Discretionary Civil Penalties under the Financial Services Act 2008 and the Insurance Act 2008

Discretionary Civil Penalties under the Financial Services Act 2008 and the Insurance Act 2008 Guidance Note This guidance note is relevant to all current and former:  licenceholders and other permitted persons under the Financial Services Act 2008;  authorised insurers, registered insurance managers and registered insurance intermediaries under the Insurance Act 2008. First issued: 1 August 2015 Last updated: 20 December 2022

Isle of Man Financial Services Authority First issued 1 August 2015 Page 2 of 24 Last updated 20 December 2022 Contents

1. Civil Penalties......................................................................................................................4 1.1 Civil Penalties under the Financial Services Act 2008.................................................4 1.2 Civil Penalties under the Insurance Act 2008 .............................................................5 1.3 Discretionary Civil Penalties........................................................................................7 1.4 Administrative Civil Penalties for FSA08 Licenceholders............................................8
2. Decision-Making Process for Discretionary Civil Penalties ................................................8
3. Staged Approach ................................................................................................................9 3.1 Stage One – Identification.........................................................................................10 3.2 Stage Two – Determination ......................................................................................11 3.3 Stage Three – Calculation..........................................................................................12 3.3.1 Determining the applicable Penalty Level .........................................................12 3.3.2 Considering aggravating and mitigating factors................................................13 3.3.3 Ascertaining relevant income ............................................................................13 3.4 Stage Four – Implementation ...................................................................................15 3.4.1 Penalty notice and payment timeframe............................................................15 3.4.2 Publication of information.................................................................................15 3.4.3 Ongoing monitoring...........................................................................................16
4. Discount Facility................................................................................................................16
5. Appeals to the Financial Services Tribunal.......................................................................17 Appendix A – Key Factors for Consideration ...........................................................................19 Appendix B – Discretionary Civil Penalty Levels......................................................................21 Appendix C – Aggravating and Mitigating Factors...................................................................22 Appendix D – Sample Calculations ..........................................................................................23 Appendix E – Other Key Concepts...........................................................................................24 Glossary Authority Isle of Man Financial Services Authority EDMP Enforcement Decision-Making Process FSA08 Financial Services Act 2008 FSC Financial Supervision Commission IA08 Insurance Act 2008 Tribunal Financial Services Tribunal

Isle of Man Financial Services Authority First issued 1 August 2015 Page 3 of 24 Last updated 20 December 2022 Update Notes: This document was first issued by the Financial Supervision Commission (‘FSC’) on 1 August 2015. The functions of the FSC and Insurance and Pensions Authority were transferred to the Isle of Man Financial Services Authority on 1 November 2015. The following additional updates have been made:  This document was updated on 13 December 2016 as part of a rebranding exercise to reflect the transfer of functions.  This document was updated on 6 March 2017 to reflect changes to the numbering of the Financial Services Rule Book on 1 January 2017.  This document was updated on 20 December 2022 to apply to regulated entities under the Insurance Act 2008 as part of a consultation on the Insurance (Civil Penalties) Regulations 2022 and also to reference the Authority’s Enforcement Decision-Making Process (‘EDMP’).

Isle of Man Financial Services Authority First issued 1 August 2015 Page 4 of 24 Last updated 20 December 2022

1. Civil Penalties In this document ‘regulated entities’ refers to licenceholders under the FSA08 and authorised insurers, registered insurance managers and registered insurance intermediaries under the IA08. 1.1 Civil Penalties under the Financial Services Act 2008 The Financial Services Act 2008 (‘FSA08’) provides the Isle of Man Financial Services Authority (‘the Authority’) with a broad spectrum of statutory powers and responsibilities for the licensing and oversight of regulated activities carried out in or from the Isle of Man. The following actions may be taken when dealing with contraventions of the Authority’s regulatory framework:  Section 8 – Alteration of conditions of existing licences  Section 9 – Revocation or suspension of a licence  Section 10 – Declaration of persons unfit to be directors, controllers or key persons  Section 10A – Prohibitions  Section 11 – Warning notices  Section 13 – Public statements  Section 14 – Directions  Section 16 – Civil penalties. In addition to the above, the Authority may apply to the High Court for the special remedies outlined in Part 5 of the FSA08, such as the granting of an injunction or the appointment of a receiver, business manager or reporting accountant. Section 16 of the FSA08 enables the Authority to require a current or former licenceholder to pay a penalty for any contravention of the FSA08 or any prohibition or requirement imposed under the FSA08: 16 Civil penalties (1) If the Authority is satisfied that a permitted person — (a) has contravened any provision of this Act; (b) has contravened any prohibition or requirement imposed under this Act; or (c) in purported compliance with any such requirement, has furnished the Authority with false, inaccurate or misleading information, it may require the permitted person to pay a penalty in respect of the contravention. (2) The Authority shall give written notice to the permitted person concerned of any decision under subsection (1), together with a statement of the reasons for the decision. (3) The Authority may not in respect of any such contravention — (a) both require a person to pay a penalty under this section and revoke a licence issued under section 7 to carry on a regulated activity; or

