ASIC v AMEX: Court orders first penalty of $8m following contraventions of design and distribution obligations

What you need to know

• On 19 July 2024, the Federal Court handed down the reasons for its first monetary penalty ordered under the design and distribution obligations (DDO) regime in ASIC v American Express Australia Limited [2024] FCA 784 
• The decision follows admissions of contravention by American Express for the period between May 2022 and July 2022  and the parties filing a Statement of Agreed Facts and Admissions
• The Court found that there were contraventions of section 994C(4) of the Corporations Act by failing to review the target market determination (TMD) made for its co-branded David Jones credit cards in circumstances where it ought reasonably to have known that cancelled application rates for those cards were a circumstance that would reasonably suggest that the TMD was no longer appropriate
• The Court ordered a pecuniary penalty of $8,000,000 in respect of American Express’s conduct (and an agreed sum of ASIC's costs of $200,000).
• The judgment provides guidance on the obligation in the DDO regime to review TMDs where issuers ought reasonably to know that circumstances have arisen which require TMD review
• In particular, the court has emphasised that an organisation that makes a TMD must review a TMD under section 994C(4) if, objectively speaking, the organisation knows or ought reasonably to know of a circumstance which has occurred that would reasonably suggest that the TMD is no longer appropriate – ie, constructive knowledge is sufficient to give rise to the obligation to review the TMD. 
• By contrast, the court confirmed that the organisation's obligation to inform distributors to cease retail distribution conduct once it knows that a review trigger has occurred, arises where there is actual knowledge that the review trigger has occurred. 
• The court explained that this was consistent with the DDO regime's general consumer protection aims being reflected in a cascading range of remedial responses

What you need to do

• Where the DDO regime applies, you should have in place robust monitoring and surveillance processes, policies and controls to quickly identify any circumstances  which may reasonably suggest that your TMDs are no longer appropriate (in addition to specific "review triggers" specified in the TMD)
• In respect of an obligation to review the TMD, it will be no defence to civil liability say that you were aware of a relevant circumstance arising but were unaware that it would reasonably suggest that the TMD is no longer appropriate – that argument was rejected and it is clear that knowledge of the circumstance affecting the appropriateness of the TMD is judged objectively.
• It is therefore important to maintain and operate processes, policies and controls which are able to both identify all circumstances arising from retail product distribution conduct which may trigger section 994C, and identify how such circumstances could affect the appropriateness of the TMD.
• This will require those involved in drafting TMDs and monitoring the distribution of products under the TMDs to understand the types of circumstances which might arise and the particular meaning of "appropriate" in section 994B(8).
• It is critical that taking these steps is conducted across your organisation and that the need to identify and act upon circumstances such as this are effectively communicated to all relevant staff and there is training and oversight to reinforce them.

Design and Distribution Obligations regime

The DDO regime requires issuers of financial products to consider and define target markets for their financial products; and distributors of the financial products to take reasonable steps to ensure that the products are distributed in a targeted manner consistent with the TMD. 

ASIC has undertaken a number of investigations and taken enforcement action since the introduction of the regime, including civil penalty proceedings for alleged breaches of DDO. Following the Federal Court's decision in ASIC v Firstmac (see our update here – ASIC v Firstmac Limited: Court makes first finding of contravention of design and distribution obligations), ASIC v AMEX is the first case quantifying a pecuniary penalty for breach.

Background 

American Express had since February 2008 issued a number of co-branded credit cards under an agreement with David Jones (DJ Cards). 

Customers were able to apply for DJ Cards either in-store or online, with in-store applications being responsible for 80-90% of new applications. An in-store application was completed by the customer filling out a digital tablet-based application. 

American Express and David Jones tracked the number of applications received and the number of DJ Cards approved, issued and activated. Further, David Jones allocated each David Jones store a target in respect of the applications and activations, of which American Express was aware.

American Express and David Jones had a “David Jones Alliance” team. Broadly speaking, American Express was primarily responsible for developing the strategy to drive acquisition of the Cards, including monitoring cancelled application rates and coming up with strategies to reduce those rates. American Express also had a "Product Manager" responsible for managing the product portfolio, which included addressing customer retention and cancellation of the DJs Cards. The Product Manager was separate from, and reported to, the Director of the David Jones Alliance.

The TMDs

As the DJ Cards were "financial products" subject to the DDO regime, American Express made a TMD for each of the DJ Cards which were offered at the commencement of the regime. 

