Credit providers to proceed with caution

Featured

man-and-women-window-shipping-at-mallCredit-granting companies are urged to continue to carry out stringent checks on prospective lenders, following a recent ruling that relaxes affordability assessment requirements.

While many local retailers have lauded a recent High Court ruling that binned a legal clause requiring lenders to demand payslips and financial statements from credit applicants, the move has been met with raised eyebrows from SA’s credit regulator – which is concerned it may lead to reckless lending.

Indeed now more than ever, in light of the historic ruling, it is worth reiterating how vital it is for credit lending – in whatever form – to be approached with caution. If you are a business owner that deals with individuals or other businesses, the importance of carrying out thorough checks when assessing customers’ credit status cannot be stressed enough.

While it is unquestionably important for businesses to have customers, financially vulnerable customers only spell trouble – both for your company’s bottom line and the customer, who you as a business should be protecting.

Court ruling

On March 16 this year, the Western Cape High Court made a ruling that binned the clause of the National Credit Regulations that, since 2015, had made it compulsory for credit lenders to acquire payslips and financial statements from prospective borrowers before granting credit.

The judgment applies to all forms of credit lending, from store credit to microloans.

Prior to the recent ruling, subsection 23 A(4) of the National Credit Regulations required credit providers to obtain three recent payslips or bank statements as proof of income from applicants who were permanently employed – and three recent documented proofs of income or bank statements from those who did not receive a salary. If the applicant could not provide proof of income, credit providers had to then get three recent bank or financial statements from them (see page 18 of the Government Gazette, 13 March 2015).

While affordability assessments have always been a requirement of the National Credit Act (NCA), prior to the more stringent requirements put in place in 2015, credit providers were allowed to decide on their own means of carrying these out.

This year’s Western Cape High Court ruling – spurred on by applications by Truworths, the Foschini Group and the Mr Price Group – essentially returns the affordability assessment subsection of the NCA back to its former, more moderate, self.

The three retailers brought the case against the Department of Trade and Industry and the National Credit Regulator (NCR) because they claimed the said affordability assessment regulation adversely affected their businesses.

Continue with caution

However, the NCR, which believes an important tool in the fight against reckless lending and borrowing has been removed, is not happy with the ruling, to the extent it is considering an appeal.

The Credit Ombud, meanwhile, has also reportedly greeted the ruling with caution.

News site iol cites NCR company secretary, Lesiba Mashapa, urging credit providers to continue to carry out thorough credit checks despite the ruling: “We appeal to credit providers to continue to apply the income verification standards set by the regulations to protect themselves and consumers from reckless lending and borrowing.”

While the credit regulations in terms of affordability assessments have been significantly relaxed, Section 81 of the NCA, which requires credit providers to take “reasonable steps” to assess consumers’ financial stability before granting credit, remains in force.

Mashapa has urged credit providers to proceed with caution, and continue to carry out stringent credit checks on prospective customers. “[Credit providers] should request consumers to produce proof of income.”

pbVerify offers a range of B2B and B2C Credit Risk Management tools for any size business in South Africa that grants credit. For more information visit our products page HERE

 

[REFERENCES]

  1. Credit Ombud – National Credit Regulations including affordability (Chapter 3: Page 17)
  2. The Department of Justice & Constitutional Development – National Credit Act (Page 114)
  3. Southern African Legal Information Institute – Truworths Limited and Others v Minister of Trade and Industry and Others (4375/2016) [2018] ZAWCHC 41
  4. iol – High Court ruling removes barriers to credit
  5. Business Day – Court ruling leaves credit providers in catch-22 situation

Data protection: SA companies need to take a global stance

Featured

how-to-comply-with-the-data-protection-act-457501399With the implementation of the EU’s data protection laws just around the corner, local entities need to study up on how it could affect them.

D-day for implementation of the European Union’s (EU) General Data Protection Regulation (GDPR) is just three months away – and South African organisations are by no means off the hook.

If you are a South African entity that handles individuals’ personal data, you will be acutely aware of our country’s data protection law – the Protection of Personal Information (POPI) Act – but have you considered how the looming GDPR affects the way you manage clients’ personal information?

The fact of the matter is, if you are a locally-based business that offers goods or services to EU customers, you also deal with personal information or data relating to EU citizens’ – and you are just as responsible for complying with the GDPR as any EU business.