Isle of Man Financial Services Authority First issued 1 August 2015 Page 5 of 24 Last updated 20 December 2022 (b) require a person to pay a penalty under this section if criminal proceedings have been commenced in respect of the contravention. (4) When setting the amount of a financial penalty, the Authority shall have regard to any regulations under subsection (5). (5) The Authority shall make such regulations as are necessary to give effect to this section with respect to — (a) the imposition of financial penalties under this section; and (b) the amount of those penalties. (6) Any amount received as a penalty shall be paid into and form part of the General Revenue of the Island. The Financial Services (Civil Penalties) Regulations 2015 (‘the Regulations’) made under section 16(5) of the FSA08 provide a framework for the imposition of both discretionary and administrative civil penalties upon current and former licenceholders: 1 Regulation Name Civil penalties for Calculation Method Regulation 5 Discretionary Regime Serious regulatory failings Discretionary penalties based on a percentage of a licenceholder’s ‘relevant income’ Regulation 6 Administrative Regime Breaches of specified administrative requirements Fixed penalties This document provides guidance to licenceholders on the operation of the Discretionary Regime and may be updated from time to time in accordance with the Authority’s Enforcement Decision-Making Process (‘EDMP’). 1.2 Civil Penalties under the Insurance Act 2008 The Insurance Act 2008 (‘IA08’) provides the Authority with a broad spectrum of statutory powers and responsibilities for the authorisation and oversight of insurers, insurance managers and insurance intermediaries who carry out business in or from the Isle of Man. The following actions may be taken when dealing with contraventions of the Authority’s regulatory framework:  Section 9 – Alteration of conditions of existing authorisations  Section 9 – Withdrawal of authorisation in respect of new business  Section 13 – Consequences of not complying with capital requirements  Section 26 – Cancellation or restriction of registration for insurance managers and insurance intermediaries  Section 29 – Declaration of persons unfit to be directors, controllers or key persons  Section 29A – Prohibitions

1 Any reference in this document to ‘regulations’ refers to a provision of either or both of the Financial Services (Civil Penalties) Regulations 2015 or the Insurance (Civil Penalties) Regulations 2022, as applicable.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 6 of 24 Last updated 20 December 2022  Section 29C – Prohibitions: variation and revocation  Section 29E – Warning notices  Section 33 – Residual powers to impose requirements  Section 34 – Public statements  Section 37 – Civil penalties. In addition to the above, the Authority may apply to the High Court for the special remedies outlined in Part 9 of the IA08, such as the granting of an injunction or the appointment of a receiver, business manager or reporting accountant. Section 37 of the IA08 enables the Authority to require a current or former authorised insurer, registered insurance manager or registered insurance intermediary to pay a penalty for any contravention of a requirement imposed under the IA08: 37 Civil penalties (1) A penalty of such amount as the Authority considers appropriate may be imposed on a person by the Authority if the Authority considers that the person has acted in contravention of a requirement imposed on that person by or under this Act. (2) If a penalty is imposed under subsection (1) and the Supervisor considers that the relevant contravention was caused or permitted by a controller, director, chief executive or senior manager of the person on whom the penalty is imposed, the Supervisor may in addition impose a penalty of such amount as the Supervisor considers appropriate on the controller, director, chief executive or senior manager. (3) Where the Authority intends to impose a penalty, the Authority shall give notice in writing to the person concerned giving particulars of the alleged contravention, the amount of the penalty and the reasons for the decision (4) If the person concerned does not appeal the decision under section 45, the penalty shall be paid to the Treasury within such period as may be prescribed. (5) If the person concerned does appeal the decision under section 45 and on the determination of the appeal a penalty of any amount is payable, that penalty shall be paid to the Treasury within 14 days of the determination of the appeal. (6) Where the person concerned fails to pay the penalty, it may be collected by the Treasury as a civil debt due to it. (7) Any amount received in respect of a penalty levied under this section shall be paid into and form part of the General Revenue of the Island. (8) This section is in addition to and not in derogation of any other provision of this Act that confers a power or provides for a contravention to be an offence. The Insurance (Civil Penalties) Regulations 2022 (‘the Regulations’) made under section 50(1) of the IA08 provide a framework for the imposition of discretionary civil penalties upon authorised insurers, registered insurance managers and registered insurance intermediaries:

Isle of Man Financial Services Authority First issued 1 August 2015 Page 7 of 24 Last updated 20 December 2022 Regulation Name Civil penalties for Calculation Method Regulation 5 Discretionary Regime Serious regulatory failings Discretionary penalties based on a percentage of a regulated entities’ ‘relevant income’ This document provides guidance to regulated entities on the operation of discretionary penalties and may be updated from time to time in accordance with the Authority’s EDMP. 1.3 Discretionary Civil Penalties Prior to expansion of the civil penalties framework for FSA08 licenceholders in 2015, the Authority had only made Regulations for the imposition of administrative civil penalties for the late submission of returns under the FSA08. The implementation of the Discretionary Regime provided the Authority with an additional disciplinary measure for dealing with serious matters of non-compliance. In order to achieve consistency of approach across regulated sectors, a decision was taken in 2022 to extend the Discretionary Regime to cover regulated entities under the IA08. The core principle behind discretionary civil penalties is to enable the imposition of punitive financial sanctions upon regulated entities for serious contraventions of the FSA08 and IA08. Such penalties are a disciplinary measure that may be applied to regulated entities in appropriate circumstances, and may serve as a general deterrent for the wider financial services sector. Discretionary civil penalties are not intended to apply to isolated, technical or administrative breaches in the absence of a more fundamental failing that otherwise calls into question the suitability of a regulated entity to carry on regulated activity in or from the Isle of Man. The Authority will consider the use of discretionary civil penalties for serious regulatory failings as it does for other regulatory action such as directions, conditions, warning notices, prohibitions, revocations etc. The imposition of such penalties may be deemed appropriate where regulatory action such as licence or authorisation revocation or prohibition of key persons is either considered to be too harsh a response or not in the best interests of relevant parties, e.g. a licenceholder’s clients, an insurer’s policyholders or the public in general. Discretionary civil penalties may be used in conjunction with other regulatory actions where necessary in order to meet the Authority’s regulatory objectives. A decision to impose a discretionary civil penalty will not necessarily preclude the use of complementary regulatory actions where these are considered a proportionate response to the regulatory failing in question. The Authority recognises the potential financial and reputational impact of discretionary civil penalties upon regulated entities, and the corresponding importance of having suitably robust internal procedures for the administration of the framework in a fair, effective and

