Remote Service Supplier (RSS)
The following information and scenarios relate to organisations wishing to become an approved Independent Operator (IO) and an approved Remote Service Supplier (RSS).
Key Facts
- A single legal entity (Company) cannot apply to become an IO and an RSS. They can only apply to be approved for one role.
- An IO and an RSS can operate from the same address, but they must be two separate legal entities, with two separate VAT numbers (in this scenario, they cannot work together as an IO and RSS for chain authorisation)
- Chain authorisation is not possible between an IO and an RSS registered at the same address
- An IO can be registered on the ground floor and an RSS can be registered on the first floor of the same building, providing they have different addresses (e.g. Unit 1a and Unit 1b). In this situation, providing they are two separate legal entities with two separate VAT numbers, chain authorisation between the IO and RSS is permitted.
Quick Links: Scenario 1 – Single Legal Entity with One Premises / Scenario 2 – Single Legal Entity with Two Premises / Scenario 3 – Two Legal Entities with One Premises / Scenario 4 – Two Legal Entities with Two Premises / Scenario 5 – Two Legal Entities with One Premises with Separate Addresses / FAQs
Important Information
Where an organisation meets the requirements to apply for approval to become an IO and an RSS (Scenarios 3, 4 & 5 below), they must ensure separation of duties and sufficient safeguards are in place to prevent conflict of interest.
Retention of Evidence
When carrying out security-related activities as a Remote Service Supplier (RSS), the responsibility for validating the vehicle and customer details remains the responsibility of the Independent Operator (IO). The IO is also responsible for retaining this information for a period of 5 years from the date of repair.
As the RSS you will need to retain the following information for the purpose of any audit:
- The date of the repair
- A summary of the work carried out
- The name of the IO you carried out the work for
- The name of the RSS Employee who carried out the repair
From the information above, the auditor will be able to track the repair and ensure that the relevant IO has retained the vehicle and customer identification information required as part of the SERMI Scheme.
Working with Countries not yet ‘live’ with SERMI
As a SERMI approved RSS, you can only access security-related information on behalf of an Independent Operator (IO) with SERMI approval, working in a country which has migrated to SERMI. If the Independent Operator is working in a country which has not yet migrated to SERMI, they will not be able to provide you with the digital certificate required to access security-related information on their behalf. SERMI are currently working on a solution for this, and we will provide an update once a solution has been implemented.
Scenario 1 – Single Legal Entity with One Premises
In this scenario, RMI Diagnostics Ltd is a single legal entity, with a single VAT number. They operate out of one building, which is also the registered address on Companies House.
RMI Diagnostics Ltd can apply to become either an approved Independent Operator (IO) or an approved Remote Service Supplier (RSS).
In this scenario, RMI Diagnostics Ltd cannot apply to become an approved Independent Operator (IO) and an approved Remote Service Supplier (RSS).
Scenario 2 – Single Legal Entity with Two Premises
In this scenario, RMI Autos Ltd is a single legal entity, with a single VAT number. They operate out of two buildings, with two different addresses but only one registered address on Companies House.
RMI Autos Ltd can apply to become either an approved Independent Operator (IO) or an approved Remote Service Supplier (RSS).
In this scenario, RMI Autos Ltd cannot apply to become an approved Independent Operator (IO) and an approved Remote Service Supplier (RSS).
Scenario 3 – Two Legal Entities with One Premises
In this scenario, RMI Autos Ltd and RMI Diagnostics Ltd are two separate legal entities, operating out of the same premises. Each legal entity has a separate VAT number but has the same registered address on Companies House.
RMI Autos Ltd can apply to become an approved Independent Operator (IO) and RMI Diagnostics Ltd can apply to become an approved Remote Service Supplier (RSS).
Note: In this scenario, RMI Diagnostics Ltd can work with any other approved IO. However, they cannot work with RMI Autos Ltd on the same vehicle (chain authorisation).
Example Activities
- RMI Autos Ltd carries out a security-related repair within their workshop. An IO technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
- RMI Autos Ltd carries out a security-related repair away from their workshop using one of their mobile technicians. The mobile technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
- RMI Autos Ltd carries out a security-related repair within their workshop. The IO technician plugged in to the vehicle is unable to carry out the repair and has to contact a member of the RSS team (RMI Diagnostics Ltd) to remote into the vehicle and carry out the repair – IO & RSS Chain Authorisation Activity – Not permitted under SERMI as the IO and RSS are registered at the same address
- RMI Autos Ltd sends out a mobile technician to carry out a security-related repair. When the mobile technician plugs in to the vehicle, they are unable to carry out the repair. They call in to the RSS office (RMI Diagnostics Ltd) and one of the office-based RSS technicians accesses the vehicle remotely and carries out the repair – IO & RSS Chain Authorisation Activity – Not permitted under SERMI as the IO and RSS are registered at the same address
- RMI Diagnostics Ltd is contacted by another approved IO (not RMI Autos Ltd) and is asked to carry out a remote security-related activity. RMI Diagnostics Ltd completes the activity remotely – IO & RSS Chain Authorisation Activity – Permitted
Scenario 4 – Two Legal Entities with Two Premises
In this scenario, RMI Autos Ltd and RMI Diagnostics Ltd are two separate legal entities, operating out of two separate premises. Each legal entity has a different registered address on Companies House and has a separate VAT number.