Leon van der Merwe, head of digital at customer communication firm PBSA, points out that any entity controlling or processing data relating to EU citizens is affected by the GDPR. “Controlling refers to any organisation that states why and how data is processed, while a processor is any party doing the actual processing of the data, whether based in the EU, or not.”

GDPR vs POPI

Van der Merwe says it is crucially important for local companies with dealings abroad to do their homework and familiarise themselves with the GDPR’s ground rules. “Companies could be fined heavily under GDPR regulations if they fail to provide evidentiary and auditable processes, as well as adequate IT security, to protect personal data.”

The GDPR is a regulation borne out of the European Parliament, Council of the European Union and European Commission’s joint intent to strengthen and unify data protection EU citizens.

Non-compliance with the GDPR comes with a hefty fine of up to €20 million (about R290 million) – or 4% of annual sales.

Similar to SA’s POPI Act, the GDPR is all about data protection. Data includes things like a person’s name, email address and phone number, as well as information collected by website cookies like internet browsing habits.

Breaching rules laid out in the POPI Act comes with a R10 million fine and/or a jail sentence.

Van der Merwe summarises the parallels between the two data-protection directives: “POPI and GDPR are similar, in that they both aim to strengthen the protection of personal information. They differ in their approach, in that the GDPR takes a wider, more global perspective that includes anyone, anywhere either controlling or processing – or both – data relating to EU citizens.”

Auditable business processes

A big part of compliance, when it comes to both the POPI Act and the GDPR, specifically involves audit trails – something PBSA’s digital signature and workflow product, SignFlow, is heavily centred on.

For evidentiary purposes and in order for any company to assert GDPR compliance, the automated management of an audit trail is imperative.

Van der Merwe says SignFlow is can assist customers in their strategy to automate and digitise processes in a responsible and compliant manner. “Business Process Automation is at the forefront of our technology development at SignFlow, including tools like DocFlow, CaseFlow and our digital customer on-boarding tools.”

At the core of SignFlow, he says, is Public Key Infrastructure (PKI). “PKI manages users’ private keys, and signs and secures documents using Public Key Cryptography. Not only does this make documents tamper-evident after they’ve been signed, but the entire operation is conducted in a secure network over encrypted secure socket layers between the public, personal devices and private servers.”

Unlike paper files and systems managing email attachments, this portal fully controls and audits the workflow and communication channels between interacting parties. “This greatly reduces the risk of data leaks,” says van der Merwe.

“The system enhances non-repudiation, creating a digital trail of undeniable events that prove intent and identity.”

With GDPR set to come into effect on 25 May 2018, and the high stakes attached to non-compliance, South African companies simply cannot afford not to take a global view on data protection. “The protection of personal information goes far beyond just the POPI Act for local companies dealing with international customers,” says van der Merwe.

 

[REFERENCES]

  1. Digiday – For the GDPR-curious: WTF is the Article 29 Working Party?
  2. The Digiday Guide to GDPR (PDF)
  3. The Sun – What is GDPR, what does it stand for, when is the deadline in 2018 and how can you check if a business is compliant?
  4. Michalsons – What does the GDPR mean for the POPI Act?
    POPI commencement date or POPI effective date starts the clock
  5. Wikipedia – General Data Protection Regulation
  6. IOL – Protection of Personal Information Act soon to become a reality
  7. ITWeb – Unpacking the POPI Act: The ins and outs of protecting personal information

Why is it important to credit check prospective customers?

Featured

credit-check-signThe importance of knowing the credit worthiness of new customers cannot be emphasised enough.

It is undeniably important for any business to have customers – whether it be individual consumers, other businesses or suppliers – but it is even more important that the customers you do business with are reliable when it comes to paying you for the services or products you tender.

And, while it may seem counterproductive – even absurd – to turn business away, the value of having quality, paying customers who settle their bills on time, cannot be compared to the value (or lack thereof) of having customers who become a burden because they are constantly defaulting on payments.

The bottom line is, you should never be afraid to turn non-creditworthy customers away because, at the end of the day, it is your company’s bottom line that is on the chopping block.

No business – no matter how big or small – can afford to jeopardise profits. In fact, bad debt and cash flow issues have been positioned as the two main reasons start-ups and small businesses fold.

You also need to be aware that, legally, if you either fail to carry out a credit check or you decide to give a non-creditworthy candidate the green light, you have no recourse down the line should they default on payment and, inevitably, your best option would be to write the debt off.

