1. Senior Management Responsibilities David Scott & James Smethurst 10 March 2009 To insert other ready-formatted pages: go to the insert menu/slides from files/ select ‘on-screen inserts.ppt’ Click the display button, then click the button on the right (marked with red below). Click on the slide(s) to insert then insert and close.

2. Contents  Introduction  Approved persons and SYSC – a recap  Current Regulatory Approach  Enforcement context  FSA practice and issues arising

3. Introduction “the financial crisis can be to an important extent attributed to failures and weaknesses in corporate governance arrangements. When they were put to the test, corporate governance routines did not serve their purpose to safeguard against excessive risk taking in a number of financial services companies.” (“The Corporate Governance Lessons from the Financial Crisis” OECD Report)

4. The Approved Persons Regime  Role of individuals at the centre of regulatory regime  FSMA – section 59  authorised firm must take reasonable care to ensure that no person performs a “controlled function” without prior approval of the FSA  two types of controlled function  dealing with customers / property  significant influence functions  Approval process allows FSA to determine whether person is “fit and proper”  Approved status also gives FSA disciplinary sanctions over individuals as well as firms (but note FSA has power to ban any individual)

5. The Approved Persons Regime cont/d  Approved persons, like authorised firms, subject to set of Principles  FSMA requires FSA to publish a Code “for the purpose of helping to determine whether or not a person’s conduct complies with the statement of principle”  Principles 5 to 7 apply specifically to SIFs  AP must take reasonable steps to ensure business for which he is responsible is organised so it can be controlled effectively  AP must exercise due skill care and diligence in managing area of business for which he is responsible  AP must take reasonable steps to ensure business for which he is responsible complies with relevant requirements of regulatory system

6. Systems and Control (SYSC)  SYSC 2 – senior management arrangements  clear and appropriate apportionment of significant responsibilities amongst directors and senior managers so that:  clear who has what responsibilities; and  business of the firm can be adequately monitored and controlled by directors and senior managers  SYSC 3 - systems and controls  firm must take reasonable care to establish systems and controls appropriate to its business  SYSC 4 – organisational requirements for common platform firms  senior personnel responsible for ensuring compliance by firm with regulatory system  assess and periodically review policies, procedures and arrangements for compliance

7. Current Regulatory Approach  Increasing emphasis on senior management responsibility  Move to principles-based regulation  Governance at the heart of effective risk management  Competence of senior managers  Extending the approved persons regime

8. Principles-based Regulation  Principles-based regulation imposes significant responsibility on senior management “The move to principles-based regulation and to high-level standards instead of detailed rules means that there is a greater emphasis on the responsibilities of firms’ senior management. So they will need to move away from focusing on compliance with the detailed rules and consider whether they meet the spirit of the Principles and our new high-level standards.”  But, FSA focus not on Principles per se but on “consequences of the actions of firms and the individuals we supervise. Given this philosophy, a better strapline would be ‘outcomes-focused regulation’” (Hector Sants FSA Business Plan 2009/10)  Senior management must consider how to produce the outcomes desired by the FSA

9. Governance and Risk Management  Recent risk management failures in sector seen as failures of governance  Effective governance regarded as key to effective risk management “We see good governance as being at the heart of good risk management because it is only through having good governance in place that a firm is likely to be both able and willing to face up to its key risks.” (Sheila Nicholl, September 2008)  SYSC 7 – risk control for common platform firm  senior personnel must approve and periodically review strategies and policies for taking up, managing, monitoring and mitigating risk  SYSC 14 – prudential risk for insurers  ultimate responsibility for the management of prudential risks rests with the firm’s governing body and relevant senior managers

10. Governance and Risk Management cont/d  What does this mean?  importance of governing body involvement in risk management – especially ICAAP process  assessment of and appetite for risk should inform business strategy  importance of governing body receiving risk management information  importance of challenge within firms

11. Competence of Senior Managers  Competence of senior management key focus “The supervisory assessment of management competence within firms is fundamental to the FSA’s risk framework. This assessment has become even more important as the FSA seeks to embed More Principles Based Regulation….The extent to which the FSA can place reliance on senior management will inform its view of the firm’s risk profile, and the way it interacts with the firm.” (FSA Internal Audit Report into Northern Rock)  Primary responsibility for assessing competence sits with the firm – poor choice will call into question competence of board  But, FSA conducting more of its own due diligence of SIF applicants  interviews for applicants at largest firms  Need for relevant skills / experience given role in risk management?

12. Extending the Approved Persons Regime FSA CP08/25  FSA CP08/25 - extension of the approved persons regime  directors and NEDs of parent undertakings or holding companies must be approved if “their decisions opinions or actions are regularly taken into account by the governing body of the firm”  director and NED function also to apply to branches of non-EEA firms where person has responsibility for regulated activities of the branch  Reflects concern lack of independence of UK subs / branches?