The "review triggers" which would require review of the TMD included in both TMDs:

• material change to the key product features, attributes, eligibility and/or terms and conditions;
• material changes to fees or interest rates;
• high default rates, high hardship rates or evidence of unmitigated risks to vulnerable customers;
• material or unexpectedly high number of complaints about the product or distribution of the product; and
• the use of Product Intervention Powers, regulatory orders or directions that affect the product.

In the case of the DJ Amex Card, the review triggers also included " abnormal cancellation rates".

Monitoring cancellation rates

There were a number of working groups or forums within American Express that considered cancelled application rates, including a "Cancellations Working Group". Reducing the number of cancellations associated with instore Card applications was one of American Express’ highest priority initiatives in the David Jones Alliance.

American Express was aware of the following reasons for high cancelled application rates:

1. Customers were offered a discount at the point of sale when applying for a DJ Card, ranging from 10-30%. The discount only applied instore if the customer was instantly or conditionally approved. American Express was aware that point-of-sale discounts resulted in increased cancellations of DJs Card applications; and
2. By October 2021, American Express was aware that some customers did not understand that they were applying for a credit card with an annual fee and instead understood they were applying for a loyalty card. This issue was identified in training material provided to David Jones’ staff in October 2021, the content of which had been approved by American Express.

Although DJ Cards "product owners" had the DDO regime explained to them in sessions, the relevant procedure did not provide any guidance on how to determine if and when a review trigger had occurred, or an event or circumstance had occurred that would reasonably suggest that the TMDs for the Cards were no longer appropriate. Further, no specific metrics were given to provide guidance on the meeting of "abnormal cancellation rates", instead "American Express relied on the experienced and professional judgment of key staff involved in the David Jones Alliance to identify if and when a review trigger or a relevant event or circumstance had occurred". However, the "product managers" for the DJ Cards did not attend the meetings of the Cancellations Working Group, despite that group being the primary forum in which the David Jones Alliance would consider and monitor cancelled application rates for the purpose of the DDO regime.

Between October 2020 and October 2021, American Express was aware of high cancelled application rates for DJ Cards, including for the reasons set out above. On 26 August 2021, the Cancellations Working Group was informed that the average cancellation rate in 2020 was 52%.

From December 2021 to March 2022, American Express took steps to monitor and reduce in-store cancellations by engaging with David Jones to seek to understand the reasons for the high cancelled application rates and identifying the key drivers of cancellations and implementing action plans to address those. However, the rates of cancelled applications did not reduce, and instead increased – by 11 May 2022, the headline monthly rates of cancellations was 60%. In short, the high rates of cancelled applications had become entrenched and the actions taken by American Express and David Jones to address these rates were not working.

Admitted Contraventions and the construction of section 994C

American Express admitted that by May 2022 it knew that a relevant circumstance had occurred in respect of each of the DJ Cards. However, it was an agreed fact that American Express did not have actual knowledge that the circumstance reasonably suggested that the TMDs were no longer appropriate.

American Express admitted that between 25 May 2022 and 5 July 2022 (a period of 41 days) it contravened:

• Section 994C(4) by failing to cease issuing each of the DJ Cards; and
• Section 994C(5) by failing to take all reasonable steps to ensure that David Jones was informed that it must not continue distributing each of the DJ Cards

when it knew a circumstance had occurred and as a matter of objective fact, but not to American Express’ actual knowledge, that circumstance reasonably suggested that the TMDs were no longer appropriate.

The Court (Jackman J) was not prepared to declare contraventions on the basis of those admissions and rejected the parties' construction of subsections 994C(4)(c) and (5)(c) upon which the admissions relied. The Court ultimately held that American Express contravened section 994C(4) (but on a different basis to the parties' submissions) and did not make any findings of contravention of section 994C(5) at all.

The parties had jointly submitted that the knowledge requirement (actual or constructive in section 994C(4), actual only in section 994C(5)) has two elements:

1. that the person knows (or alternatively, in the case of section 994C(4), ought reasonably to know) that an event or circumstance "has occurred"; and
2. the event or circumstance “would reasonably suggest” that the TMD is no longer appropriate

with only (1) and not (2) being subject to the knowledge requirement. On that submission, once knowledge of the event or circumstance has occurred it is then to be objectively determined that the event or circumstance reasonably suggests that the TMD is no longer appropriate, without any need for the person to know that the event or circumstance reasonably suggests that the TMD is no longer appropriate.