So, without question, it pays to do your homework. In fact, the advantages of carrying out thorough credit checks go beyond just protecting your profits. The process also allows for intensified sales efforts overall, as these can be confidently spent on the right kind of client, the kind that will add to your income – and not take away from it.

pbVerify offers a range of B2B and B2C Credit Risk Management tools for any size business in South Africa that grants credit. For more information visit our products page HERE

pbVerify intros new verification product

Featured

pbVerify Consumer Marriage Status reportSA’s leading data bureau has added the Consumer Marital Status Report to its suite of credit vetting products.

In the name of protecting your organisation and potentially saving it huge amounts of money, it is imperative that you, as a credit-granting facility, carry out thorough credit checks on new customers.

That is why – as part of our ongoing quest to place all the tools our customers need to manage their credit risk at their fingertips – pbVerify has introduced a new credentials verification product – the Consumer Marital Status Report*.

This latest addition, which forms part of pbVerify’s comprehensive Business to Consumer (B2C) and Business to Business (B2B) credit check suite, allows pbVerify users to quickly and accurately verify the names and identity number of any consumer’s spouse.

While the Consumer Marital Status Report comes primarily in response to our clients’ need to authenticate the marital status of an applicant requesting a financial service, it is also a very useful tool for tracing agents, who may need to access spouse details of customers in default.

All the user needs to access the marital details of the applicant in question, is the applicant’s name, surname and 13-digit South African identity number. These details are then checked against Home Affairs data, after which the system returns the marital details, including the applicant’s spouse’s (if any) first name, surname and identity number.

*The Consumer Marital Status Report costs R7.50 – or 75 pbVerify credits – and is available after registration to any business that grants credit to other businesses or consumers.

For more information on pbVerify’s suite of B2B and B2C credit risk management products click HERE.

New partnership simplifies company registration process

Featured

company-registration-MalaysiaCompany and domain names can now be registered as one, making it easier for companies looking to manage credit risk to access pbVerify’s full suite of services.      

A recent partnership between three South African agencies, allowing company and domain names to be registered together, has streamlined the process of registering local companies and, in turn, of accessing pbVerify’s suite of verification products.

Earlier this month it was announced that the Companies and Intellectual Properties Commission (CIPC), the ZA Domain Name Authority (ZADNA) and the ZA Central Registry NPC (ZACR) had collaborated to make it possible for new companies to register with the commission and claim a parallel co.za domain name at the same time.

The move will not only give new companies greater control over their intellectual property, it also significantly simplifies the process of acquiring unique online credentials – a requirement for access to many professional services, including pbVerify’s credit vetting products.

Daily online news portal, SME South Africa, cites ZACR CEO Lucky Masilela as saying the three-party agreement enables new enterprises to protect their fledgling online identities. “This innovative offering seamlessly combines the offline and online worlds in a way that provides total convenience and protection for start-ups.”

Credit management services

pbVerify is South Africa’s leading data bureau, offering small-to-medium enterprises (SMEs) and corporates all the information needed in order to make informed, intelligent business decisions to the end of mitigating credit risk.

The easiest way to verify businesses, people and property in South Africa, pbVerify’s suite of credit management services includes business credit checks, CIPC business and director searches, Home Affairs ID verification, SARS advanced VAT verification and bank account verification – among others.

Minimum requirements for companies seeking full access to pbVerify’s services are: a business email address; a business landline number and valid business registration details pertaining to an active business.

Now, thanks to the CIPC, ZADNA and ZACR partnership, companies can quickly and painlessly ensure they are able to tick all the above boxes.

Masilela describes the partnership as a “a fantastic example of domain name space pioneering coupled with out-the-box thinking in the area of public-private partnerships” and says the organisation is looking to launch further services for new enterprises, start-ups and other commercial users in future.Masilela describes the partnership as a “a fantastic example of domain name space pioneering coupled with out-the-box thinking in the area of public-private partnerships” and says the organisation is looking to launch further services for new enterprises, start-ups and other commercial users in future.

For more information on pbVerify’s services call 010 300 4898 or send an email to support@pbverify.co.za.

 

REFERENCE:

SME South Africa – Attention Startups! Company and Domain Names Can Now be Registered Together

 

The future of digital onboarding is here

Featured

An integration between two of pbDigital’s software platforms makes it possible for financial institutions to digitally onboard customers in record time.

A recent integration between SignFlow and pbVerify has created a platform for digitally onboarding customers that is about to change the way credit is granted –in terms of risk management, compliance and convenience.