13. Clarifying the Responsibilities of NEDs FSA CP 08/25  Clarification of responsibilities of NEDs - Principle 6  establish and continually maintain his confidence various matters, including  conduct of the firm  performance of senior management  adequacy of financial controls  risk management  remuneration  provide independent perspective and constructively challenge  scrutinise performance and approach of senior managers

14. Enforcement rhetoric – general  Consistent FSA messages to senior management  FSA’s enforcement objective – credible deterrence  "The purpose of enforcement is deterrence both in a specific and a general sense; not just to punish the individual wrongdoing but to send a message to a wider audience to achieve change. We are committed to using enforcement activity to bring about changes in behaviour of firms and individuals.“ (Margaret Cole, 14 March 2007)  Meaning what? Full use of the FSA’s array of powers

15. Enforcement rhetoric – specific  “2.2 We will be seeking to hold individuals exercising significant influence over authorised firms accountable for poor conduct at those firms with regard to regulated activities. Previously, for individuals holding significant influence controlled functions, we have tended to focus on cases of dishonesty or lack of integrity where prohibition or withdrawal of approval was the most appropriate outcome. In the future, we will also consider the competence of significant influence function holders and we would not shy away from pursuing cases against individuals who breach our Principles and the Code of Practice for Approved Persons (APER).”  “4.3Our expectations of non executives and executives are different. In the past we have said that we will not discipline non-executives if they have acted in accordance with their roles and responsibilities when things go wrong. In the future, we will look at non-executives more closely in these cases if we believe that they should have intervened where executives are making sustained poor decisions.”

16. Enforcement activity in previous years Reporting year (1 st April to 31 st March) No. of fines Total of fines (£m) Public censure only Criminal outcome ProhibitionFinal notices against individuals 2002/3159.17214 2003/42212.38319 2004/53122.2500919 2005/61717.4323726 2006/73214.66411020 2007/8214.45203063 So far, in 2008/09 we estimate total fines amount to about £15 million.

17. Enforcement decisions  Multiple mortgage broker cases in 2008 for sales and advice process failings - where sole trader or only one approved person then difficult to avoid allocation of responsibility for SYSC failings to that person.  David Whistance and William de Broe (2007)  Failures led to unreconciled debit balances totalling £66.3 million in 2004 and 2005 audited accounts.  WDB breached PRIN 3 (systems and controls) for inadequate accounting procedures and records.  WDB fined £560,000.  Whistance, as finance director, held personally responsible for the firm's inadequate accounting systems and controls.  Whistance fined £30,000.

18. Enforcement decisions  Sindicatum Holdings and Michael Wheelhouse (2008)  Inadequate AML systems - PRIN 3 breach  No loss but risk of loss and financial crime.  Firm fined £49,000  MLRO held personally responsible for SYSC failures.  MLRO fined £17,500.  Few final notices against senior managers to date (except for very small firms) but likely to increase in 2009 (see FSA ‘s 2009 Financial Risk Outlook)

19. FSA powers in relation to individuals  The fifth Threshold Condition: suitability  The power to grant approval and the power to withdraw approved person status  The power to fine and/or publicly censure an approved person  The banning power – “prohibition orders”  NB: possible challenge to exercise of each power  NB: different burdens of proof depending on particular power

20. Disciplinary powers  FSMA 2000 section 66  Twin test: guilty of misconduct and FSA is satisfied action is “appropriate in all the circumstances”  What is misconduct?  breach of a statement of principle, or  knowingly concerned in a contravention by the firm  Same enforcement process applies

21. Timing issues and recent changes to FSA practice  2 year limitation period for FSA to start disciplinary action  No particular FSA practice since 2001  Few decisions as few individual investigations  A recent change on referral to enforcement – need to consider recommendation to investigate individuals as well  Low threshold for commencement of an investigation  Assumption that one or more approved persons will be investigated?  Will this affect timing decisions about referrals to enforcement generally?

22. Practical issues arising  Referrals are not public and are for investigation only – but hugely significant for the individual  What information does the FSA have about who had responsibility and who did what at that early stage?  Does the approved person remain in position?  Will disciplinary action be coupled with action to withdraw approval or a prohibition order?  Will this impact self-reporting?  Will this mean risk of disciplinary action against senior management when problems arise?

23. Practical issues arising  Is separate representation required?  D&O notification?  Faster or slower outcomes for FSA?  Loss of discounts for firms?  More RDC hearings?

24. © Freshfields Bruckhaus Deringer LLP 2009 This material is for general information only and is not intended to provide legal advice.