The FCA was set up in 2013 as a response to the perception that its predecessor, the Financial Services Authority, had failed to properly regulate UK banks in the run-up to the 2008 Financial Crisis. As its name implies, the Financial Conduct Authority was primarily tasked with policing conduct, rather than ensuring the provision of financial services. Since March 2016 in its first-phase application, the SM&CR has been the flagship of the FCA regulation fleet. While the FCA expects financial services firms to be self-policing, it has always regarded enforcement as a vital tool in attaining its statutory objectives. However, the total number of enforcement actions in any given year vs. the number of firms regulated by the FCA (approx. 48,000) makes for relatively comfortable reading for those inclined to non-compliance or even outright malfeasance. For example, since the regime’s inception the Regulator has finalised proceedings against a sum total of zero firms in respect of their SM&CR implementation The FCA’s standard response to criticism has been that the “low” and declining enforcement rate is an indication of how well their system is working. Make of that you will, but this “defense” does presume a financial panopticon in which the FCA has perfect knowledge, only intervening via enforcement when strictly necessary. As the graph below illustrates, since the FCA’s inception, both the number and value of fines have been on a broadly downward trend.
The number of investigations, while not directly comparable on a year by year basis, is markedly higher. As per its most recent Annual report, the FCA has 591 open enforcement cases, relating to 224 investigations. Of these open cases, 206 are against firms and 385 against individuals.
The average time taken to complete the regulatory ‘investigation stage’ (which ends at the point at which the investigation team make initial findings) was 40 months last year. This is up from 25 months in 2020/21 (and 38 months in the 2021/22). Regulatory cases that went beyond the investigation stage took a further 24 months to conclude (on average)- a total of 64 months. Therefore, in cases where the FCA chose to pursue enforcement action, the average time to completion was a full five years and four months. If the case then proceeds to settlement or on to the RDC or Tribunal it takes on average a further 23 months to conclude.
While no firm or individual would welcome any degree of FCA enforcement; whether innocent or not, investigation itself is frequently tantamount to a significant penalty. Though there is no Regulatory requirement that a subject under investigation must inform anyone of the fact, it is very likely that individual contracts with banks, insurers, investors, investors, suppliers and even clients may require notification of potential proceedings. In these cases, simply being investigated by the FCA may amount to a commercially existential threat.
A particularly egregious example of this occurrence can be seen in the Upper Tribunal’s 2020 review of Financial Services (Euro) Limited v FCA. Financial Services (Euro) Limited (FSEL) were a mortgage-broking firm who were investigated by the FCA, because the Authority had concerns that the firm may be unwittingly used to facilitate fraud. While under investigation, FSEL was unable to obtain professional indemnity cover and suspended its business as a result. In the absence of revenue, FSEL was unable to pay its annual FCA levy. As a consequence, the FCA cancelled FSEL’s regulatory permission, effectively shuttering its business. The Upper Tribunal was highly critical of the FCA, both in respect of its decisions regarding FSEL as well as its submissions to its own Regulatory Decisions Committee seeking approval of such.
We have seen that, however headline-grabbing when they occur, the chances of an enforcement action against a particular firm or individual are relatively low. However, penalties are financially and reputationally significant at the corporate level and typically terminal at the individual level, at least in career terms. As above, approximately 1 in 200 regulated firms are currently under investigation. At the very least, each of these represents a significant cost in time and resources and in the worst cases can prevent a firm from doing any business at all.
Investigations may arise from a number of sources, the FCA may be alerted to possible rule breaches by complaints from the public or firms, by referrals from other authorities or through its own enquiries and supervisory activities. Firms are also obliged, under Principle 11 of the Principles for Businesses in the FCA’s Supervision manual, to bring their own contraventions to the FCA’s attention. Irrespective of the source of the investigation, it is vital for both firms and individuals that any investigation takes the shortest time possible.
In practical terms, there is only one way to ensure this- you must act on the assumption you will be investigated at some point. This being the case, when the FCA do come knocking, it is imperative that you are able to co-operate with them to the fullest extent, rapidly allaying their concerns and bringing the investigation to a swift conclusion. The only way to do this is to be entirely compliant in all aspects and to be able to fully evidence such compliance.
While there are is a multitude of possible infractions which may form the basis of an investigation i.e. money laundering, reporting failures, “use it or lose it” etc., the SM&CR constitutes a list all to itself, particularly so for Senior Managers. It is entirely possible, if time-consuming and insecure, to track and evidence SM&CR compliance via an assortment of generic software such as Word and Excel. It is, of course possible to do all sorts of ill-advised things- using software that entirely lacks audit trail, user authorisation and version control functionality to show compliance with a complex regime is one such thing. There are many examples similar to the case above, “innocence” is no bar to an investigation, the absence of structured evidence of compliance can only serve to lengthen what will almost certainly be a painful and expensive investigatory process.
Something about – call us @ Corterum etc..
