KYBC obligations offer a real, tangible, complementary solution to address all illegal content with minimal burdens on legitimate businesses.
We very much welcome that the European Commission has shown interest in solving this problem in its pre-legislative texts on the DSA. However, we are concerned it has so far only mentioned KYBC obligations in the context of online marketplaces. Such a limited approach would be a missed opportunity to address the broad range of illegal content online.
The DSA represents a real opportunity to rectify the situation that allows bad actors to ignore Article 5 of the ECD with impunity. A business cannot go online without a domain name, without being hosted, or without advertisement, payment services or online marketplaces. These intermediary services, having a direct relationship with the business, are therefore best placed to make sure that only businesses that are willing to comply with the law have access to their services. This does not mean monitoring their business customers’ behaviour or content, but merely asking them to identify themselves and applying simple due diligence checks on the basis of publicly available data. Should the information provided prove to be manifestly wrong, or the intermediary be notified that the business customer isn’t who it claims to be, the intermediary should stop providing services until the business customer remedies the situation.
For decades, fraudulent businesses have been exploiting the lack of enforcement of the information requirements under Article 5 of the ECD. This has been to the detriment of a safe and trustworthy online environment and has facilitated the use of infrastructure by completely anonymous commercial entities that intentionally make available or distribute illegal content. These include operators of scam websites and operators of online services distributing illegal gambling, substandard or falsified medicines, sexual abuse material, counterfeits, malware and more.
Now is the time to act.
KYBC obligations are an ideal tool to give Article 5 ECD greater effect. Requiring commercial entities to reveal their true identity on the internet would automatically reduce illegal content online and would greatly facilitate consumers’ and business customers’ efforts to seek redress.
The obligation actually already exists: Article 5 ECD establishes that service providers shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, identity information, including the name of the service provider, the geographic address at which the service provider is established, the details of the service provider, including their electronic mail address, which allow them to be contacted rapidly and communicated within a direct and effective manner.
But under existing law, they face no consequences for failing to do so. Operators of scam websites seeking to defraud consumers, as well as operators of online services disseminating child abuse content, illegal gambling, counterfeit products and other illegal content freely target EU citizens, using EU-based infrastructure, with an impunity borne of complete anonymity.
KYBC obligations impose minimal or no burdens on legitimate businesses, all of which are easily identifiable. Making a defined set of intermediaries responsible for collecting data to confirm the identity of entities with whom they are directly contracting – and verifying that data – should be easy to implement as part of the sign-up process and subsequent periodic re-verifications. In the event that the identification data proves to be false, misleading or otherwise invalid, the intermediary will have to stop providing their services to the respective customer.
Categories of intermediaries to be covered by KYBC obligations
When considering the categories of intermediaries to be covered by KYBC obligations, it is necessary to find the right balance, recognizing that the problem of illicit operators extends far beyond the online marketplace, and often manifests itself through dedicated sites and services distributing scams or illegal content. Against this background, we propose that KYBC obligations should be applicable not just to marketplaces, but to the full range of services that enable the possibility of operating an information society service covered by Article 5 ECD. These would include, for example, business applications of hosting and CDN services, payment services, domain name services, advertising services, and proxy services.
Sanctions
KYBC obligations do not affect the liability privileges in Articles 12-15 ECD, but create new and direct obligations on certain categories of intermediaries. Dissuasive financial penalties should be introduced for non-compliance.
IMCO Approved Text on KYBC
Compromise Amendment C
Transparency and consumer protection
Compromise Amendment 4
Transparency and information obligations