RMI Autos Ltd can apply to become an approved Independent Operator (IO) and RMI Diagnostics Ltd can apply to become an approved Remote Service Supplier (RSS).
In this scenario, RMI Autos Ltd and RMI Diagnostics Ltd can work together as an IO and RSS on the same vehicle (chain authorisation).
Example Activities
RMI Autos Ltd carries out a security-related repair within their workshop. An IO technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
RMI Autos Ltd carries out a security-related repair away from their workshop using one of their mobile technicians. The mobile technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
RMI Autos Ltd carries out a security-related repair within their workshop. The IO technician plugged in to the vehicle is unable to carry out the repair and has to contact a member of the RSS team (RMI Diagnostics Ltd) to remote into the vehicle and carry out the repair – IO & RSS Chain Authorisation Activity – Permitted
RMI Autos Ltd sends out a mobile technician to carry out a security-related repair. When the mobile technician plugs in to the vehicle, they are unable to carry out the repair. They call in to the RSS office (RMI Diagnostics Ltd) and one of the office-based RSS technicians accesses the vehicle remotely and carries out the repair – IO & RSS Chain Authorisation Activity – Permitted
RMI Diagnostics Ltd is contacted by another authorised IO (not RMI Autos Ltd) and is asked to carry out a remote security-related activity. RMI Diagnostics Ltd completes the activity remotely – IO & RSS Chain Authorisation Activity – Permitted
Scenario 5 – Two Legal Entities with One Premises with Separate Addresses
In this scenario, RMI Autos Ltd and RMI Diagnostics Ltd are two separate legal entities, operating out of the same premises, but each company has a different address (Unit 1a and Unit 1b in the example above). Each legal entity has a different registered address on Companies House and has a separate VAT number.
RMI Autos Ltd can apply to become an approved Independent Operator (IO) and RMI Diagnostics Ltd can apply to become an approved Remote Service Supplier (RSS).
In this scenario, RMI Autos Ltd and RMI Diagnostics Ltd can work together as an IO and RSS on the same vehicle (chain authorisation).
Example Activities
RMI Autos Ltd carries out a security-related repair within their workshop. An IO technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
RMI Autos Ltd carries out a security-related repair away from their workshop using one of their mobile technicians. The mobile technician plugs in to the vehicle and carries out the repair themselves – IO Activity – Permitted
RMI Autos Ltd carries out a security-related repair within their workshop. The IO technician plugged in to the vehicle is unable to carry out the repair and has to contact a member of the RSS team (RMI Diagnostics Ltd) to remote into the vehicle and carry out the repair – IO & RSS Chain Authorisation Activity – Permitted
RMI Autos Ltd sends out a mobile technician to carry out a security-related repair. When the mobile technician plugs in to the vehicle, they are unable to carry out the repair. They call in to the RSS office (RMI Diagnostics Ltd) and one of the office-based RSS technicians accesses the vehicle remotely and carries out the repair – IO & RSS Chain Authorisation Activity – Permitted
RMI Diagnostics Ltd is contacted by another authorised IO (not RMI Autos Ltd) and is asked to carry out a remote security-related activity. RMI Diagnostics Ltd completes the activity remotely – IO & RSS Chain Authorisation Activity – Permitted
FAQs
If we operate as two companies (one approved as an IO and one approved as an RSS), based at the same address with different VAT numbers, can the IO Employee authorise the RSS Employee to access security-related repair and maintenance information via SERMI?
No. Although you have approval through the two companies to operate as an IO and an RSS, it is prohibited for a chain authorisation request (required between the IOE and RSSE) to come from the same address. There is specific mention of this scenario in the sanctioned interpretations document published by SERMI.
Can we apply to become an RSS using our VAT number and then use our Unique Tax Reference (UTR) number to become an IO (or vice versa)?
No, not if both numbers relate to the same Company. To become approved as an IO and an RSS you will need two separate companies, registered with two separate VAT numbers or two separate UTR numbers.
If we have two companies, both registered at the same address, but with different VAT numbers, can we apply to become an IO and an RSS?
Yes. Providing you have two separate companies, operating independently of each other and both with a unique VAT number or UTR number. Each of the two companies can apply for one of the roles (IO or RSS). In this scenario the IO and RSS cannot work together (chain authorisation) due to being registered at the same address. – this would not be suitable for most organisations wanting to register as an IO and an RSS. This scenario is only appropriate for an IO and RSS who will never work together on the same job (chain authorisation).
If we have two premises, which run independently of each other, but both have the same VAT number, can one premises apply to become an IO and the other apply to become an RSS?
No. If you only have one VAT number, you are classed as being one company in relation to SERMI approval. You will only be able to apply for one role (IO or RSS), but you can apply for this role for both premises (sites). Each site will be approved independently and will require a separate application form completing and each one will need to apply for the same role (IO or RSS).
If we operate as an IO and an RSS (two companies with two VAT numbers) and we operate from the same site, can you combine our audits?
No. As the Conformity Assessment Body (CAB), we are prohibited from conducting combined audits for an IO and an RSS at the same time.