Whilst the deadline for submission of data relating to the Directory falls in 2020, the update from the FCA is a timely reminder that there is a lot to be done by firms both in advance of the 9 December 2019 when the SMCR regime comes into effect (the Implementation Date) and beyond. Regulated firms need to ensure they are prepared and take the necessary steps now.
What Needs to be Done?
What type of firm are you?
For firms who aren’t already on the implementation journey, the first step is to work out what type of SMCR firm you are. Firms who currently hold "limited permissions" will be Limited Scope firms, firms who hold full CCA permissions will be a "Core Firm" unless one of six criteria applies in which case they will be an "Enhanced Firm". The category of firm will dictate the extent to which the SMCR rules apply to a relevant business and how much is involved in getting compliant.
Who will hold the Senior Management Functions in the business?
Every Senior Manager will have a duty of responsibility under FSMA so that if there is a breach, the Senior Manager for that area could be held accountable (in addition to the firm) if they didn’t take reasonable steps to stop the breach. It is therefore crucial that each relevant Senior Manager is aware of their legal duty of responsibility - avoid any surprises and make sure they are on board now and understand the significance of the role and the potential consequences of falling short of their duties.
Do you need to change existing approvals now?
Are there any existing approved persons who will not hold Senior Manger functions going forward? Firms must consider whether they need to change any existing approvals or add any new ones ahead of the Implementation Date.
The FCA have confirmed that firms won’t have to apply for re-approval for currently "Approved Persons" where there is no substantive change in the individual's role before and after the Implementation Date. Firms already have a responsibility to make sure such individuals are fit and proper and therefore they will automatically be converted to the SMCR regime. Firms should take action now if they don't want any existing approved persons to map across under the new regime.
Put in place relevant Statements of Responsibility
Once the Senior Managers are selected you need to document their responsibilities. The FCA have defined certain Prescribed Responsibilities which must be allocated to Senior Managers. The relevant responsibilities need to be detailed in a "Statement of Responsibility" (SOR) setting out what that manager is accountable and responsible for. The SOR will be submitted for approval by the FCA and the firm is responsible for keeping these up to date.
Who are the Certification Staff?
Certification covers specific functions which aren't Senior Manager functions but can have an influence on customers, the firm or market integrity. Firms have to ensure such staff are fit and proper to perform their role and certify the position to the FCA at least annually. It can be difficult to determine who falls into this category of staff in any organisation - staff who interact with clients in a purely administrative capacity are unlikely to be caught provided they have no scope to choose, decide or reach a judgement as to what should be done in any given situation and have a mainly automated role.
Schedule staff training
All Senior Managers and Certification Staff have to be trained prior to the Implementation Date. All other staff in the business (save for ancillary staff who don't perform a role specific to financial services and who the FCA consider to be ancillary) will need training on the Conduct Rules before December 2020, but most firms are aiming to get training under way in September/October.
Renew contractual documentation, policies and procedures
Criminal Record checks and Regulatory References (for previous employers in the past 6 years) are required for people applying for Senior Management, Certification and NED roles so firms need to ascertain what procedures need to be in place to accommodate that process.
This will involve updating documented policies and procedures and relevant contracts of employment which also have to be reviewed more generally to accommodate breaches of the Conduct Rules and the relevant implications. Firms also need to document how they will deal with annual fitness and proprietary checks, training, conducting audits etc.
What does the future look like?
All firms should keep an audit trail of what they have done as part of their SMCR implementation projects. They should assess the effectiveness of the procedures put in place at regular intervals following the Implementation Date.
Firms should also consider putting an SMCR User Manual in place so everyone in the firm understands their obligations and who is responsible for what. That is in addition to ensuring wider staff training on the Conduct Rules is rolled out and ensuring relevant information for The Directory is given to the FCA on time
With less than 5 months to go, there is a lot to do before the Implementation Date and potentially a lot to consider after it too!