Isle of Man Financial Services Authority First issued 1 August 2015 Page 8 of 24 Last updated 20 December 2022 proportionate manner. Decisions to impose a discretionary civil penalty are therefore taken under the EDMP. 2 1.4 Administrative Civil Penalties for FSA08 Licenceholders The Administrative Regime for FSA08 licenceholders has been carried over from the Financial Services (Civil Penalties) Regulations 2011 and operates separately to the Discretionary Regime explained in the remainder of this document. The administrative civil penalties have not changed since 1 January 2012. Breaches of specified administrative requirements, such as the late submissions of returns, are relatively straightforward to identify. Administrative civil penalties operate on a strict rules-based approach, subject to the Authority retaining the right to waive such penalties in truly exceptional circumstances. The decision to impose a civil penalty for a breach of an administrative requirement does not follow the same enforcement process as discretionary civil penalties. Currently no regulations have been made in respect of imposing administrative civil penalties under the IA08. 2. Decision-Making Process for Discretionary Civil Penalties The decision to impose a discretionary civil penalty upon a regulated entity for a serious regulatory failing in accordance with the regulations is a discretionary power and will ultimately be determined following consideration of the relevant facts and circumstances of each case. The Authority has powers of investigation and enforcement that can be used following a breach or a pattern of breaches (e.g. civil penalties, directions, or action over the fitness and propriety of key persons). The Authority uses these powers where appropriate, however in practice many breaches of regulatory requirements are handled without the need to use such powers. The Authority considers a judgement-based approach to be the most suitable method for the imposition of discretionary civil penalties for serious regulatory failings due to the wide range of facts and circumstances that need to be taken into account. The broad nature of regulated activity carried out in (and from) the Isle of Man, coupled with the diversity of regulated entities, means that a prescriptive regime would likely prove unworkable and result in disproportionate penalties. In order to safeguard the consistency of decision-making, consideration of serious regulatory failings will be dealt with through the EDMP. The Authority seeks to take appropriate and meaningful action (where needed) against regulated entities and/or

2 https://www.iomfsa.im/enforcement/enforcement-action/

Isle of Man Financial Services Authority First issued 1 August 2015 Page 9 of 24 Last updated 20 December 2022 individuals that fail to meet the required standards and where disciplinary action will result in the advancement of the Authority’s regulatory objectives. The approach to enforcement action is tailored to each case and its specific details. Each case will vary and require different investigation techniques and disciplinary tools. However, cases that result in enforcement action will proceed through all key stages as detailed within the EDMP. Further information on the enforcement process can be found on the Enforcement Action webpage of the Authority’s website. Due to the potential impact upon regulated entities, any recommendation to impose a discretionary civil penalty for a serious regulatory failing must be supported by the Authority’s Chief Executive. The power to impose such a penalty ultimately rests with the Members of the Authority as part of the EDMP. The Authority recognises the importance of maintaining a consistent decision-making process to support the fair and effective operation of discretionary civil penalties. As such, the decision on whether or not to impose a civil penalty may be informed, amongst other things, by prior decisions made in response to earlier cases. The Authority will determine the most appropriate form of regulatory action to take following consideration of the relevant facts and circumstances. For example, under section 16(3) of the FSA08, the Authority may not both impose a civil penalty and also revoke a licence (issued under section 7) to carry on a regulated activity, nor may the Authority require a person to pay a civil penalty if criminal proceedings have been commenced in respect of the contravention. This provision illustrates the role of the EDMP in selecting the most appropriate regulatory actions in response to a serious regulatory failing, with due regard being paid to the statutory limitations on the exercise of the Authority’s regulatory powers. The EDMP involves robust internal procedures with suitable checks and balances in place to ensure fair and consistent decision-making. The effectiveness of the judgement-based approach is supported by a person’s right to appeal to the Financial Services Tribunal (‘the Tribunal’) in accordance with section 32 of the FSA08 and section 45 of the IA08. 3. Staged Approach The Authority will adopt the following staged approach when dealing with discretionary civil penalties under the Regulations:

