Guidance on the duty of responsibility: final amendments to the Decision Procedure and Penalties Manual

Policy Statement PS17/9 May 2017 Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual

returns you to the contents list takes you to helpful abbreviations How to navigate this document onscreen 2 PS17/9 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual Consultation Paper 16/26 which is available on our website at www.fca.org.uk/publications Comments or queries can be sent to: Harry Caldecott Enforcement and Market Oversight Division Financial Conduct Authority 25 The North Colonnade Canary Wharf London E14 5HS Telephone: 020 7066 2966 Email: cp16-26@fca.org.uk This relates to Contents 1 Overview 3 2 Responses to the issues in CP 16/26 6 Annex 1 List of non-confidential respondents 8 Annex 2 Abbreviations used in this paper 9 Appendix 1 Made rules (legal instrument)

3 PS17/9 Chapter 1 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual 1 Overview Introduction 1.1 In this paper, we set out amendments to the Decision Procedure and Penalties Manual (DEPP), to explain how we will enforce the duty of responsibility. Who does this affect? 1.2 The amendments will be of interest to firms covered by the Senior Managers Regime (SMR) and their Senior Managers. Senior Managers at UK banks, building societies, credit unions, PRA-designated investment firms, and incoming branches of overseas firms (collectively referred to as ‘banks’) have been subject to the duty of responsibility since 10 May 2016. The duty of responsibility will apply to Senior Managers at all types of firms when the SMR is extended.1 Is this of interest to consumers? 1.3 This paper will mainly be of interest to banks and their Senior Managers. However, consumers may be interested in how our approach sits within the FCA’s priority of culture and governance in firms. Context 1.4 Following recommendations by the Parliamentary Commission on Banking Standards (PCBS) in its final report on professional standards and culture in the UK banking sector, Parliament passed the Banking Reform Act. It introduced, among other things, the Senior Managers Regime (SMR), the Certification Regime, the Conduct Rules and a criminal offence relating to a decision causing a financial institution to fail. These came into force on 7 March 2016. 1.5 On 4 May 2016, Parliament passed the Bank of England and Financial Services Act 2016, which introduced the ‘duty of responsibility’. The duty of responsibility came into force on 10 May 2016. In CP16/26, we consulted on how we would enforce the duty of responsibility. 1 Senior Managers and Certification Regime: extension to all FSMA-authorised persons, Treasury white paper, October 2015.

4 PS17/9 Chapter 1 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual The SMR 1.6 The SMR applies to individuals performing a Senior Management Function (Senior Managers), specified by either the FCA or the PRA, on behalf of banks. When applying for regulatory pre-approval for an individual to perform a Senior Management Function, a bank is required to submit a Statement of Responsibilities to the regulators. This must set out the areas of the firm that the prospective Senior Manager will be responsible for managing. The firm must resubmit the Statement of Responsibilities whenever there is a significant change in the Senior Manager’s responsibilities. 1.7 Banks must also prepare a management Responsibilities Map, setting out their governance and management arrangements, and how responsibilities are allocated to individuals within the firm. When bringing enforcement action against a Senior Manager – whether under the Conduct Rules, the duty of responsibility or otherwise – the FCA will consider the Statement of Responsibilities and the firm’s management Responsibilities Map when determining the extent of the Senior Manager’s responsibilities in the firm. The duty of responsibility 1.8 Under the duty of responsibility, we and the PRA can take action against Senior Managers if they are responsible for the management of any activities in their firm in relation to which their firm contravenes a regulatory requirement, and they do not take such steps as a person in their position could reasonably be expected to take to avoid the contravention occurring (or continuing). 1.9 The duty of responsibility will apply across the financial services industry when the SMR is extended to firms outside the banking sector. 1.10 The duty of responsibility requires the regulators to prove a contravention of a regulatory requirement by the firm, and that the Senior Manager was responsible for the management of any activities in their firm in relation to which the firm’s contravention occurred. The burden of proof lies with the regulators to show that the Senior Manager did not take such steps as a person in their position could reasonably be expected to have taken to avoid the firm’s contravention occurring. The Conduct Rules 1.11 The duty of responsibility is supported by Conduct Rules. The Conduct Rules set basic standards of good conduct for certain staff. We may take disciplinary action against those staff if their conduct falls short of these standards. 1.12 A subset of the Conduct Rules applies only to Senior Managers. These include requirements that reasonable steps are taken to ensure the business of the firm is controlled effectively, that the business complies with regulatory requirements and that any delegation of responsibilities is appropriate and properly overseen. 1.13 We may take disciplinary action against a Senior Manager for breaching the Conduct Rules, being knowingly concerned in a firm’s contravention of a regulatory requirement, or for breaching the duty of responsibility, or a combination of all three.

