Alison McHaffie’s Financial Services Investigations and Enforcement Column: December 2016

30/01/2017

What a difference a year makes. A look back at FCA enforcement activity in 2016 reveals a dramatic drop both in the number and the size of financial penalties being imposed by the FCA. After the huge penalties imposed for attempted benchmark manipulation, total fines this year have dropped from over £900 million at the end of 2015 to around £22 million by the beginning of December this year. While it was always expected that the benchmark fines were likely to be a high water mark, what is interesting is the drop in published enforcement actions overall. Is this a temporary blip while new management takes stock and new processes embed or a turning point in FCA’s approach to enforcement?

A move to constructive deterrence?

As far back as October 2015, Tracey McDermott, the then acting FCA CEO, indicated that the volume of regulatory activity over recent years was not sustainable for regulators or for the industry. The FCA’s recently published mission consultation reflects on this too, in seeking to move on from what it terms the “conduct crisis” of PPI, benchmarks, interest hedging rate products (IRHPs) and financial crime. Perhaps the change we are seeing is best summed up in the FCA Chairman’s use of the phrase of “constructive deterrence” in the introduction to this year’s FCA Business Plan, in which he explains that the best form of regulation is seeking to prevent things from going wrong in the first place through proactive engagement. This is a theme which is also echoed in the mission consultation. Certainly, my experience of helping firms deal with problems in their businesses is that the FCA is now more willing to engage constructively with firms which notify issues and to support them in putting things right rather than necessarily seeing it as a reason to refer the firm to enforcement for investigation.

So while there have been fewer enforcement cases resulting in the headline grabbing fines, it does not necessarily mean that there has been a drop in regulatory activity. It does appear that more issues are being dealt with outside of formal enforcement processes through intensive supervision with firms working to correct control failings and remediate customers where detriment may have been suffered. The FCA itself has pointed to the amount of remediation work being undertaken by firms and highlighted as an example the long running IRHP review scheme, completed this year, which the banks voluntarily adopted and which has delivered over £2 billion of redress. This could be seen as evidence not just of a change in approach from the FCA moving away from the unfortunate “shoot first ask questions later” mantra of Andrew Bailey’s predecessor, but one of cultural change at the firms themselves which are now more inclined proactively to identify and address problems and deal constructively with the regulators in putting things right.

Themes from 2016 enforcement actions

Notwithstanding the significant drop off in public enforcement outcomes, there are still some themes to emerge from the action that has been taken in 2016.

We have seen the FCA continue to bring actions against firms for breaches of Principle 11, reinforcing the importance it places on firms being open and transparent with their regulators (see the Sonali Bank final notice and Millburn Insurance Company final notice). It has been apparent for some time that, whenever a firm notifies an issue to the FCA, there will be questions over when it was first identified and whether it could or should have been identified or notified earlier. A failure in this area is much more likely to mean a referral to enforcement than if a firm promptly identified the issue and notified. So it is not surprising to see Principle 11 breaches featuring in FCA cases this year. The number of firms the FCA regulates has almost doubled to around 56,000 since it took on responsibility for the regulation of consumer credit and this means it necessarily relies on firms bringing matters to its attention. This is not just a responsibility for firms, but one for senior management too; the FCA also fined a senior bank executive in February this year (see the Achilles Macris final notice) for a breach of the equivalent principle for approved persons, Statement of Principle 4.

A review of the financial penalties imposed by the FCA this year reveals relatively few cases brought against firms, just eight in total (including one listing rule case, Cenkos Securities). Three of these related to client money and asset breaches, so it is clear that Principle 10 and the need for firms to take adequate care to protect client assets in the wake of the financial crisis continues to be important for the FCA (see the Aviva final notice, Towergate final notice and Coverall Worldwide final notice). These cases are good examples of the FCA taking action where there may have been no customer detriment but firms’ arrangements have exposed clients to the risk of financial loss. It is also interesting to note that the Aviva case was the first client asset case concerning issues surrounding the oversight of outsourced arrangements. This is part of a wider focus over the importance of ensuring effective oversight over outsourced providers and the FCA reminding the market that the firm outsourcing remains responsible for the regulated activities which, in the words of Mark Steward, FCA Director of Enforcement and Market Oversight, “can be delegated but not abdicated”.

Another continuing area of focus where the FCA will usually impose financial penalties or indeed issue prohibitions and/or pursue criminal prosecutions, is financial crime. This year has seen the FCA obtain a number of insider dealing convictions including further convictions in the long running Operation Tabernula investigation, and also fine Sonali Bank (UK) Ltd for failures in its AML controls. The FCA also fined W H Ireland Ltd for exposing its clients to the risk of market abuse through weak controls. Prevention of financial crime continues to be a focus for FCA, as it made clear in its Business Plan for this year, and one where it is committing to investment in technological development and data science to improve its detection of insider dealing, market manipulation and money laundering.