Isle of Man Financial Services Authority First issued 1 August 2015 Page 10 of 24 Last updated 20 December 2022 3.1 Stage One – Identification The Authority has adopted a judgement-based approach for the identification of serious regulatory failings in order to cover the broad range of failings and circumstances where it may be appropriate to impose a discretionary civil penalty. It is important that the framework is sufficiently flexible to allow each case to be considered on its own facts and merits in order to ensure the proportionality of any corresponding regulatory action. For the purposes of discretionary civil penalties, a serious regulatory failing is defined as a serious contravention of the FSA08 or IA08 or any prohibition or requirement imposed under those Acts, as appropriate. The term serious is given its ordinary meaning. In a regulatory context, the concept of seriousness relates to the nature, extent and impact of the regulatory failing measured against the Authority’s regulatory objectives, which are — (1) securing an appropriate degree of protection of policyholders, members of retirement benefits schemes and the customers of persons carrying on a regulated activity; (2) the reduction of financial crime; and (3) the maintenance of confidence in the Island’s financial services, insurance and pensions industries through effective regulation, thereby supporting the Island’s economy and its development as an international financial centre. 3

3 Section 2 of the FSA08 and section 1 of the IA08. Stage Four – Implementation Penalty notice and payment Publication on website Ongoing monitoring Stage Three – Calculation Identify the Penalty Level Ascertain the relevant income Consider additional factors Stage Two – Determination Determine whether a civil penalty is the most appropriate regulatory action Stage One – Identification Identify and investigate a serious regulatory failing

Isle of Man Financial Services Authority First issued 1 August 2015 Page 11 of 24 Last updated 20 December 2022 In relation to (1) and for the avoidance of doubt, the Regulations only apply to current and former regulated entities under the FSA08 and IA08. The Regulations do not apply to regulated entities under the Retirement Benefits Schemes Act 2000. Determination of seriousness would therefore include consideration of — (a) the nature, extent and impact of the regulatory failing, e.g. the scale of any breach; (b) the relative impact upon the Authority’s regulatory objectives such as — (i) significant loss (or a risk of such loss) to customers or policyholders; and (ii) financial crime (or a significant risk of such crime); (c) the relative impact upon the Island’s reputation as an international financial centre; e.g. in terms of the fair treatment of customers or policyholders, or facilitation of financial crime; (d) the regulated entity’s particular circumstances; e.g. in terms of the regulated activities it carries on, its compliance history, any resulting implications for fitness and propriety, or improper gain as a result of the failing; and (e) comparative practices within the financial services sector. A series of breaches of Isle of Man financial services legislation may amount to a serious regulatory failing where those breaches are a result of a fundamental deficiency in a regulated entity’s compliance arrangements. Where the Authority becomes aware of a serious regulatory failing it will seek to gather as much information on the matter as possible in order to assess the nature, extent and impact of that failing in the context of both the Authority’s regulatory objectives and the relevant circumstances. Substantive communication between the Authority and regulated entities is anticipated to enable the accurate and consistent determination of matters that may warrant the imposition of a discretionary civil penalty. Serious regulatory failings are, by their very nature, likely to require substantial remedial action that will need to be appropriately addressed by both the regulated entity and the Authority, irrespective of the form of regulatory action taken. 3.2 Stage Two – Determination The most appropriate regulatory response will depend upon the seriousness of the regulatory failing in the context of the Authority’s regulatory objectives and the relevant circumstances. Once a serious regulatory failing has been identified, the Authority will determine whether or not it is appropriate to impose a discretionary civil penalty or if some other form of regulatory action would be more appropriate. This will involve consideration of the nature, extent and impact of the regulatory failing. The Authority will have regard to the Key Factors for Consideration in Appendix A when making such a determination. These factors are not intended to be exhaustive, although they are expected to cover the most relevant matters for consideration.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 12 of 24 Last updated 20 December 2022 One aspect of determining whether a civil penalty is the most appropriate regulatory action will involve the Authority referring to the regulated entity’s most recent annual financial return and financial resources calculations to consider the potential financial consequences to the regulated entity and to third parties (including customers and creditors) of imposing the penalty. This will include an assessment of — (i) whether a regulated entity will suffer serious financial hardship as a result of having to pay a civil penalty; and (ii) whether the penalty would render the regulated entity insolvent or threaten its solvency. There may be exceptional cases where, even though a regulated entity would suffer financial hardship or face potential insolvency, the Authority considers the matter to be so serious that it remains appropriate to levy a discretionary civil penalty as a punitive disciplinary measure. However, discretionary civil penalties are not intended to destabilise firms into failure; they are punitive actions for serious misconduct which regulated entities should be able to manage. 3.3 Stage Three – Calculation 3.3.1 Determining the applicable Penalty Level Once the Authority has decided that it is appropriate to impose a discretionary civil penalty, it must then identify the applicable Penalty Level for the regulatory failing under consideration. The Regulations specify two levels of discretionary civil penalty for serious regulatory failings: Level 1 and Level 2 (‘the Penalty Levels’). Both Penalty Levels cover serious regulatory failings and together are intended to reflect the progression of severity of the factors contained within. The maximum penalty amount that may be imposed under each Penalty Level is specified as a maximum percentage of the regulated entity’s ‘relevant income’.4 For example, Level 2 covers the most serious matters and therefore allows the Authority to levy higher penalty amounts than it otherwise could for Level 1 matters. The Authority has a broad spectrum of regulatory sanctions at its disposal and does not expect to exercise its power to impose discretionary civil penalties frequently. The criteria for each Penalty Level are detailed in the Schedules to the Regulations, which is reproduced in Appendix B (using ‘regulated entity’ in place of the FSA08 and IA08 equivalents). Determination of the correct Penalty Level is important and requires assessment of the nature, extent and impact of the regulatory failing against the factors contained within each Penalty Level.