The court firmly rejected this submission, holding "the matter [to be] so obvious that it does not raise a real issue of construction at all" and concluding that the person must know, or ought reasonably to know, that an event or circumstance has occurred that would reasonably suggest that the determination is no longer appropriate. The court held that "the provision is clear in requiring the relevant knowledge to extend to the relevant event or circumstance reasonably suggesting that the determination is no longer appropriate".

In reaching that conclusion, the court rejected the submission that this would be contrary to the consumer-centric focus of the DDO regime "if a person […] responsible for monitoring review triggers, had no knowledge or understanding of the DDO regime, the organisation may be liable for a contravention of s 994C(4) (by reason of the “ought to have known” requirement), but could wholly avoid contravening the corresponding obligation to inform relevant product distributors imposed by s 994C(5)". The court held that subsections 994C(4)(c) and (5)(c) clearly have divergent knowledge requirements (and penalties, subsection 994C(5) carrying potential criminal liability), meaning that while "the overall legislative purpose may be described at a high level of generality as consumer protection, the particular purpose of [subsections] 994C(4) and (5) is to impose a regime of remedial responses [and that] it is fundamental to that purpose that the provisions should specify the nature and elements of the knowledge which trigger the requisite remedial response."

Further, the court also discussed the construction of “first knew” in subsection 994C(4)(c), relating to the steps a person must take after they "first knew" of the occurrence of relevant event or circumstances. Those words sit uncomfortably with the opening line of the paragraph requiring that a person "knows, or ought reasonably to know” that certain matters exist and therefore created an uncertainty as to whether "first knew" refers to actual or constructive knowledge, or only to actual knowledge. To resolve that tension, the court held that “first knew” in should be construed as meaning “first knew or ought reasonably to have known”, holding that the context in which the words “first knew” appear strongly indicates that there were intended to apply to both actual and constructive knowledge. In reaching that conclusion, the court noted that "it would be preferable for Parliament to tidy up the drafting of s 994C(4)(c) by adding after “first knew” the words “or ought reasonably to have known” [as it] is most unsatisfactory for a civil penalty provision to be so poorly drafted".

Penalty

The court noted it was relevant to the assessment of penalty that despite the DJ Cards being withdrawn, American Express continues to operate in the credit card industry and is the subject of DDOs in respect of other cards it issues. The court stated that any penalty would need to be sufficient to deter other product issuers and distributors from contravening the DDO regime.

The parties had agreed a penalty of $10.8 million if the Court found contraventions of sections 994C(4) and (5), or $8 million if the Court only found contraventions of section 994C(4). 

The Court ultimately concluded that $8 million was an appropriate penalty, comprised of $4.5 million for contravention of section 994C(4) in relation to the "standard" card and $3.5 million for contravention of section 994C(4) in relation to the "platinum" card. The higher amount for the "standard card" was considered appropriate given the greater potential for consumer harm arising from its distribution in greater volumes than the "platinum" card. 

In determining penalty, the court noted that:

• The relatively short duration of the contravention (41 days) was a mitigating factor. 
• There was a failure by American Express to implement adequate systems to ensure compliance with the DDO scheme and to equip their staff to understand and act in accordance with the company’s obligations. Whilst this did not directly involve senior management, it was relevant that the person responsible for the David Jones Alliance also failed to pay attention to the regulatory requirements under the DDO and American Express did not have in place sufficient checks to ensure that it was able to comply with its obligations.
• While there was no evidence of quantifiable financial loss suffered by consumers as a result of the contravention, American Express’s conduct was contrary to some of the objectives of the regulatory regime. Specifically, a large amount (around 5,000) of customers applied for DJ Cards in the period of contravention, exposing them to potential harm from obtaining a financial product that may not have been appropriate to all of their needs and objectives.
• American Express did not make a significant profit from the contravention.
• There was evidence that American Express had demonstrated some level of commitment towards complying with the DDO regime (for example by undertaking a DDO project to "retrofit" the DJ Cards with TMDs and issuing a DDO Product Owner Guide).
• American Express had cooperated with ASIC in admitting facts and contraventions and had undertaken to work to update its DDO program.

The Court concluded that "a penalty of this order ensures it has a “sting” sufficient to deter both repetition by American Express and contravention by other providers of financial products, and one that goes beyond being a mere “cost of doing business”

Want to know more

• ASIC v Firstmac Limited: Court makes first finding of contravention of design and distribution obligations (16 July 2024)

Authors: Jonathan Gordon, Partner; Corey McHattan, Partner; Lorraine Hui, Partner and Daniel Pannett, Senior Associate.