It seems a year cannot go by without at least one case involving PPI, and this year that was the fine on CT Capital Ltd for failures in its PPI complaints handling.With FCA proposing the deadline for bringing PPI complaints to be mid 2019 (although it is still under consultation and this may slip further), I would hope that we are reaching the beginning of the end of the PPI debacle.

Consumer credit activity

It was always anticipated that the move to regulating consumer credit would be challenging both for firms and the FCA as they got used to a new regime.Much of the regulatory activity in this sector has sofar been within Authorisation. The FCA has refused authorisation to a number of consumer credit firms and a significant number of debt management companies have left the market. On top of this, a number of consumer redress schemes have been established, and, as at April this year, the FCA reported that 23 schemes had been set up resulting in £334 million of redress to consumers.

There has been a steady stream of announcements this year, including Motormile Finance UK Ltd, a debt purchase and collections firm, for historic failures in its due diligence and collections process, and CFO Lending Ltd agreeing to provide over £34 million of redress to more than 97,000 customers for unfair practices. Much of the redress and remediation action being taken by consumer credit firms relates to historic issues with their roots dating back to before FCA regulation.

Consequently, the FCA appears to be working with firms to put in place these schemes and publicising
some of these actions, rather than taking enforcement activity and imposing financial penalties. This in
itself helps to achieve the FCA’s objective of credible deterrence and set the FCA’s expectations for the
industry going forward. However, those that don’t get their house in order and make the cultural changes required are likely to find themselves at the sharp end of enforcement in the coming years.

FCA looking beyond its remit?

Another area the FCA has grappled with this year is the extent to which it can take action for authorised firms’ unregulated activities, a line which the FCA considers has become “blurred” in recent years (see the mission consultation). This has been highlighted by its review of the treatment of SME customers in the banking sector and the LIBOR and FX investigations. We have seen the FCA, while recognising the limitations of its remit, become more willing to comment on a firm’s unregulated activities and set out its expectations.

We are likely to see the FCA continue to expect firms to act voluntarily in the same way towards their unregulated business as they do to their regulated business. Where the FCA identifies possible misconduct in unregulated activities, I think we will see the FCA take a robust view particularly where there may be issues of fraud, where it is closely linked or may affect a regulatory activity and where it may undermine confidence in the UK regulatory system. It will consider the application of prudential obligations, and/or the threshold conditions and senior management responsibility. The mission consultation contains a clear warning that while FCA’s focus will be primarily on regulated activities, it will intervene against unregulated activities on a case by case basis where there is a threat to its objectives.

Individual accountability

2016 has also not seen a noticeable uptick in the number of actions and financial penalties imposed on individuals. It is of course too early for the new responsibilities introduced by the senior managers regime (SMR) for the banking and insurance sectors which came into effect in March 2016 (see my November 2015 column) to have resulted in any enforcement action. However, since the financial crisis, the FCA has been speaking about the increased expectations on personal accountability and the way it routinely looks into individuals’ roles when something goes wrong at a firm, so it is perhaps surprising that we have not seen more action in this area. While the SMR will make it clearer who has personal accountability for a particular area, the personal conduct rules themselves have changed very little when compared to those in place prior to the introduction of the new regime. However, cases against individuals are generally harder fought and it may just be that these are taking the FCA longer to investigate.

Of the 14 financial penalties imposed on individuals to date in 2016, five of these related to a specific
investigation into failings over the provision and validity of solicitors’ professional indemnity insurance
(PII) and provide good illustrations of what a diligent executive should (and definitely should not) do (see Legal update, FCA and PRA enforcement action relating to solicitors' PII and other insurance schemes' failures). Of the remainder, two of the actions were announced at the same time as the disciplinary action against the individual’s firm: the MLRO at Sonali Bank (see the Steven Smith final notice) and a director at Towergate Underwriting Group (see the Timothy Philip final notice). So there is some evidence for the FCA’s drive to enforce greater personal accountability where things go wrong in a firm’s business.

FCA procedural changes and tools

Two relatively long running reforms to the FCA enforcement process remain work in progress as
2016 draws to a close.