4 ‘Relevant income’ is defined in regulation 3 (Interpretation) of each of the Financial Services (Civil Penalties) Regulations 2015 and the Insurance (Civil Penalties) Regulations 2022.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 13 of 24 Last updated 20 December 2022 When considering whether or not to impose a discretionary civil penalty the Authority will pay due regard to penalties imposed in previous cases in order to achieve sufficient consistency of approach. The Authority may be informed by decisions made in previous cases but will not be bound by those decisions. No case is expected to be the same, and each will need to be considered on its own facts and merits. The calculation of discretionary civil penalties may not exceed the maximum percentage of relevant income specified in the Regulations for each Penalty Level, i.e. where the Authority decides to impose a discretionary civil penalty for a Level 1 failing, the final penalty amount may not exceed 5% of the regulated entity’s relevant income. Determination of the appropriate figure is made following consideration of the Key Factors for Consideration, which may be modified by any relevant aggravating or mitigating factors. It is anticipated that the majority of discretionary civil penalties will fall within certain percentage ranges of relevant income. For example —  Level 1 penalties are expected to fall between 3% and 5% of relevant income  Level 2 penalties are expected to fall between 6% and 8% of relevant income. However, the Regulations enable the Authority to set a penalty at any amount up to the maximum percentage of relevant income specified. This allows sufficient flexibility for the calculated penalty amount to reflect the nature, extent and impact of the serious regulatory failing and any aggravating or mitigating factors. 3.3.2 Considering aggravating and mitigating factors Once the Authority has determined the appropriate Penalty Level it must then consider any aggravating or mitigating factors to determine an appropriate penalty amount within the scale for that Penalty Level. A table of aggravating and mitigating factors is included at Appendix C (‘the Aggravating and Mitigating Factors’). These factors are expected to cover the most relevant matters in a regulatory context but are not intended to be exhaustive. Sufficient aggravating factors would result in the calculation of a higher penalty amount, whereas sufficient mitigating factors should result in the calculation of a lower penalty amount. For consistency of calculation, the discretionary civil penalty will be calculated using a whole percentage figure within the applicable Penalty Level and rounded up to the nearest Pound Sterling. 3.3.3 Ascertaining relevant income The key concepts used to ascertain a regulated entity’s relevant income are defined in the Regulations.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 14 of 24 Last updated 20 December 2022 The regulated entity’s relevant income will form the basis for the initial calculation of any discretionary civil penalty. Regulated entities are already required to provide the Authority with a copy of their audited annual financial statements as part of their annual financial return as soon as it is available and, in any case, within four months of the annual reporting date for a regulated entity under the FSA08 or within six months for a regulated entity under the IA08. 5 Where the annual financial return for the relevant period has not been provided, the Authority will liaise with the regulated entity to ensure that the relevant accounting information is obtained as soon as possible. Where it is not possible to obtain the relevant financial information by the date prescribed in the Regulations, the Authority may exercise its discretion to either — (a) postpone the imposition of a penalty until such information becomes available; or (b) appoint a reporting accountant in accordance with section 23 of the FSA08 and section 1A of Schedule 5 to the IA08. For entities regulated under the FSA08, relevant income is derived from the turnover of the relevant business line(s). The Authority recognises, however, that serious regulatory failings may not be solely attributable to a specific business line. Such failings are, by their very nature, expected to cut across a licenceholder’s regulated activities. Nevertheless, some flexibility in the determination of relevant income is permitted by the Regulations to ensure that the calculation of a discretionary civil penalty is proportionate to the failing under consideration. The Authority does not currently impose a requirement upon licenceholders to include a breakdown of the annual turnover for each regulated activity in the annual financial returns made under the Rule Book. As such, where it is possible to attribute a regulatory failing to a particular business line the licenceholder should provide the Authority with an audited financial breakdown of the relevant turnover element if it has not already been made available. The Authority may request a breakdown under section 23 of the FSA08 where the licenceholder’s annual financial statements do not include a satisfactory breakdown. In cases where a failing affects all regulated activities undertaken, or where a licenceholder is unable to provide the Authority with an audited breakdown of the annual accounting turnover for the relevant business line (where the licenceholder has not been exempted from audit requirements), the annual turnover of all regulated activities carried on by that licenceholder shall be deemed relevant income for the purposes of the initial civil penalty calculation. Licenceholders who have been exempted from audit requirements should supply information that has been verified/attested by its board of directors (or equivalent governing body). Illustrative calculations for three different relevant income scenarios are included at Appendix D. Guidance on other key concepts is included at Appendix E to further assist regulated entity’s understanding of the Discretionary Regime in a regulatory context.

