FSA Update: FSA policy statement on the Year 2000

FSA policy statement on the year 2000

In October, the FSA issued a policy statement on its regulatory responsibilities and the Year 2000 problems. Many firms have already realised that the Year 2000 problem is a compliance as well as a business issue. Regulators have warned that they will consider disciplinary action against firms who do not take reasonable steps to deal with the problem, as it will

be indicative of a firm which does not have proper internal controls and has not acted with due skill, care and diligence.

The FSA's policy statement does not give any exact criteria which firms will be able to meet in order to claim a 'safe harbour' and say that they have fulfilled regulators' wishes. It does, though, explain the regulators' attitude and approach to firms who are attempting to deal with the problem:

• the FSA will use the large amount of information which it has already gathered on firms preparing for the Year 2000 to take a risk-based approach to supervision of their response to the problem;
• in the light of the information gathered and the risks which that information suggests might be inherent in a firm's approach, FSA will take whatever regulatory action is necessary and appropriate to achieve its overall statutory objectives, such as to ensure the stability of the financial system and to protect consumers.

FSA has warned that, whilst in the case of most regulated institutions it will be prepared to rely on internal assessments, there will be cases when the FSA insists on a third party assessment of the work done by an institution. There will be two circumstances when FSA is likely to require a third party report:

• when an institution is so significant in a particular market that some independent corroboration of its status will be desirable; and
• when the FSA has grounds for concern about the preparations taken by a particular institution.

It is therefore important that firms document the steps which they are taking to cope with the Year 2000 problem, and the thought processes which have lead them to take the decisions which have been made so far (and will be made in the future), so that any regulator visiting a firm will have a full audit trail to follow. By ensuring that this audit trail exists, and by ensuring that the Year 2000 problem appears on the agenda at management meetings which discuss compliance issues and also board meetings, firms will be able to show to a regulator both that they are taking appropriate steps in relation to the Year 2000 problem, and that these are being supervised at an appropriately senior level.