Firstly, as I commented on in my February 2015 column, the HM Treasury Enforcement Review report
was published at the end of 2014, making a number of recommendations that are gradually being implemented, but are not yet all in force. One of the earliest developments arising from the review was the FCA’s publication of new enforcement referral criteria in 2015. We are starting to see this take effect. So while it is true that the FCA now appears to be more willing to work with firms outside of formal enforcement, it also does not mean that all firms being referred for investigation will ultimately find themselves the subject of formal disciplinary action. The FCA has stressed this in its mission consultation, saying that it wants to get away from a referral to enforcement being misunderstood as a decision to initiate enforcement proceedings when it is in fact just a decision to investigate which may or may not result in enforcement proceedings. Certainly, this is a helpful clarification of what is actually the position as a number of investigations are closed each year with no action being taken. It does appear that this is becoming more common. It is perhaps evidence of the FCA shifting towards a model of investigating more frequently, but choosing the cases that go into the later stages of enforcement more selectively.

Work would seem to be ongoing at the regulators on implementing the other recommendations arising from the review. Many involve relatively minor revisions to the enforcement process, in particular to improve its transparency and timing. Some are easily implemented and do not require rule changes. Some more significant proposed reforms, such as the introduction of a new and streamlined “focused resolution” procedure, remain in the pipeline. The FCA and PRA consulted jointly in April 2016 (in FCA CP16/10 / PRA CP14/16) on measures to implement the remaining reforms. The consultation closed in July 2016. A policy statement has not yet been published, but will hopefully appear early in the New Year and close out this long-running review.

Secondly, there appears to have been no further progress made on the FCA’s promised review of its penalty setting framework since the announcement of its intention in late 2014, on which I commented in my March 2016 column. In that column, I also commented on the use of restrictions instead of, or in conjunction with, financial penalties, as a disciplinary tool. There have been two examples this year: WH Ireland and the restriction imposed on Sonali Bank from accepting deposits from new customers for 168 days. Again, while an interesting development, and one the FCA is likely to continue to use in future, I think we are unlikely to see this being adopted in preference to financial penalties or on a significant scale.

Despite the relatively slow progress of the reforms, I believe that they are a change for the better. A few years ago, other than in certain types of market conduct cases, the prospects for firms being able to convince the FCA there was no case to answer once the decision to investigate had been taken were often slim. This is no longer right. However, while I am pleased to see that the FCA now comes to its investigations with a more open mind and the confidence to close investigations where appropriate, there is a danger that more firms will be referred to investigation for matters which could simply be resolved outside of a formal process, so causing firms additional cost and unnecessary concern. This is all the more concerning where the FCA chooses to publicise, in a statement, a referral for investigation as it did earlier this year with the six firms referred in respect of the treatment of the treatment long term customers in the life insurance sector. While FCA can, and did, make it clear it was only an investigation, and this step was required because of some of the firms or their holding company being listed, to the outside world this does still suggest there is misconduct when this has not been found. The announcement of the names of firms under investigation sets an unwelcome and unfair precedent in this regard. It is important that, in its drive for greater transparency, the FCA does not overstep the mark causing reputational damage and unfair speculation over a firm’s conduct.

A long and winding road

Recent experience does, however, suggest that the FCA investigation process is slowing down. This can be a frustration for many firms under investigation. The most recent Enforcement Performance Account seems to bear my personal experience out, with the average length of settled cases extending to over 25 months in 2015/16 compared to 16 months in the year before.

While of course it is right that due process is followed, and there will always be complex cases which take longer to resolve, there is a concern that either resource constraints or perhaps new internal processes are having a detrimental impact on the prompt resolution of cases within the FCA enforcement division. Of course this slowdown is also likely to have had an impact on the enforcement figures for the year and means I cannot simply conclude that enforcement are taking on fewer cases.

A turning point?

I began this column by asking if 2016 was a turning point in FCA’s approach to enforcement or just a year of taking stock. The answer is probably somewhere in between. Certainly, there is hope for the regulated community that a line is now being drawn under the financial and conduct crisis which has dominated FCA enforcement activity over the past few years. There does appear to be a greater willingness for firms and the regulators to work together in putting things right without the need for the big stick of enforcement. However, “credible” (or, perhaps more accurately today “constructive") deterrence is here to stay. So I do expect to see more enforcement cases brought in 2017 than in 2016, as the change in FCA senior management and in its procedures takes effect, both as a deterrent and to support the FCA’s areas of thematic concerns and priorities.

We may also see the FCA being more transparent about its activities outside of formal enforcement
action, although I would hope that this will not extend to publicising referrals to investigation except in
exceptional circumstances. Where the FCA does take enforcement action, I expect it to act decisively, looking to senior management as well as the firm, and with heavy penalties, although perhaps not of the eyewatering amounts we have seen in the recent past. Unless, of course, a new scandal emerges.