5 Rule 2.8 of the Financial Services Rule Book 2016 and section 14(3) of the IA08.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 15 of 24 Last updated 20 December 2022 3.4 Stage Four – Implementation 3.4.1 Penalty notice and payment timeframe Following a decision by the Members of the Authority to impose a discretionary civil penalty at the calculated rate, the Authority will give written notice to the regulated entity concerned of the decision to impose a penalty as soon as possible. The penalty notice will include details of — (i) the discretionary civil penalty imposed, the calculation method and the payment timeframe; (ii) the Authority’s reasons for imposing the discretionary civil penalty; (iii) any corresponding enforcement action to be taken (where appropriate); (iv) any corresponding remediation to be undertaken (where appropriate); and (v) the regulated entity’s right to appeal to the Financial Services Tribunal under section 32 of the FSA08 and 45 of the IA08. An invoice will be issued for the amount of the discretionary civil penalty imposed along with the penalty notice. The Regulations state that, where a penalty notice has been given, the penalty must be paid within 90 business days of — (a) if no appeal under section 32 of the FSA08 or section 45 of the IA08 is made within the period prescribed for the purposes of such an appeal, the expiry of that period; or (b) if there is an appeal under section 32 of the FSA08 or section 45 of the IA08 — (i) where the appellant abandons the appeal, the date of abandonment; or (ii) where the decision of the Authority is confirmed, the date of confirmation; or (iii) where the decision of the Authority is varied, such date as the Tribunal constituted under section 32 of the FSA08 or section 45 of the IA08 directs. The Regulations also specify a payment timeframe of 90 business days or by a later date as specified by the Authority in writing. The latter provision is to allow for circumstances in which a longer payment timeframe is necessary. Delayed or non-payment of a discretionary civil penalty imposed for a serious regulatory failing would be regarded as a serious matter and may prompt the Authority to consider the use of additional enforcement measures. This may involve a review of the fitness and propriety of any key persons involved or, in extreme cases, licence revocation. 3.4.2 Publication of information The publication of information in relation to the imposition of a discretionary civil penalty is a key element of the Discretionary Regime as such penalties may serve as a general deterrent to the regulated sector in order to reduce the likelihood of similar failings occurring in the future.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 16 of 24 Last updated 20 December 2022 Limited details of discretionary civil penalties imposed by the Authority will be published on the Authority’s website in accordance with section 30 of the FSA08 and section 34 of the IA08. This will comprise a press release on the Authority’s homepage in addition to an entry in the log of discretionary civil penalties maintained on the enforcement action section of the website. Details of discretionary civil penalties imposed would include — (i) the name of the regulated entity subject to the discretionary civil penalty; (ii) the amount of the discretionary civil penalty; and (iii) a brief description of the nature of the serious regulatory failing for which the discretionary civil penalty was imposed. For avoidance of doubt, the Authority will not publish details of a discretionary civil penalty imposed until — (a) if no appeal under section 32 of the FSA08 or section 45 of the IA08 is made within the period prescribed for the purposes of such an appeal, the expiry of that period; or (b) if there is an appeal under section 32 of the FSA08 or section 45 of the IA08 — (i) where the appellant abandons the appeal, the date of abandonment; or (ii) where the decision of the Authority is confirmed, the date of confirmation; or (iii) where the decision of the Authority is varied, such date as the Tribunal constituted under section 32 of the FSA08 or section 45 of the IA08 directs. This would not preclude the Authority from making a public statement under section 13 of the FSA08 or section 35 of the IA08 in relation to the regulatory failing where this is deemed to be in the public interest. The Authority’s power to make a public statement is distinct from both the power to publish information (section 30 of the FSA08 or section 34 of the IA08) and the power to impose a civil penalty (section 16 of the FSA08 or section 37 of the IA08). Entries in the press release history and in the log will be kept for a maximum of 5 years before being removed. This period ties in with the rehabilitation period for fines dealt with under the Rehabilitation of Offenders Act 2001. 3.4.3 Ongoing monitoring The Authority will continue to monitor a regulated entity’s compliance with its licence or authorisation obligations following imposition of any discretionary civil penalty. Particular focus will be given to the carrying out of any agreed remediation plan to ensure that it is completed in a timely manner and to the Authority’s satisfaction. 4. Discount Facility

Isle of Man Financial Services Authority First issued 1 August 2015 Page 17 of 24 Last updated 20 December 2022 The Regulations allow the Authority to apply a 30% reduction to a discretionary civil penalty where a regulated entity co-operates with the Authority in respect of any proceedings or investigation into the serious regulatory failing and takes appropriate steps to remedy that failing to the Authority’s satisfaction.6 This discount provision is intended to encourage co-operation with the enforcement process and any ongoing monitoring to achieve a prompt and effective resolution of the regulatory failing, which is in the interest of all parties concerned. In determining whether a regulated entity is eligible for a discount off a discretionary civil penalty imposed, the Authority will consider matters such as — (a) the efficiency of any remediation undertaken by the regulated entity upon identification of a serious regulatory failing, including quickly and effectively bringing the matter to the Authority’s attention; and (b) the nature and extent of the regulated entity’s co-operation with the Authority in respect of the enforcement process and any corresponding investigation or ongoing monitoring; and (c) whether the serious regulatory failing has been remedied — (i) before the Authority’s decision to impose a discretionary civil penalty; or (ii) within 90 business days (or other payment timeframe agreed by the Authority) of the discretionary civil penalty being imposed. For the avoidance of doubt, determination of the regulated entity’s co-operation with the enforcement process and any corresponding investigation is made irrespective of their right or intention to appeal the Authority’s decision to impose a civil penalty under section 16 of the FSA08 or section 37 of the IA08. Where the Authority has decided to apply a 30% discount it will either — (i) where the discretionary civil penalty has not yet been paid, issue a revised invoice; or (ii) where payment of the discretionary civil penalty has already been made, arrange for a refund of the discount amount to the regulated entity. Illustrative calculations for discounted penalties are included at Appendix D. 5. Appeals to the Financial Services Tribunal In accordance with section 32 of the FSA08 and section 45 of the IA08, an appeal may be made to the Financial Services Tribunal (‘the Tribunal’) in respect of a decision of the Authority to impose a civil penalty (either discretionary or administrative). Section 32 of the

