An enhanced F&P regime is expected to be introduced as part of the Individual Accountability Framework (IAF). The Government is looking to introduce the IAF in the proposed Central Bank (Amendment) Bill 2019, with a CBI consultation paper expected this year.
Ciara Murphy
Considering these developments, financial firms have an opportunity now to ensure that they are compliant with current fitness and probity requirements, as well as prepare for the implications of the IAF on their firm and individuals alike.
Background
The CBI F&P regime came into effect in 2010 with a purpose to ensure that regulated firms and individuals are committed to high standards of competency, integrity and honesty and are held to account when they fall below these standards. It is notable that in 2020, 19 Pre-approved control function (PCF) applications were withdrawn where the CBI challenged the applicant.
The CBI is committed to driving cultural change in the financial services industry in Ireland. The introduction of the IAF as well as addressing a lack of diversity, particularly at senior management and board levels are cornerstones in driving this change.
The IAF comprises of four components:
i. Conduct Standards: Sets out behaviour for firms and individuals alike;
ii. Senior Executive Accountability Regime (SEAR): Ensures clearer accountability by placing obligations on firms and senior individuals within them to set out where responsibility and decision-making lies in their business;
iii. Enhancements to the current F&P Regime: Strengthens the obligation on firms to proactively assess individuals in controlled functions on an ongoing basis; and
iv. Unified Enforcement process: Enables the CBI to pursue individuals directly for misconduct rather than having to link then to their participation in a regulatory breach with a firm.
Key challenges
Both ‘Dear CEO’ F&P letters highlighted issues around firms’ obligations. The first letter indicated that while the F&P standards for individuals appeared to be well known, there was less understanding surrounding a firms’ legal obligations under the 2010 Act. The second letter followed a thematic review across a sample of financial institutions in the banking and insurance sectors and noted a wide divergence of standards in the implementation of the Regime.
A number of issues were highlighted in both ‘Dear CEO’ letters, however, those that pose the most significant challenges to firms relate to:
• Due Diligence – initial and ongoing; and
• Outsourcing of PCF/Control function (CF) roles.
Firms have an obligation that individuals who hold senior and customer facing positions are fit and proper for their role not only on appointment but also throughout the tenure of their role. Issues highlighted in both initial and ongoing due diligence included a lack of evidence of interview notes, qualifications, references and suitability assessments. A lack of judgement searches, regulatory searches, directorship searches and adverse media searches were also highlighted. Ongoing due diligence appeared limited to annual self-certification. Firms should proactively conduct ongoing due diligence screening of staff to ensure there has been no change in circumstance that may affect the fitness or probity of the individual. Annual self-certification is the minimum expected of a firm.
Outsourcing in itself has been subject to much regulatory scrutiny, with local focus indicated through the recently published CBI consultation paper on cross industry guidance on outsourcing CP138. The CBI has reminded firms that F&P obligations apply irrespective of whether PCF/CF roles are performed within the firm or outsourced to a regulated or unregulated service provider. Where large global firms rely on an operating model leveraging services and capabilities from group centres of excellence, this challenge may be intensified.
When the performance of a function is outsourced to a regulated Outsourced Service Provider (OSP), the individuals technically will not be taken to be a CF or a PCF rather their activity under the written outsourcing agreement. Having such outsourcing written agreements in place is key to ensuring firms are compliant with the F&P Standards. It was also noted that where control functions are outsourced to unregulated OSPs, the majority of firms had not, as part of their due diligence in appointing CF role holders, obtained the required documentation nor made any inquiries as to OSPs’ process for assessing fitness and probity. It noted that some firms did not have a process whereby outsourcing arrangements were analysed to verify whether PCF or CF roles were being performed.
What to do next
There are a number of areas in which firms should consider regarding their compliance with the F&P Standards now and on an ongoing basis:
• Assessment of compliance with the current F&P Standards and subsequent plans to remediate. Transparent communication and reporting to internal governance fora will be required until gaps are resolved.
• Mechanisms to promote the level of awareness of the obligations of the regime at staff and Board levels, thereby enhancing individual accountability and firms’ obligations therein.
• Clear and documented roles and responsibilities across Board, Nomination Committee, Company Secretary, Business lines, Compliance, HR, Risk, Internal Audit and Legal. This will strengthen a firms F&P corporate governance arrangement.
• Formalised appointment process for Board and PCF appointments will enable a level of scrutiny and formality around interview notes and suitability assessments expected.
• Identification and designation of CF roles. Having a clear and approved rationale for those in and out of scope roles will assist in consistent application of CF designations. Regulatory role profiles which complement human resource data may alleviate CF classification of individuals now and going forward.
In addition to firms addressing these considerations, they should pay particular attention to those key challenges around due diligence and outsourcing of CF activities. Firms should ask themselves the question whether the outcome of their due diligence processes truly answers the question as to whether a person continues to be fit and proper in their role on an ongoing basis. A highly manual and administrative due diligence process may lead to a ‘tick box’ mentality missing the objective of the regime, that individuals holding senior and customer facing positions are fit and proper in the roles they carry out. The consideration of technology enablement in F&P processes may indeed alleviate this administrative burden and allow for a change in mindset.
In light of the upcoming introduction of the IAF around conduct standards, the annual F&P certification process should be reviewed so that it aligns to conduct breach management, performance management and remuneration processes.
With regards to the outsourcing of PCF/CF roles outside of a legal entity, firms should consider assessing their end to end processes from a control function activity perspective ensuring there is a governance structure in place that provides adequate oversight. Where outsourcing agreements are in place, firms should ensure that OSPs implement a process for assessing and maintaining fitness and probity.
In summary
While SEAR is a regime that firms should be preparing for, the area of F&P is not one to be overlooked. ?Significant issues have been highlighted in the two ‘Dear CEO’ F&P letters, which indicate that much is still to be done. The F&P regime can be complex in application and resource intense to remediate. Firms should be making sure they are compliant with current standards, ready for the enhanced F&P regime, as well as leveraging it in their preparations for SEAR.
No doubt addressing the issues and considerations highlighted will present challenges to firms in ensuring they comply with both the ‘letter of the law’ and ‘spirit’ of the current regime and that proposed under the IAF. Nonetheless it provides firms with the opportunity to get ahead and prepare, allowing for a stable ground from which firms can identify and implement changes to their operating models in embedding individual accountability and diversity.
The CBI is committed to driving the industry in a cultural transformation to rebuild trust in the industry; ensure consumers and investors are protected; and safeguard monetary and financial stability. Firms demonstrating proactiveness, transparency and willingness to learn and change will strengthen their corporate governance standards and practices in this journey.