5 PS17/9 Chapter 1 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual Summary of feedback and our response 1.14 We have made no substantive amendments to DEPP in light of the responses to CP16/26. Next steps 1.15 Enforcement’s guidance in DEPP will apply from 3 May 2017.

6 PS17/9 Chapter 2 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual 2 Responses to the issues in CP16/26 2.1 In CP16/26, we asked: Q1: Does the draft guidance in Appendix 1 provide clarity on the FCA’s proposed application of the duty of responsibility? 2.2 We received responses to CP16/26 from 11 organisations or individuals and a full list of non-confidential respondents can be found at Annex 1. 2.3 Almost all the responses we received supported our proposals. Generally, respondents thought that the guidance provided a useful insight into the considerations that we would have regard to, when taking action under the duty of responsibility. Respondents were pleased that we would not apply standards retrospectively and that we had worked closely with the PRA to ensure that our guidance on the duty of responsibility is consistent and aligned with theirs. They were pleased that a Senior Manager will not be bound by a finding of the RDC, a court or a tribunal to which they are not party or privy. They acknowledged that we, when applying the duty of responsibility, might need to look beyond a Statement of Responsibilities and a management Responsibilities Map. They told us that they expect us to take more action against senior individuals, particularly in large, complex firms. We summarise our feedback to the responses below. The Senior Manager’s duty to the customer and to society 2.4 One respondent criticised our guidance on the grounds that it does not state that a Senior Manager has a responsibility to their customers and to society. Our response Our guidance is concerned with the steps Senior Managers should take to stop their firms contravening regulatory requirements in relation to the activities that they are responsible for managing, not with identifying Senior Managers’ other obligations. DEPP 6.2.9-E G (7) does state, however, that when determining whether a Senior Manager has taken the steps reasonably expected of them, we will have regard to whether they acted in accordance with their statutory, common law and other legal obligations, including the Conduct Rules. Rule 4 of the Conduct Rules states that Senior Managers must pay due regard to the interests of customers and treat them fairly.

7 PS17/9 Chapter 2 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual Combined FCA and PRA list of considerations 2.5 One respondent thought it would be helpful if the FCA and the PRA produced a combined list of considerations, to which we would expect to have regard, when applying the duty of responsibility, and determining when someone has taken reasonable steps under the Conduct Rules. Our response We have worked closely with the PRA to ensure that our guidance on the duty of responsibility is consistent and aligned with theirs. The steps reasonably expected of a Senior Manager under our and the PRA’s guidance on the duty of responsibility are the same. Neither set of guidance is prescriptive. The steps that a Senior Manager should take to comply with the duty of responsibility will vary from case to case, depending on the circumstances. We and the PRA have taken different approaches to giving guidance on the Conduct Rules, reflecting our different approaches to guidance generally and the broader scope that the FCA has to apply the Conduct Rules. Some of the more detailed examples of non-compliant behaviour in the FCA Conduct Rules guidance will be more relevant to people who are only subject to the FCA’s regime. The publication of a combined list of considerations, to which the FCA and the PRA would expect to have regard, when applying the duty of responsibility, and determining when someone has taken reasonable steps under the Conduct Rules, is therefore unnecessary. Handovers 2.6 One respondent asked us to delete 6.2.9 E G (13), which requires the outgoing Senior Manager to take reasonable steps to ensure an orderly handover. In their view, many Senior Managers do not leave their employers on good terms, and so are unable to ensure an orderly handover. Our response Our guidance reflects COCON 4.2.8 G, in the context of SC1 of the Conduct Rules, which gives guidance on how Senior Managers might take reasonable steps to ensure that the business of the firm for which they are responsible is controlled effectively. What is reasonably expected of a Senior Manager when handing over will vary from case to case, depending on the circumstances. We have therefore not amended our guidance.

8 PS17/9 Annex 1 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual Annex 1 List of non-confidential respondents Association of British Credit Unions Limited Association for Financial Markets in Europe British Bankers Association Building Societies Association Chartered Banker Institute Company Create Solutions Limited Company Worksmart Limited Irish League of Credit Unions Lloyds Banking Group Nationwide Building Society Limited Standard Chartered Bank There were 11 respondents in total.

