The Regulation of Premium Rate Services Order 2024

17 Risk assessment requirements

(1) No PRS provider may enter into an arrangement in respect of a controlled PRS, unless the provider has carried out an assessment of risk in respect of that arrangement (but see paragraph (6)). (2) In carrying out that assessment, the PRS provider must have regard to— (a) the purpose and nature of the arrangement, (b) the parties to the arrangement, and (c) the provision, content, promotion and marketing of the controlled PRS in respect to which the arrangement is being made. (3) For the purposes of paragraph (2)(b), the PRS provider must take account of such of the following information as it may reasonably access from public sources in relation to each party— (a) the party’s corporate structure, (b) whether there are reasonable grounds for suspecting that the party is unable, or is likely to be unable, to pay its debts as they fall due, (c) the party’s involvement in any legal proceedings, including any previous or ongoing legal proceedings and judgments or any other decisions made by a court, tribunal or other body in respect of the party, (d) registered information (if any) of any sub-contractors used, or to be used, by the party in respect of the controlled PRS to which the arrangement mentioned in paragraph (1) relates, and (e) the party’s relevant compliance history. (4) In paragraph (3)(e), “relevant compliance history” means— (a) where a party referred to in paragraph (2)(b) is a PRS provider, any decisions made by OFCOM under Part 10 of this Order concerning the party’s compliance with requirements imposed by Parts 2 to 9 of this Order, (b) where a party referred to in paragraph (2)(b) is a person to whom a relevant approved code applied, any decisions made by a relevant enforcement authority under such a code concerning the party’s compliance with requirements under such a code, and (c) where a party referred to in paragraph (2)(b) is a person who is subject to other requirements imposed by OFCOM or any other regulatory body, any decisions by that body concerning the party’s compliance with the requirements in question. (5) The PRS provider must take such measures as are appropriate and proportionate for the purpose of mitigating and managing any risks identified in the assessment. (6) Where there is no reasonable prospect of the PRS provider taking the measures required by paragraph (5), the provider must not enter into the arrangement. (7) Where the PRS provider enters into the arrangement referred to in paragraph (1), it must review and update the assessment at appropriate intervals (for so long as the arrangement remains in place) to consider— (a) where risks were previously identified by the assessment, whether those risks have materially changed, and (b) whether any new risks have arisen, having regard to the matters in paragraph (2). (8) Where the updated assessment under paragraph (7) identifies either materially changed risks or new risks, the PRS provider must go on to take such measures as are appropriate and proportionate for the purpose of preventing adverse effects arising from such risks. (9) Where there is no reasonable prospect of the PRS provider taking such measures, it must immediately terminate the arrangement. (10) A generally authorised person of the PRS provider required to carry out any assessments and take any measures under this article must approve such assessments and measures. (11) The PRS provider must make and keep a record in writing of— (a) the assessment carried out for the purposes of this article (including any updated assessment made in accordance with paragraph (7)), and (b) any measures taken in accordance with paragraphs (5) or (8). (12) In this article— “appropriate intervals” means— within the period of 12 months beginning with the day after the PRS provider has carried out the risk assessment under paragraph (1), and thereafter at intervals not exceeding 12 months from the previous review until the arrangement has concluded; “generally authorised person” has the meaning given in article 10(1)(b); “public sources” means sources that contain information that is available to members of the public in the United Kingdom; “registered information” means— in the case of a body corporate, firm, unincorporated body or association that is a legal person under the law by which is it governed— in the case of a limited company that is registered in the United Kingdom, the registered name, number and address, and any trading name, or in any other case, particulars of the legal form of a company, firm, unincorporated body or association under the law by which it is governed, and (if applicable) the register in which it is entered and its registered name, number and address in that register, and any trading name, or in any other case, the name (including any trading name) and the last known address of the person; “relevant approved code” and “relevant enforcement authority” have the meanings given in paragraph 1 of Schedule 4; “risk” means any reasonably identifiable circumstance or event having a potential adverse effect on consumers using the controlled PRS to which the arrangement mentioned in paragraph (1) relates.