Six Channels, One That Counts as Notice Given and Received

The Association of Banks in Singapore lists six channels a bank may use to tell a customer that its terms are changing. Only one of them carries the Code's own statement that the message counts as notice given and received. That sentence sits in an appendix, and it is the reason certain bank letters are still printed.

Six permitted channels, and what separates one of them

Section 14(b) of the Code of Consumer Banking Practice says a bank "will communicate these changes to you through any of these appropriate channels: i. account statements ii. its ATMs iii. its branches iv. the Internet, including its website or through e-mail v. letters vi. the newspapers". Paper is one option among six. Any argument that a Singapore bank is required to post a letter about a change of terms is wrong, and a compliance reader will know it is wrong.

What the Code does do is treat one of those six differently. Appendix I(1): "Note that if your bank sends you a letter to your last known address informing you of any changes relating to its operations or your account, it will be considered as notice given and received." No equivalent sentence attaches to the website, the ATM screen, the statement insert or the newspaper advertisement.

That matters most where a clock is running. Under section 9(b)(ii) the bank undertakes to give 30 days' notice, absent a contrary contractual agreement, before any variation to terms and conditions relating to fees, charges, liabilities or obligations takes effect, and under 9(b)(iii) to provide a written summary of the key features where the variation is substantial or the changes are complicated.

What the deemed-notice line is actually worth

Our read, and it is a commercial read rather than a legal opinion: the value of that appendix line is that it moves the question from receipt to despatch. A bank relying on email has to deal with an argument about whether the message arrived, was opened, or was filtered. A bank relying on a letter to the last known address is working with a standard its own industry code has already answered, and the remaining question is a narrower one about what was sent, to which address, and on what date.

That narrowing is only worth something if the answers exist, and two of them are production facts. The address has to be the last known address rather than a stale one, which makes address currency part of the compliance position rather than a housekeeping task. The despatch date has to be evidenced by something better than an assumption that the file went out the day it was approved. A letter posted four days late is still deemed notice given and received; it is simply deemed four days into a thirty-day clock the bank has already started counting.

Outsourcing the letter does not outsource the accountability

Section 4(3) of the Personal Data Protection Act keeps a bank's obligations in place for personal data processed on its behalf, as if the bank had processed the data itself. Handing a file to a print and mail vendor moves the work, not the accountability.

What the enforcement record shows is that this cuts both ways. In Aviva Ltd and Toh-Shi Printing Singapore Pte Ltd [2016] SGPDPC 15, statements went out disclosing the personal data of 8,022 individuals. The Commission found the insurer not in breach of section 24, because it had done an appropriate level of due diligence on its vendor, and imposed a financial penalty of S$25,000 on the printer. The sending organisation's obligation is discharged by evidenced due diligence. The vendor carries its own statutory liability for the production controls, and a vendor offering to take the risk off a bank's hands is describing something the Act does not allow.

Where the chain actually breaks

The failure that matters in a notice run is not an intercepted file. It is a mismatched pack: the right letter sealed into an envelope addressed to somebody else. PDPC has written a guide specifically for this, the Guide to Printing Processes for Organisations, and it names the controls plainly: separation of the roles of do-er and checker so the checker is independent, checks placed at a juncture where corrective action can still reverse the error, intensity of checking proportionate to volume and sensitivity, and a documentary trail of what each party did. At the enveloping stage it asks for checking that recipients match for the letter and its attachments before sealing.

The Aviva decision shows where that sequence breaks in practice. The client had signed off sample cases before printing. The printer then sorted the data again, by postal code, overseas address and undeliverable mail, and printed on the strength of the earlier sign-off. The Commission's finding was that fresh samples should have been provided after that further sorting, and the quality checks re-run against the client's original source data.

The operating rule we take from it, and apply to every lettershopping run: any step that reorders or re-associates a file invalidates the check that came before it, so the check runs again, against source, not against the intermediate file. It is an unglamorous rule and it is the one that prevents the expensive failure. The same logic governs setup waste, which carries live customer data on every calibration sheet and has to leave the floor through destruction rather than the recycling bin.

A small run is not a small engagement

A low-volume notice run for a bank does not fall below the threshold where outsourcing rules apply. Summarising MAS Notice 658 on the management of outsourced relevant services, Allen & Gledhill notes that the notice extends to arrangements that are not material or not ongoing where they involve the disclosure of customer information by banks to service providers, and that a bank must maintain a register of its outsourced relevant services.

Treat that as the law firm's reading rather than the text of the notice. The MAS pages for the notice and its FAQ returned service errors throughout our research, so we have not read it directly. The direction is clear enough to plan around: nine hundred statutory notices carrying customer data generate the due diligence, register entry and audit-rights obligations that a large programme does, which is a good reason for a bank to place small sensitive runs with a vendor already legible to its own vendor-management process.

What to settle before the file moves

For any run where a clock is attached to the letter, settle four things in writing at the point of engagement rather than at the point of dispute: which address file version was used and when it was last corrected, the date of lodgement as distinct from the date of approval, the point in the process where recipient matching was verified, and what happened to the data and the setup waste afterwards.

Those are the same four questions a bank's outsourcing register will eventually ask of the engagement anyway. Our own print-side controls are set out under secure data printing, separately from our ABS OSPAR audit, whose scope covers mailroom, messaging and local courier services rather than print. The two assurance routes are different, and a vendor should be able to tell you which one covers what you are buying.