6 For avoidance of doubt, under the Regulations a 30% discount is either applied or it is not. The percentage cannot be altered. By contrast, regulation 5(4) of the Anti-Money Laundering and Countering the Financing of Terrorism (Civil Penalties) Regulations 2019 allow for a penalty to be reduced by ‘up to 30%’.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 18 of 24 Last updated 20 December 2022 FSA08 specifies the decisions of the Authority that may be appealed. The Tribunal has the power to confirm, vary or revoke the decision in question. The ability of regulated entities to appeal to the Tribunal is key to the fair operation of the Discretionary Regime. The appeals process is an important mechanism alongside the Regulations, published guidance and the Authority’s internal procedures for achieving due process, fairness and consistency in the operation of the Discretionary Regime. Where a regulated entity does not agree with the Authority’s decision to impose a civil penalty, it may instigate the appeals procedure under the Tribunals Act 2006 and section 32 of the Financial Services Act 2008 or section 45 of the IA08. Accordingly, the payment timeframe (see 3.4.1) and the publication of information (see 3.4.2) in relation to the civil penalty will be deferred until the outcome of the appeal is known. An appeal may be made to the High Court, in accordance with rules of court, on a question of law from any decision of the Tribunal.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 19 of 24 Last updated 20 December 2022 Appendix A – Key Factors for Consideration Key Factors for Consideration Seriousness The overall seriousness of the regulatory failing. Customer loss The nature, extent and impact of any significant loss to customers (or a risk of such loss) as a result of the regulatory failing. Financial crime Whether the regulatory failing resulted in financial crime (or a significant risk of such crime). Reputation The nature, extent and impact of any damage to the reputation of the Isle of Man and its status as an international financial centre as a result of the regulatory failing. Affordability The potential financial consequences to the regulated entity and to any third parties (including customers and creditors of the regulated entity) of imposing a discretionary civil penalty. Fitness and propriety Matters of fitness and propriety relating to Key Persons and other staff of a regulated entity, for example — (a) is there evidence of negligent or reckless behaviour? (b) is there evidence that the regulated entity was aware a breach would result from the action taken? (c) has there been a deliberate attempt to conceal a breach or withhold pertinent information from the Authority (e.g. information that shows the true seriousness of the regulatory failing)? Fundamental failings The nature, extent and impact of any weaknesses in — (a) the regulated entity’s corporate governance (if applicable); (b) the regulated entity’s systems or internal controls; or (c) the fitness and propriety of any of the regulated entity’s directors, controllers or Key Persons, Such failings may relate to all or part of the business and result in multiple breaches of legislation. Improper gain The nature, extent and impact of any benefit obtained (or loss mitigated) as a result of the regulatory failing. Breaches of legislation The nature, extent and impact of any breaches of primary and secondary legislation incurred as a result of the regulatory failing. Identification The length of time between occurrence of the regulatory failing (if possible to discern) and its identification by the regulated entity or the Authority. Notification The length of time the regulated entity was aware of the regulatory failing prior to notifying the Authority and the circumstances surrounding notification. Remediation The extent to which the regulated entity has attempted to address the regulatory failing and the efficiency of any remedial action taken.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 20 of 24 Last updated 20 December 2022 Key Factors for Consideration Compliance record Whether the regulatory failing (or a similar failing) has occurred previously. Other cases Discretionary civil penalties imposed by the Authority in other cases.

Isle of Man Financial Services Authority First issued 1 August 2015 Page 21 of 24 Last updated 20 December 2022 Appendix B – Discretionary Civil Penalty Levels Discretionary Civil Penalty Percentage of relevant income Level 1 A penalty may be imposed at this level in cases where there has been a serious regulatory failing where any of the following factors are present but none of the factors in Level 2 are present — (a) the serious regulatory failing has resulted in a risk of significant loss to any of the regulated entity’s customers; (b) the serious regulatory failing has resulted in a significant risk of financial crime; or (c) the serious regulatory failing is attributable to serious negligence by any of the regulated entity’s directors, controllers or key persons. Up to 5% Level 2 A penalty may be imposed at this level in cases where there has been a serious regulatory failing where any of the following factors are present — (a) the serious regulatory failing has resulted in a significant loss to any of the regulated entity’s customers; (b) the serious regulatory failing has resulted in financial crime; (c) the serious regulatory failing was incurred deliberately by any of the regulated entity’s directors, controllers or key persons in order to obtain a benefit or mitigate a loss; (d) any of the regulated entity’s directors, controllers or key persons have attempted to conceal the serious regulatory failing from the Authority; or (e) the serious regulatory failing is attributable to serious deficiencies in any of — (i) the regulated entity’s corporate governance (if applicable); (ii) the regulated entity’s systems and internal controls; or (iii) the fitness and propriety of any of the regulated entity’s directors, controllers or key persons. Up to 8%

