In early July the FCA and the PRA published a number of documents relating to the extension of the Senior Managers and Certification Regime (SMCR) to those firms not currently subject to that regime. These included policy statements and rules which were described as "near final", as they require approval from HM Treasury. Whilst the regulatory communications were broadly as the industry and commentators had expected from the consultation, the FCA has helpfully clarified a few matters that some firms asked about during the consultation process.

This note will briefly describe the current position regarding SMCR implementation, before setting out 11 questions that the FCA has answered in relation to firms which are regulated by the FCA but not the PRA (so called "solo-regulated" firms).

Background and update

The SMCR has applied to banks, building societies and credit unions, as well as the eight investment firms authorised by the PRA, since March 2016. The FCA issued consultation papers in 2017 proposing how it should be rolled out to all solo-regulated firms. Both the PRA and the FCA also consulted on the extension of the SMCR to insurers, which are currently subject to the Senior Insurance Managers Regime; this is not dissimilar to the Senior Managers Regime but does not include the extensive and onerous provisions of the Certification Regime and Conduct Rules. See our previous Insight piece for further details on the regime.

The regulators have now issued a number of policy statements and supervisory statements setting out in detail how the regime will apply to insurers and FCA solo-regulated firms. The FCA has also published two guides on the SMCR, aimed respectively at each type of firm. Finally, the FCA has issued a consultation paper on establishing a "directory" of individuals at SMCR firms (including banks) who will no longer be shown on the Financial Services Register. The Directory Consultation Paper will be the subject of a separate Dentons Insight piece.

In general the FCA is implementing the regime as proposed in the consultation papers. There are only a few minor changes, mainly around the boundary between the "core" and "enhanced" versions of the regime.

The FCA notes that Brexit may require certain amendments to the rules, though, as the SMCR is a (rare) example of UK regulatory policymaking that does not derive from EU legislation, these are unlikely to be extensive and will only affect EEA firms and branches.

The SMCR will come into force for insurers on 10 December 2018 and, subject to Treasury approval, for solo-regulated firms on 9 December 2019.

Eleven questions answered

1 Will firms need to appoint someone to each Senior Management Function?

The SMCR provides a more granular list of Senior Management Functions (SMFs) than the current list of controlled functions. This has prompted some firms to ask whether they are required to have individuals fulfilling each function. The FCA has confirmed that they do not: the general principle is that if a person is to carry out a role that is designated as an SMF they must be approved as such, but otherwise there is no general requirement to appoint individuals to hold SMFs.

This means that those firms that are not currently required to have a Compliance Officer or Money Laundering Reporting Officer are not required to appoint them under the SMCR. Likewise, although there are designated SMFs for the chairs of the Risk, Audit, Remuneration and Nominations Committees, the SMCR does not itself require firms to establish such committees or appoint individuals as their chairs.

2 How should firms in the enhanced regime formalise arrangements with senior individuals in the wider group?

The FCA notes that some firms may have allocated responsibility for specific functions to senior executives in other companies in the group. This will generally not be an issue for firms in the limited and core regimes, but firms in the enhanced regime are likely to have to apply for the group executive to be a senior manager. The reason is that, under the "no gaps or overlaps" principle, enhanced regime firms must allocate responsibility for each of their business areas, activities and management functions to specified individuals. If the relevant individual would not otherwise be a senior manager, they must be approved to perform the Other Overall Responsibility role (SMF18). The FCA suggests that the relationship between the firm and the relevant senior manager should be formalised, for instance through a contract of employment or a formal board delegation document.

3 Must the board chair be a non-executive director?

At present board members will be approved as either the CF1 (executive director) or CF2 (non-executive director) function. Under the SMCR the board chairperson will need to be approved to hold a specific SMF, namely the SMF9 Chair function. Whilst in banks the chair is expected to be a non-executive, the FCA has clarified that in solo-regulated firms the chair may be either executive or non-executive, though the FCA notes that there may be other obligations or good governance practices that require the chair to be a non-executive director.

4 Does the general counsel of an enhanced regime firm need to be a senior manager?

Whether the general counsel must be a senior manager is a question with a vexed history. In the banking regime, the FCA left the legal function out of its indicative list of key business and management functions. Whilst this list was not intended to be exhaustive, most banks and advisers assumed this omission to be deliberate. The FCA later clarified its view that the legal function was a key management function and, if the general counsel was accountable to the board for their oversight of that function, they should be a senior manager. However, the FCA said it would consult on the question and banks that had, in good faith, not made their general counsel a senior manager did not need to change their approach in the interim.

A discussion paper followed, but no consultation. In the press conference to launch its 2018/19 business plan, the FCA said the planned consultation had been a casualty of the need to devote extra resources to Brexit and would not take place until April 2019 at the earliest.

