31% median

32%

about pensions

308

A bigger firm gets more complaints simply because it has more customers.