Isle of Man Financial Services Authority First issued 1 August 2015 Page 22 of 24 Last updated 20 December 2022 Appendix C – Aggravating and Mitigating Factors Aggravating Factors Mitigating Factors Nature, extent and impact of the regulatory failing Significant damage to the reputation of the Isle of Man (or a risk of such damage) Little or no damage to the reputation of the Isle of Man (or little risk of such damage) The results of the failing are persistent or long-lived The results of the failing are isolated or short-lived Increased risk of the financial failure of the regulated entity Little or no risk of the financial failure of the regulated entity Financial crime Increased risk of financial crime such as money laundering or terrorist financing Little or no risk of financial crime such as money laundering or terrorist financing Customers Adverse impact upon customers (e.g. significant loss or a risk of such loss) Little or no adverse impact upon customers (e.g. no significant loss or no risk of such loss) Fitness and propriety The failing has been incurred deliberately, negligently or recklessly The failing is inadvertent or a result of genuine error The failing was within the regulated entity’s control (possibly senior staff involved) The failing was wholly or partly outside the regulated entity’s control Competency Indications of lack of competence in the handling of the situation Indications that the situation has been handled competently The failing was not identified by the regulated entity in the first instance (e.g. it was identified by the Authority or an auditor etc.) The failing was identified by the regulated entity in the first instance (e.g. not by the Authority or an auditor etc.) Slow and/or inadequate remedial action Prompt and/or effective remedial action Fundamental issues Lack of, or inadequate procedures or controls (e.g. other similar matters have been handled inappropriately) Generally adequate procedures and controls (e.g. other similar matters have been handled appropriately) The serious regulatory failing has recurred (e.g. repetition of the same breach) or has remained unaddressed or uncorrected once the regulated entity became aware of it The serious regulatory failing is an isolated incident and has been addressed and corrected once the regulated entity became aware of it Numerous breaches of different types which could indicate fundamentally weak controls or poor compliance Breaches of specific regulatory requirements only but with otherwise good compliance

Isle of Man Financial Services Authority First issued 1 August 2015 Page 23 of 24 Last updated 20 December 2022 Appendix D – Sample Calculations Sample Calculations Example Relevant Income (RI) Level 1 – Up to 5% RI Level 2 – Up to 8% RI Max. Penalty (5% RI) Max. Penalty (Reduced by 30%) Max. Penalty (8% RI) Max. Penalty (Reduced by 30%) £1,000,000,000 £50,000,000 £15,000,000 £80,000,000 £56,000,000 £500,000,000 £25,000,000 £17,500,000 £40,000,000 £28,000,000 £100,000,000 £5,000,000 £3,500,000 £8,000,000 £5,600,000 £25,000,000 £1,250,000 £875,000 £2,000,000 £1,400,000 £10,000,000 £500,000 £350,000 £800,000 £560,000 £5,000,000 £250,000 £175,000 £400,000 £280,000 £1,000,000 £50,000 £35,000 £80,000 £56,000 £750,000 £37,500 £26,250 £60,000 £42,000 £500,000 £25,000 £17,500 £40,000 £28,000 £250,000 £12,500 £8,750 £20,000 £14,000 £100,000 £5,000 £3,500 £8,000 £5,600 £50,000 £2,500 £1,750 £4,000 £2,800 £10,000 £500 £350 £800 £560

Isle of Man Financial Services Authority First issued 1 August 2015 Page 24 of 24 Last updated 20 December 2022 Appendix E – Other Key Concepts Various concepts are included in this document that may benefit from further clarification. As with the general concept of seriousness detailed in 3.1 of the Guidance Note, most of these concepts are exemplified by their relative applicability to different situations and circumstances. In adopting a judgement-based approach to the imposition of discretionary civil penalties for serious regulatory failings, the Authority believes that any attempt to define such concepts beyond their common meaning would be both impractical and counterintuitive. A list of common definitions for the key concepts contained within this document are detailed below for guidance purposes: Concept Common Definition Competence The quality of being competent; adequacy; possession of required skill, knowledge, qualification, or capacity Deliberate Done consciously and intentionally Inadvertent Not resulting from or achieved through deliberate planning; unintentional (Of a mistake) Made through lack of care; negligent Isolated Separated from other persons or things; alone; solitary Negligent Guilty of or characterised by neglect, as of duty; i.e. – (a) to pay no attention or too little attention to; disregard or slight (b) to be remiss in the care or treatment of (c) to omit, through indifference or carelessness (d) to fail to carry out or perform (orders, duties, etc…) (e) to fail to take or use Persistent Persisting, especially in spite of opposition, obstacles, discouragement, etc.; persevering Lasting or enduring tenaciously Constantly repeated; continued Reckless (Of a person or their actions) Without thinking or caring about the consequences of an action Significant Important; of consequence Having or expressing a meaning; indicative; suggestive Statistics. of or relating to observations that are unlikely to occur by chance and that therefore indicate a systematic cause Uncorrected Left faulty or wrong