As everyone in the industry will be well aware by now, the Senior Managers and Certification Regime (SM&CR) for solo regulated firms comes into effect from 9th December this year, bringing with it new responsibilities for staff at pretty much every level of the business. The good news is firms have time to think through the implications of the regime, consider what changes and new procedures they may need to put in place and ensure they are fully prepared well in advance of the deadline.
As a reminder there are three key parts to the SM&CR; Senior Management Functions (Senior Managers), Certification Regime and the Conduct Rules. In this article we are concentrating on one part of the new regime, Senior Managers and, in particular, the responsibilities which a Senior Manager might hold and what firms need to think about when allocating responsibilities.
Under the new regime every Senior Manager will be required to have a Statement of Responsibilities (SoR). A SoR must set out what a Senior Manager is responsible and accountable for; it will have to be submitted when a Senior Manager is being approved and where there is a significant change to their role.
An individual undertaking a Prescribed Responsibility needs the appropriate level of authority, experience, skills and knowledge
Duty of Responsibility
The SoR is an aspect of the regime which, in our view, requires particular thought and preparation.
Why? Well, in part, this is because the new regime introduces the Duty of Responsibility – under FSMA every Senior Manager has a Duty of Responsibility. In its guide to the SM&CR for solo regulated firms, the FCA explains what this Duty means:
“if a firm breaches one of our requirements, the Senior Manager responsible for that area could be held accountable if they didn’t take reasonable steps to prevent or stop the breach.”
So, where an individual accepts a particular responsibility, they are also accepting this Duty.
Which means the firm and the individual need to be confident that the Senior Manager has the right skills and the right level of authority to direct and control affairs and that there is an adequate infrastructure in place to provide sufficient oversight. Among other things, this could include having relevant MI which tells a story, with context, so the Senior Manager has adequate information available on which to base an informed view.
The Statement of Responsibilities (SoR)
Depending on what category a firm falls into (Core, Enhanced or Limited Scope), more or fewer Senior Managers will be captured by the new requirements. As the Core category will cover by far the largest number of solo regulated firms, we’re focusing on the regime as it applies to them.
Current Approved Persons in Core firms will, by and large, automatically convert to Senior Manager Functions as part of the transition process and, in most cases, a SoR won’t have to be submitted as part of the transition, nevertheless every Senior Manager must have a SoR and it must be kept up to date.
In order to complete a SoR, a firm will need to decide what Prescribed Responsibilities and what other key responsibilities sit with each Senior Manager.
Prescribed Responsibilities are those which the requirements stipulate can only sit with a Senior Manager; among other things these include responsibilities for the Senior Managers Regime itself, the Certification Regime, the Conduct Rules, countering the risk of financial crime, etc.
An individual undertaking a Prescribed Responsibility needs the appropriate level of authority, experience, skills and knowledge. They are taking personal responsibility for one or more of these key issues and can be held personally responsible for the firm’s failure to comply.
In addition, a Senior Manager’s SoR will explain what other responsibilities they hold. This could be anything not covered by their Prescribed Responsibilities; the FCA expects this will usually cover business functions and activities for which the individual is accountable, for example, sales, customer service, information technology, etc.
Why responsibility isn’t always clear
During the course of our work, we sometimes see issues in the way in which firms allocate responsibilities, the most common include:
- Everybody on the Board being collectively responsible – the FCA is not expecting that Prescribed Responsibilities will be shared (except in very limited circumstances) so, for example, if you currently have the entire board sharing responsibility for countering the risk of financial crime, this is very unlikely to be acceptable in future. Now is the time, then, to decide who will be responsible for what, why they are a suitable individual and to make sure that they have an adequate infrastructure on which to call.
- One person being responsible for too much – guidance in SYSC is that a firm should avoid allocating such a wide range of Prescribed Responsibilities to one individual that “they are not able to carry out those responsibilities effectively”. We do sometimes see situations where, in practice, one senior individual in a business directs and take decisions on a very wide range of matters. This has two implications: a) is the individual responsible for too much? and b) are they exercising practical control over a responsibility which might actually be formally allocated to someone else?
- A lack of clarity as to who is responsible for what – firms not having formally discussed and documented where responsibilities sit and, at times, confusion as to what sits with whom. We’ve been in meetings where such misunderstandings have led to the situation where one senior staff member has turned to another and said: “I thought that was your area, not mine” – fortunately such an occurrence is very rare these days, but it can still happen.
Even if your firm is clear about where current responsibilities sit, you will still need to consider the additional Prescribed Responsibilities which will apply to your business and to formally allocate these. In our view, it is prudent to take the opportunity that the SM&CR provides to revisit where accountabilities lie and to ensure that skills, authority, experience – and appetite – all match.
The FCA’s Consultation Guidance, GC18/4, covers SoRs and Responsibilities Maps (the latter applies only to Enhanced firms) and includes questions for firms to consider when completing the Statements. We’d recommend that firms ‘dry run’ completing SoRs and see what, if any, issues this exercise throws up.
Make starting SM&CR a New Year’s resolution
As the dust of IDD and GDPR is beginning to settle, this New Year feels an appropriate time to start SM&CR discussions, to consider what training, if any, might be needed and to put processes in place to strengthen oversight if required. This should help to ensure that everyone affected has a proper understanding of the implications and is fully in agreement with their role, well in advance of the December implementation date.
If there are any barriers to allocating responsibilities appropriately, particularly the Prescribed Responsibilities, it will be far better to identify these sooner rather than later while there is still ample time to address any issues.
Of course, the allocation of responsibilities is just one element of the SM&CR and firms will have to consider other key areas such as:
- Regulatory references and criminal record checks;
- Identifying Certification staff and developing an internal certification process to ensure initial and ongoing suitability;
- Understanding the Conduct Rules, identifying to whom these apply and being able to roll out training which will ensure that staff understand what they mean to them;
- Implementing a Conduct Rule breach reporting process.
Plus, additional requirements for Enhanced firms, such as Responsibility Maps; additional Prescribed Responsibilities; Handover Procedures and an ‘Overall Responsibility’ requirement.
So, we’re not suggesting that dealing with the issue of allocation of responsibilities means the job is done, far from it, but it could be a very useful first step in making sure your business is fully prepared for the new regime.
From Helen Dean, Head of Technical Services, Thistle Initiatives