Although pbVerify has offered digital onboarding – an advanced customer activation product designed for financial institutions – for some time, never has this tool been as powerful as it is now, with the incorporation of SignFlow digital signatures.

Digital onboarding was introduced specifically to A) improve the customer experience by making it easier for them to activate and use financial services products, and B) give financial institutions a more secure and scalable means of growing their business.

That said, it makes no sense for institutions and their customers to have to switch back to manual halfway through the digital process of onboarding, to finalise the process with signatures – the old way of doing things.

Since pbDigital is all about innovation, meet the new way of doing things…

Now, with pbVerify’s integration with SignFlow, you can say goodbye to the expensive and onerous manual methods associated with finalising the process of customer onboarding – printing of forms, signing by hand, scanning, uploading and emailing – and say hello to a new fast and fail-safe system that allows institutions to onboard customers entirely online, in a fraction of the time and at a fraction of the cost.

No longer do red tape and geographical circumstances play a part in how long it takes to finalise the onboarding process. With SignFlow, it is simply a case of sending the completed online form to the designated signatory or signatories for approval – all via a secure, legal online platform. No more physical records, no more running around, no more waiting – and, most importantly, no more jeopardising of customer data.

Compliance & security

In today’s legal milieu, with the Financial Intelligence Centre Act (FICA) of 2001 and the Protection of Personal Information (POPI) Act of 2013 binding businesses to stricter data protection criteria than ever before, there is no margin for mistake.

With pbVerify and SignFlow behind your onboarding process, FICA and POPI compliance concerns are a thing of the past.

These software platforms – now integrated into one seamless onboarding solution – offer financial institutions an efficient and guaranteed means of making sure business processes and IT systems comply with the law when dealing with customer data.

 

This is how our new onboarding solution works, in a nutshell:

Front-end: Customer Online App

  1. The customer fills out pbVerify’s intelligent digital onboarding form (complete with auto-population and including Home Affairs/CIPC verification, as applicable).
  2. Details of the designated signatory or signatories (approver/s) are entered.
  3. The signatory/signatories are notified pbVerify has received a customer activation form, of which they are the listed party/parties responsible for sign-off.
  4. The said party/parties follow the link provided, and sign the application form online using SignFlow.
  5. The application process is complete.

Back-end: Admin/Credit Control

  1. Once the customer has completed the application, admin/credit control will get notified of a pending application and can log in to the admin portal, in order to run the required credit and compliance checks.
  2. The digitally-signed agreement/contract can be downloaded online for review and compliance validity confirmation.
  3. If required, different checks can be generated such as CIPC, Bank Code Updates and Full Credit reports.
  4. Once checks are done, the system can notify the relevant department of the application status and pending credit facility.

NOTE: All internal checks are scoped according to customer-specific scope and requirements. This is all customisable, according to business’ specific needs.

Welcome to the future of digital onboarding – an error-free, fast, secure way of procuring new customers.

 

ABOUT OUR COMPANY

pbVerify and SignFlow are products of pbDigital, a division of customer communications firm PBSA.

About pbDigital

pbDigital is the software division of PBSA, which specialises in a range of software products designed to help clients communicate more efficiently with their customers.

pbDigital’s software offerings can be classified according to the following categories:

  • eSign document workflow, digital signature and PKI integration solutions (SignFlow https://www.signflow.co.za/)
  • Credit risk management, data & credit bureau API integration and customer on-boarding
  • Enterprise content and document management
  • Business process automation software with multi-channel output tools and workflow

 

About PBSA

With a rich history of innovation dating back over 90 years, PBSA (formerly Pitney Bowes SA) is a leading customer communications company, offering software, equipment and services to help companies improve operational efficiencies and connect with their customers in more meaningful ways.

Based in Midrand, Gauteng, PBSA understands both hardware and software solutions and is optimally positioned to provide a secure, committed support infrastructure to its Southern African customer base. The company’s solutions help companies engage customers, gain business insight, manage document workflow and ultimately optimise overall business performance.

PBSA believes innovation and growth go hand-in-hand with long-held ideals such as collaboration, integrity and accountability.

PBSA embraces the fast-changing world of technology, which today sets the tone for the business going forward. The company has transformed – and continues to transform – from a purely paper-based to an integrated digital business that serves the market through its own time-honoured patented technology and an extensive network of channel partners.

Everything the company does has one goal – to help its clients communicate more effectively with their customers.

