“Know your business customer” (KYBC) obligations: a real and tangible solution to reduce illegal content and products with minimal burdens on intermediaries and legitimate businesses
In a responsible and mature economy, businesses should not be able to operate and have access to the modern necessary infrastructure Europe has to offer without accurately identifying themselves. This applies equally to the offline and to the online world, which is why in 2000 legislation introduced an obligation on businesses to identify themselves on their websites (see Article 5 of the e-Commerce Directive (ECD)). Unfortunately (and unsurprisingly) businesses that have the intention of making a profit out of illegal content do not comply with this obligation and do not suffer consequences.
We welcome the European Commission’s proposal for a Digital Services Act (DSA). As this letter focuses on the “Know Your Business Customer” (KYBC) obligations of the proposal, the signatories of this letter may also be in touch with you independently on this and other important elements of the DSA.
With regard to KYBC obligations, we welcome the inclusion of a provision ensuring the traceability of traders in Article 22. We acknowledge that this represents a step forward. However, the Commission’s proposed Article 22 only introduces KYBC obligations in the context of online marketplaces. Such a limited approach is a missed opportunity to address the broad range of illegal content and counterfeit, unsafe, non-compliant and substandard products online.
The DSA represents a real opportunity to rectify a situation that allows bad actors to ignore Article 5 of the ECD with impunity. A business cannot go online without a domain name, without being hosted, or without advertisement or payment services. These intermediary services, having a direct relationship with the business, are therefore best placed to make sure that only businesses that are willing to comply with the law have access to their services. This does not mean monitoring their business customers’ behaviour, but merely asking them to identify themselves and applying simple due diligence checks on the basis of publicly available data. Should the information provided prove to be manifestly wrong, or the intermediary be notified that the business customer isn’t who it claims to be, the intermediary should stop providing services until the business customer remedies the situation.
For decades, fraudulent businesses have been exploiting the lack of enforcement of the information requirements under Article 5 of the ECD, which has been to the detriment of a safe and trustworthy online environment and has facilitated the use of infrastructure by completely anonymous commercial entities that intentionally make available or distribute illegal content and products. These include operators of scam websites and operators of online services distributing illegal content, including but not limited to substandard or falsified medicines, sexual abuse material, counterfeits, malware, illegal gambling, piracy and more. These illegal activities can cause serious harm to EU citizens’ physical, psychological and financial wellbeing. In some cases, especially during the COVID-19 pandemic, they can even pose a threat to life. All of these operators and all intermediary service providers enabling them to operate should be subject to KYBC provisions.
The Digital Services Act is an opportunity for the Council to address these shortcomings of the ECD. We therefore urge you to ensure that all intermediaries – not just online marketplaces – know who their business customers really are.
We thank you for your attention and would welcome the opportunity to discuss this issue with you further.
For the full list of signatories, please download the letter to the European Parliament and the European Council.