Route 166 – The Ultimate Road Trip for Investment Banks
Associate - Compliance
Monday 6 April 2020
The power of the Financial Conduct Authority (FCA) to order a Skilled Person Report under Section 166 (s166) of the Financial Services and Markets Act 2000 (FSMA 2000) has long been the regulators’ most feared weapon. Commissioned when the FCA requires further information on or has concerns about a regulated firm’s activities, Section 166 reports can inflict severe financial damage: companies under such investigation foot the bill, even if no breach is identified. Regulation has grown increasingly complex in the aftermath of the financial crisis: in an aim to increase the resilience of the financial system, the expansion of the regulatory landscape has also increased firms’ likelihood of inadvertently indulging in non-compliant behaviour. With 51 Skilled Person Reports issued throughout 2018 – 2019[i], it is of increasing importance that firms familiarise themselves with the s166 process.
What Is a Section 166 report?
The FCA can commission two types of Skilled Person Review: s166 reports by skilled persons; and s166A reports, for which a skilled person is appointed to collect and update information[ii]. The extent of any issues; the potential or actual impact on customers; adequacy of systems and controls (including compliance and risk management); and past business reviews; are included in the report, alongside any remedial actions. The outcome of commissioned reports can be used as a launchpad for enforcement actions by the regulator if the skilled person report confirms their concerns. Regulated firms typically undertake the costs of a skilled person review as a fee, which are often considerable even if, as mentioned above, no deficiencies are identified.
The FCA has developed a Skilled Person Panel divided into 14 subject categories known as ‘Lots’[i]. In recent years, the regulator has paid particular attention to Lot E: Financial Crime, and Lot D: Conduct of Business, ordering a spate of investigations into both areas[ii]. In Q2 2019, two Supervision Firms were dedicated to Financial Crime[iii], whilst in Q1 2020, two out of nine commissioned s166 reviews were concentrated around Conduct of Business, focusing on the Treating Customers Fairly initiative[iv].
Additionally, on 6th June 2018, the FCA published the reasoning behind their decision to fine Canara Bank £896,100, and they restricted the bank’s ability to accept deposits from new customers for 147 days[v]. As part of the FCA Trade Finance Thematic Project in 2012, the regulator visited Canara and, during this visit, serious AML failings were noted[vi]. A subsequent visit in 2015 discovered these deficiencies had not been remediated, and exposed further AML failings.
Consequently, a skilled person was appointed by the FCA to report on Canara Bank’s systems and controls for AML and Sanctions. In a damning verdict, the Skilled Person Report concluded that Canara Bank “fundamentally [did not understand] the issues highlighted by the FCA or [remediate] them adequately. Ultimately, the Bank [had] an AML framework that [had] fundamental shortcomings and [was] not fit for purpose”[vii].
Under Section 348 of FSMA 2000, s166 reports are usually confidential and not disclosable without the permission of their subject[viii]. The regulator can also publish s166 reports in mitigating circumstances, for example Canara Bank’s consistent AML failings. Additionally, the Treasury Select Committee chose to publish the s166 report on the Royal Bank of Scotland’s now-defunct restructuring division Global Restructuring Group (GRG)[ix], given a prior leak of the report and ensuing overwhelming public interest in bringing transparency to GRG failings.
Who is the Skilled Person?
On the 1st April 2013, the regulation of financial services in the UK irrevocably changed when, in addition to replacing the established Financial Services Authority (FSA), the FCA gained the power to directly appoint the skilled person to lead commissioned Section 166 reviews[x]. The skilled person is an independent party and is generally sourced from the Skilled Person Panel[xi]. Whilst it is possible for regulated firms subject to an s166 review to nominate the skilled person, it is usually necessary to do so from the Skilled Person Panel as the firm’s nominee needs to be approved by the FCA[xii]. Firms should consider that where the regulator appoints the skilled person, the report is submitted directly to the regulator. Should the firm nominate the skilled person themselves, the latter is required to deliver the report to the firm, presenting an opportunity to comment on the report before its submission to the FCA.
What initial steps should firms take when an s166 is served?
It is important to note that s166 reviews are a supervisory tool of the FCA[xiii] and not an enforcement action. It is possible to demonstrate compliance and resolve the FCA’s concerns without further action. When an s166 report has been commissioned, transparency between firms and the skilled person is imperative. The attitude and behaviour of firms can be taken into consideration, and the appearance of withholding information will reflect poorly on them.
Due to the possibility of enforcement actions, firms will inevitably devote significant time and effort to a skilled person review, which can stretch resources and potentially cause a negative impact on the firm’s daily operations. Whilst it is essential that firms dedicate the appropriate amount of time to an s166 review, it is also important to maintain oversight of operations outside the scope of the review. Resources attributed to the s166 that are clearly separated from BAU operations could prove beneficial to managing finite resources and to maintaining existing oversight arrangements, such as the production and circulation of Management Information (MI). The commission of an s166 report generally indicates a firm has fallen short of their regulatory expectations – the implementation and maintenance of firm-wide oversight can ensure all operations remain compliant.
Firms subject to a skilled person review may benefit from consulting with organisations that are familiar with the s166 process[xiv]; that are capable of facilitating discussions with the FCA prior to and succeeding the skilled person report; can help prepare witnesses for interview with the skilled person; and can assist the firm in carrying out an internal investigation prior to the review. An internal investigation focused on the area the regulator is concerned about may ensure deficiencies are raised, discussed and remedial actions agreed upon – the skilled person and the regulator expect firms to evidence regulatory compliance, which includes maintaining robust systems and controls to mitigate risk. Ensuring good record-keeping, displaying firm-wide culture and governance, and upholding clear reporting lines will also demonstrate compliance. Oversight across departments is essential for risk management and can also be evidenced through the compilation and use of MI.
Firms must ensure staff are equipped with the appropriate skills and support when faced with the daunting prospect of an s166 review. They can prepare their staff through specific training around the s166 process, and by ensuring that they are aware of all applicable policies and procedures. Liaising with a third party who is familiar with the process can exponentially facilitate preparation, as it is possible to convince the regulator to pursue other courses of action, including an internal investigation[xv], or to reduce the scope of the review.
Section 166 reviews have been predominantly used by the regulator as a reactive punishment for financial services firms – a record 140 s166 reports were commissioned in 2010-2011[xvi] in the aftermath of the financial crisis. In 2015, the FCA was criticised after it was revealed that only 2% of Skilled Person Reports issued in 2014 resulted in enforcement action[xvii]. As a result, the number of s166 reports commissioned has increased. Throughout the 2018-2019 financial year, the FCA and PRA combined issued 51 Skilled Person Reports, a 16% increase on the previous financial year[xviii].
This figure is expected to remain elevated and, with regulated businesses spending £110.1 million on conducting skilled person reports in the year to 31st March 2017[xix], it is in their best interests to ensure that they are prepared to evidence their compliance. Through embracing and implementing increasingly complex regulation, the financial industry has endeavoured to redeem its reputation with the general public following the financial crisis. It is important this trajectory continues and the industry’s perception of Skilled Person Reports changes. Firms should view them not as a feared punishment for a lapse in compliance, but as an opportunity to identify and review areas where governance and oversight arrangements can be enhanced throughout the firm to support process optimization and a protected reputation.