SignFlow engineers terminate menacing Bitcoin virus

Featured

pic for SignFlow bitcoin blogA dangerous Bitcoin-mining virus has been detected and disabled by two of our IT experts.

A potentially devastating Bitcoin-mining virus has been stopped in its tracks, thanks to the vigilance and quick actions of SignFlow (a PBSA brand) engineers William Vermaak and Morne Wilken.

Vermaak and Wilken detected malicious activity on one of their customer’s servers last week, immediately analysed the source of the virus and un-infected the server.

According to Vermaak, the virus had gone undetected by all available virus packages. “We submitted samples to ESET the next day and [the company] immediately responded from its virus lab in Denmark, confirming the virus was wild and that detection for the threat had been added to its latest definition updates.”

Founded in 1992, ESET is a Slovakia-based IT security company that offers anti-virus and firewall products such as ESET NOD32. The security company named the virus winlog.VBS – VBS/TrojanDownloader.Agent.QE trojan winlog.bat – BAT/CoinMiner.UG Trojan.

By the time of detection, the virus had already infected 0.04% of Windows computers in South Africa, while Russia was hardest hit, with 0.5% of all Windows computers infected. Windows is currently the most popular end-user operating system in the world.

Essentially a Bitcoin-mining virus, the Winlog Virus downloads a Bitcoin CPU miner on the victim’s computer, and then mines Bitcoins for the virus originator. Vermaak says this type of virus is particularly evasive. “It tries to make itself resilient and configures various system schedules to start it again if it’s stopped. The virus will also install itself on the system as a system service.

“The virus infiltrates the System Registry and changes some keys to make itself run again if it’s shut down. Shortcuts on the victims’s Desktop are modified to run the virus and these then run the original program, in an attempt to mask it’s presence. The virus also copies itself into various other files on the system – including Microsoft.exe – to try ensure resilience.”

Prevalent pest

According to Manuel Corregedor, chief operations officer at information security company Telspace Systems, Bitcoin-mining viruses have become rampant. “There has definitely, in recent times, been an increase in Bitcoin-mining viruses – in particular the diversification of the type of currencies they mine.”

Almost three months ago, Russian president Vladimir Putin’s Internet advisor, Herman Klimenko, issued a dire public warning that 20 to 30 percent of all computers in Russia were infected with computer malware designed to turn devices into Bitcoin-mining machines.

At the time Klimenko told Moscow-based news broadcaster RBC that viruses that install bitcoin-mining software are the “most common and most dangerous” type of computer malware in existence.

Corregedor says the main issue Bitcoin-mining malware creates, is that it negatively impacts the performance of the victim’s computer. “[The malware] does this by stealing/utilising the infected computer’s resources (CPU, GPU, RAM, etc). This may result, over time, in increased wear and tear, which may cause the computer to fail or cease.” On top of this destructive consequence, he adds, there are other costs associated with increased power consumption.

But this destructive malware goes even further. Apart from the said performance impact, Corregedor notes that – apart from mining Bitcoins – it  has also been seen launching web- and network-based attacks, such denial of service attacks, login brute force attacks and web application attacks.

“It should also be noted that the danger [with Bitcoin-mining malware] is further increased due to the fact that [it] has been found to be infecting Internet of Things devices i.e. web cameras, routers, Network Attached Storage devices, etc.  The infections have mainly occurred due to these devices having default credentials configured on them – for example user name admin and password admin on a router.”

Protection pointers

Corregedor says users can protect themselves against these kinds of malicious virtual attacks by ensuring their operating systems (Windows, Linux etc) are up to date with the latest security updates (patches).

He gives the following pointers:

  • Ensure you have anti-virus software installed and that it is up to date
  • Ensure your devices are not using any default login credentials and/or weak login credentials, in particular devices such as routers
  • Enable/install a Firewall
  • Install a HIPS (Host Intrusion Prevention System)
  • Be cautious/aware when it comes to receiving unexpected emails with attachments and/or installing potentially unwanted software

“Attackers are constantly scanning the internet looking for devices that are not up to date and/or are not configured securely (for example using default credentials).  Once such systems are identified, they are infected with malware,” he warns.

“Additionally, attackers are also constantly sending out spam/phishing emails that contain malicious attachments.”

Corregedor says, while South Africa is just as vulnerable as any country when it comes to infection, the country’s lack of a National Information Security Awareness campaign could render it in deeper danger.