The FCA SMCR policy statement again states the FCA's view that the legal function is not exempt from the "overall responsibility requirement" applicable to enhanced firms (i.e. the "no gaps or overlaps" principle referred to above). However, the policy is under review and the position will be clarified by a further consultation, and if necessary further rules, before the SMCR comes into force.
As things stand, firms subject to the enhanced regime should plan on the basis that their general counsel should be a senior manager. However, it is worth noting that the FCA has stressed that the general counsel is accountable for the management and oversight of the legal function, rather than for the (privileged) legal advice that they or their lawyers give.

5 How should enhanced regime firms allocate the Chief Operations Function?

The Chief Operations Function (SMF24) is defined as "the most senior person responsible for managing the internal operations (including HR), systems and technology of a firm". As there is considerable variation in how these responsibilities are apportioned amongst firms in practice, the FCA's rules give some detailed guidance on who should hold the function. Broadly, where there is a single senior person reporting to the board on these functions, he or she should be the sole holder of the function. Where there are equally senior people all reporting to the board, whether split by function (e.g. head of technology and head of operations) or by business line (e.g. COO for broking and COO for advisory), they should all hold the SMF24 function, with actual responsibilities being split between them.

6 In a partnership structure, will all partners need to be senior managers?

All partners must be senior managers, unless they are what the FCA rules uncharitably call "partners without influence", i.e. they play no part in the management of the firm. In this case they are "unlikely" to be performing the partner function. The FCA's view is that most partners will have some involvement in managing a firm, though it recognises that this will not apply in every partnership. Partnerships will have to think carefully about how their governance and management arrangements work in practice, and decide whether any of their partners genuinely play no part in the firm's management.

7 What records do senior managers need to take to comply with the duty of responsibility?

One of the most difficult practical issues for senior managers in banks is how to record that they are, on a day-to-day basis, taking reasonable steps to prevent regulatory breaches in their areas (the so-called "duty of responsibility"). Senior managers' understandable concerns that the regulator may seek evidence of compliance years after the fact have led, in some cases, to a culture of excessive paperwork and unnecessary making and recording of challenges during the decision-making process.

In response to concerns about this raised during the consultation, the FCA states that the duty of responsibility does not impose additional obligations to keep records explaining or justifying steps taken (or not taken). It goes on to say, however, that it may be in senior managers' interests to keep records of relevant steps they take. Furthermore, the FCA points out that senior managers (and significant influence function holders under the current regime) are obliged to take reasonable steps to make sure that their business area complies with the FCA's rules, including the requirement to keep records allowing the FCA to monitor the firm's compliance with its rulebook.

It is unlikely that firms or their senior managers will take comfort from the FCA's statement on these points. They will have to strike a balance between the need to keep reasonable evidence of compliance and the need to run their business efficiently and effectively.

8 Can someone be both a senior manager and a certified person?

The FCA states that if a senior manager performs a role that is subject to the certification regime, and that role is not related to their SMF, then they will also need to be certified. For example, if a senior manager meets the definition of the client dealing function (broadly equivalent to the current CF30 role), they must be certified for that function. Whilst this has been rare in the banking regime, given the different size and structure of many solo-regulated firms it may become more common.

9 How should firms assess the fitness and propriety of different levels of staff?

The FCA notes that firms should apply the certification requirements proportionately to different functions, and do not need to adopt the same criteria for fitness and propriety regardless of a person's seniority or role. It gives the example of a trainee retail investment adviser, who may be certified as fit and proper on the condition that they continue to meet basic standards and work under supervision.

10 Does the regulatory reference requirement contravene employment law or the GDPR?

One of the more onerous requirements of the SMCR is that firms are required to give a "regulatory reference", i.e. a detailed reference in a standard template, in relation to a former employee or director who is applying for a senior management or certification function at another firm. Firms are also required to update these references if new information comes to light. The reference must contain all information relevant to the assessment of an individual's fitness and propriety (although the FCA points out that this is an existing requirement).

In response to concerns around employment law and GDPR compliance, the FCA states that its rules only require firms to disclose information that has been properly verified, and there is therefore no conflict with duties under the general law to former employees or firms requesting references. The FCA also believes that the requirement does not contravene the GDPR, as the information employers are required to give is proportionate, storage of the information is for an appropriate amount of time, and it is appropriate to store it and provide it to a new employer, in order to comply with regulatory rules.

11 Should firms submit a conduct rules breach report if the employee has left?

Under the SMCR firms will be required to report disciplinary action taken against any of their staff (except ancillary staff such as secretaries and cleaners) for reasons that amount to a breach of the conduct rules. Reports must be submitted annually, or within seven business days in the case of senior managers. A nil return must be submitted if appropriate and a late return fee will be levied if no return is submitted. The FCA stresses that these rules are additional to existing rules about notifying significant issues to the FCA, such as Principle 11 and the rules in SYSC 15.3.

Where the employee leaves the firm, the position around reporting depends on timing. If the employee leaves during the disciplinary process, which cannot be completed, no report should be made. If the employee leaves after the disciplinary process has been completed, a report should be made. In addition, if the employee appeals against the disciplinary action, a report should be made but an update given if the action is overturned.