9 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual Annex 2 Abbreviations used in this paper used in this paper The Banking Reform Act Financial Services (Banking Reform) Act 2013 COCON The Code of Conduct for Staff (FCA Handbook) DEPP Decision Procedure and Penalties Manual (FCA Handbook) FCA Financial Conduct Authority PRA Prudential Regulation Authority RDC Regulatory Decisions Committee Senior Manager A person approved to perform a Senior Management Function SMR Senior Managers Regime We have developed the policy in this Policy Statement in the context of the existing UK and EU regulatory framework. The Government has made clear that it will continue to implement and apply EU law until the UK has left the EU. We will keep the proposals under review to assess whether any amendments may be required in the event of changes in the UK regulatory framework in the future. We make all responses to formal consultation available for public inspection unless the respondent requests otherwise. We will not regard a standard confidentiality statement in an email message as a request for non-disclosure. Despite this, we may be asked to disclose a confidential response under the Freedom of Information Act 2000. We may consult you if we receive such a request. Any decision we make not to disclose the response is reviewable by the Information Commissioner and the Information Rights Tribunal. All our publications are available to download from www.fca.org.uk. If you would like to receive this paper in an alternative format, please call 020 7066 9644 or email publications_graphics@fca.org.uk or write to Editorial and Digital Department, Financial Conduct Authority, 25 The North Colonnade, Canary Wharf, London E14 5HS PS17/9 Annex 2

10 Financial Conduct Authority Guidance on the duty of responsibility: final amendments (including feedback on CP16/26) to the Decision Procedure and Penalties Manual PS17/9 Appendix 1 Appendix 1 Made rules (legal instrument)

FCA 2017/27 INDIVIDUAL ACCOUNTABILITY (ENFORCEMENT) (DUTY OF RESPONSIBILITY) INSTRUMENT 2017 Powers exercised A. The Financial Conduct Authority makes this instrument in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 69 (Statement of policy); (2) section 139A (Power of the FCA to give guidance); and (3) section 210(1) (Statements of policy). Commencement B. This instrument comes into force on 3 May 2017. Amendments to the Handbook C. The Decision Procedure and Penalties manual (DEPP) is amended in accordance with the Annex to this instrument. Citation D. This instrument may be cited as the Individual Accountability (Enforcement) (Duty of Responsibility) Instrument 2017. By order of the Board 27 April 2017

FCA 2017/27 Page 2 of 6 Annex Amendments to the Decision Procedure and Penalties manual (DEPP) In this Annex, underlining indicates new text. 6 Penalties … 6.2 Deciding whether to take action … Action against individuals under section 66 of the Act … 6.2.6A G DEPP 6.2.6BG to DEPP 6.2.9G apply to action taken by the FCA under section 66 of the Act, except for action taken by virtue of section 66A(5). DEPP 6.2.9-AG to DEPP 6.2.9-FG apply only to action taken by virtue of section 66A(5). … 6.2.9 G … Action against an SMF manager under section 66A(5) of the Act 6.2.9-A G The FCA is able to take action against an SMF manager under section 66A(5) of the Act where: (1) there has been (or continues to be) a contravention of a relevant requirement by the SMF manager’s firm; (2) at the time of the contravention, the SMF manager was responsible for the management of any of the firm’s activities in relation to which the contravention occurred; and (3) the SMF manager did not take such steps as a person in their position could reasonably be expected to take to avoid the contravention by the firm occurring (or continuing). In such an action, an SMF manager is not bound by a finding of the RDC, a court or a tribunal, which he or she was not privy nor party to. 6.2.9-B G When deciding whether to take action further to section 66A(5) of the Act, the FCA will follow the approach in DEPP 6.2.1G and DEPP 6.2.6G. 6.2.9-C G When determining, for the purposes of section 66A(5) of the Act, whether an SMF manager was responsible for the management of any of the firm’s

FCA 2017/27 Page 3 of 6 activities in relation to which a contravention of a relevant requirement by the firm occurred, the FCA will consider the full circumstances of each case. A list of considerations that may be relevant for this purpose is set out below. This list is not exhaustive. (1) The SMF manager’s statement of responsibilities, including whether the SMF manager was performing an executive or non-executive role. (2) The firm’s management responsibilities map. (3) How the firm operated, and how responsibilities were allocated in the firm in practice. (4) The SMF manager’s actual role and responsibilities in the firm, to be determined by reference to, among other things, minutes of meetings, emails, regulatory interviews, telephone recordings and organisational charts. (5) The relationship between the SMF manager’s responsibilities and the responsibilities of other SMF managers in the firm (including any joint responsibilities or matrix management structures). 6.2.9-D G Under section 66A(5)(d) of the Act, such steps as a person in the position of the SMF manager could reasonably be expected to take to avoid the firm’s contravention of a relevant requirement occurring (or continuing) are: (1) such steps as a competent SMF manager would have taken: (a) at that time; (b) in that specific individual’s position; (c) with that individual’s role and responsibilities; and (d) in all the circumstances. 6.2.9-E G When determining under section 66A(5)(d) of the Act whether or not an SMF manager has taken such steps as a person in their position could reasonably be expected to take to avoid the contravention of a relevant requirement by the firm occurring (or continuing), additional considerations to which the FCA would expect to have regard include, but are not limited to: (1) the role and responsibilities of the SMF manager (for example, such steps as an SMF manager in a non-executive role could reasonably be expected to take may differ, depending on the circumstances, from those reasonably expected of an SMF manager in an executive role: see, for example, the guidance on the role and responsibilities of non￾executive directors for relevant authorised persons in COCON 1 Annex 1G);

FCA 2017/27 Page 4 of 6 (2) whether the SMF manager exercised reasonable care when considering the information available to them; (3) whether the SMF manager reached a reasonable conclusion on which to act; (4) the nature, scale and complexity of the firm’s business; (5) the knowledge the SMF manager had, or should have had, of regulatory concerns, if any, relating to their role and responsibilities; (6) whether the SMF manager (where they were aware of, or should have been aware of, actual or suspected issues that involved possible breaches by their firm of relevant requirements relating to their role and responsibilities) took reasonable steps to ensure that the issues were dealt with in a timely and appropriate manner; (7) whether the SMF manager acted in accordance with their statutory, common law and other legal obligations, including, but not limited to, those set out in the Companies Act 2006, the Handbook (including COCON), and, if the firm was listed on the London Stock Exchange, the UK Corporate Governance Code and related guidance; (8) whether the SMF manager took reasonable steps to ensure that any delegation of their responsibilities, where this was itself reasonable, was to an appropriate person with the necessary capacity, competence, knowledge, seniority and skill, and whether the SMF manager took reasonable steps to oversee the discharge of the delegated responsibility effectively; (9) whether the SMF manager took reasonable steps to ensure that the reporting lines, whether in the UK or overseas, in relation to the firm’s activities for which they were responsible, were clear to staff and operated effectively; (10) whether the SMF manager took reasonable steps to satisfy themselves, on reasonable grounds, that, for the activities for which they were responsible, the firm had appropriate policies and procedures for reviewing the competence, knowledge, skills and performance of each individual member of staff to assess their suitability to fulfil their duties; (11) whether the SMF manager took reasonable steps (including in relation to SYSC 4.9) to assess, on taking up each of their responsibilities, and monitor, where reasonable, the governance, operational and risk management arrangements in place for the firm’s activities for which they were responsible (including, where appropriate, corroborating, challenging and considering the wider implications of the information available to them), and whether they took reasonable steps to deal with any actual or suspected issues identified as a result in a timely

FCA 2017/27 Page 5 of 6 and appropriate manner; (12) whether the SMF manager took reasonable steps to ensure an orderly transition when another SMF manager under their oversight or responsibility was replaced in the performance of that function by someone else; (13) whether the SMF manager took reasonable steps to ensure an orderly transition when they were replaced in the performance of their function by someone else; (14) whether the SMF manager failed to take reasonable steps to understand and inform themselves about the firm’s activities for which they were responsible, including, but not limited to, whether they: (a) failed to ensure adequate reporting or seek an adequate explanation of issues within a business area, whether from people within that business area, or elsewhere within or outside the firm, if they were not an expert in that area; or (b) failed to maintain an appropriate level of understanding about an issue or a responsibility that they delegated to an individual or individuals; or (c) failed to obtain independent, expert opinion where appropriate from within or outside the firm as appropriate; or (d) permitted the expansion or restructuring of the business without reasonably assessing the potential risks; or (e) inadequately monitored highly profitable transactions, business practices, unusual transactions, or individuals who contributed significantly to the profitability of a business area or who had significant influence over the operation of a business area; (15) whether the SMF manager took reasonable steps to ensure that, where they were involved in a collective decision affecting the firm’s activities for which they were responsible, and it was reasonable for the decision to be taken collectively, they informed themselves of the relevant matters before taking part in the decision, and exercised reasonable care, skill and diligence in contributing to it; (16) whether the SMF manager took reasonable steps to follow the firm’s procedures, where this was itself appropriate; (17) how long the SMF manager had been in role with their responsibilities and whether there was an orderly transition and handover when they took up the role and responsibilities; (18) whether the SMF manager took reasonable steps to implement (either personally or through a compliance department or other departments)

FCA 2017/27 Page 6 of 6 adequate and appropriate systems and controls to comply with the relevant requirements and standards of the regulatory system for the activities of the firm. 6.2.9-F G Where action is taken against an SMF manager under section 66A(5) of the Act the onus will be on the FCA to show that the SMF manager has been guilty of misconduct. Action under section 63A of the Act against persons that perform a controlled function without approval …

© Financial Conduct Authority 2017 25 The North Colonnade Canary Wharf London E14 5HS Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 005429 © Financial Conduct Authority 2017 25 The North Colonnade Canary Wharf London E14 5HS Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved