FIRST STEPS
SM&CR: A JOB DONE?

Addleshaw Goddard

SM&CR: A JOB DONE?
Following the introduction of the Senior Management and Certification Regime (SM&CR), to date the focus within Financial Conduct Authority (FCA) solo regulated firms has been concentrated on implementing and embedding processes within their business as BAU (Business as Usual) processes. The 31 March 2021 was a milestone date as this marked the day by which all firms must have completed their implementation of SM&CR. Does, therefore, passing this milestone date mean that you and Senior Manager Function holders (SMFs) can relax and focus on other things, especially as the flood of headlines related to SM&CR in 2019 and January 2020 has now died down?

SM&CR has not had the same headlines over the past year. This is, however, likely to be due to everyone’s attention and energy being spent on managing the impact of COVID-19. In addition, there hasn’t been any visible high profile enforcement action taken against individuals under SM&CR, which has led some commentators to suggest that SM&CR lacks teeth. However, based on our experience of helping clients engage with regulators, it would be mistake for firms and SMFs to regard SM&CR as job done.

In this article, we consider:

•  why SM&CR should still be one of your key priorities?
•  what the areas you should focus on are
•  how to progress those SM&CR focus areas.

WHY SM&CR SHOULD STILL BE ONE OF YOUR KEY PRIORITIES
The implementation of the SM&CR regime to all FCA regulated firms is not seen by the regulator as the end point of journey. Rather, implementation is viewed as being only the beginning of the journey to ensure that firms are delivering both commercial and regulatory objectives. The FCA is expecting SM&CR to be the catalyst for driving change in how firms operate and the outcomes they deliver.

31 March therefore, marks the start of a journey for all solo regulated firms which will impact how they are governed and how they operate. The Prudential Regulation Authority’s (PRA) ‘Evaluation of senior manager and certification regime’ which surveyed banks and insurers (which have been subject to SMCR for some time) provides an indication of the level and type of changes that regulators, including the FCA, will expect to see within consumer credit firms. The PRA’s evaluation found:

• over 90% of SMFs said that SM&CR had brought about meaningful change in behaviours

• 97% of firms had integrated (to some degree) SM&CR into their BAU practices in a way that went beyond simple regulatory compliance

• 94% of SMFs said that SM&CR has brought about ‘positive meaningful change to behaviour in industry’ through ‘clearer articulation of authority and had improved focus on accountability and responsibility’. Examples of changes that have been driven by SM&CR are:

•  enhanced decision making by increasing the focus on responsibilities

•  Improved culture

•  enhanced compliance and ethics training, whistle blowing procedures, misconduct reporting, induction programmes, succession planning.

SM&CR provides the FCA with a powerful supervisory and enforcement toolkit through which it can drive forward its regulatory agenda. The SM&CR toolkit has already seen a change in how the FCA supervises and engages with firms, and we expect the changes approach to pick up speed after the 31 March.

EXAMPLES OF THE FCA’S REVISES SUPERVISORY APPROACH
•  the expectation that a firm is able to articulate and show, which SMF has overall accountability for key areas of the regulatory agenda/concerns that are applicable to the firm. These expectations are often communicated through speeches and other non-policy publications, and the SM&CR rules and guidance contain a list of expectations that are allocated to SMFs. An example of this is the management of COVID-19s impact on a firm’s operations and the service levels to customers. The overall accountability to the FCA for these responses should be the responsibility of SMFs

•  increased engagement by the FCA directly with the SMF who has overall accountability for areas they are interested in, rather than through the compliance function. This engagement model is not exclusive to when things have gone wrong, but will also be part of routine engagement

•  increased scrutiny of approved person applications that are submitted for new SMFs, especially with regards to the competence and experience of the individual candidate but also the how the individual’s ‘skill set’ fits in with the firm’s management team

•  Introduction of SM&CR has also seen a marked increase in whistleblower reports being made by individuals directly to the regulator. These reports are not just related to financial services activity but include factors which could highlight the culture within a firm, such as harassment, bullying and discrimination. Between April 2020 and September 2020 the FCA received the equivalent of nearly two reports per week, mainly in relation lack of safe working environment. The FCA has recently revamped it process for handling whistleblowing complaints and launched a campaign to encourage individuals to make reports.

QUESTIONS FOR YOU TO CONSIDER IN TERMS OF SM&CR IMPLEMENTATION
1. How confident are you and your SMFs that your SMCR implementation has positioned you to deal effectively with the revised supervisory approach by the FCA?

2. Are you able to show how your SM&CR implementation is now part of your BAU and is driving positive changes to how you do business?

If you answer ‘no’ to either of the above questions, then you need to ensure that SM&CR continues to remain one of your top priorities.

AREAS YOU SHOULD FOCUS ON
In our view there two main areas in terms of SM&CR that firms should focus on. These are:

• consider the effectiveness of your SM&CR implementation

• how can you embed the regulatory expectations of the changes that SM&CR is meant to drive into BAU processes?

The areas should be the focus of your SM&CR activities because the FCA is likely, within the next 12 months, to undertake a thematic review to see how effectively firms have implemented SM&CR. It is therefore possible that your firm may be selected to be part of any review. Any thematic review is unlikely to consider only the mechanistic aspects SM&CR implementation, but will also likely consider whether the way in which SM&CR has been implemented achieves the following regulatory objectives:

• clear allocation of overall accountabilities to senior decision makers which aligns with how the business operates in practice

• senior decision makers being able to demonstrate that they understand the regulatory requirements and expectations relating to their areas of overall accountability through their actions and decisions.

Below are examples of common weaknesses that we have seen with SMCR implementation:

• limited engagement by SMFs in understanding the impacts of SM&CR in terms of how they undertake their roles

• limited or no consideration of whether the governance structure and reporting lines as they operate within the business are aligned to how SM&CR has been implemented. This has resulted in potentially the wrong individuals being designated as SMFs, some accountabilities not being allocated to an SMF, and a lack of clarity as to what each SMF is accountable for

• SMFs have not considered what reasonable steps look like for them personally or how they evidence what reasonable steps are

• training that has been provided is too generic and too focused on what SM&CR is, rather than being role specific. In addition, there is lack of consideration of what ongoing training needs to provided and how it should be delivered effectively

• compliance monitoring methodologies have not been amended to take into account how SM&CR impacts should be included

• business and operational changes do not consider the relevant overall accountability of SMFs or whether these changes could have SM&CR implications

• lack of succession planning.

NEXT STEPS
To decide what still needs be done within your business to embed SM&CR as a BAU process, we suggest you undertake following two exercises:

1. Carry out a review which tests that you have appropriate policies and processes in place for your ongoing activities to ensure that you meet with various SM&CR obligations. An example would be obtaining and giving regulatory references.

2. Review your governance arrangements through the lens of a key or important business initiative or issue. For example, how the impacts of COVID-19 have been managed? The review should focus whether the governance and decision making processes within your business are aligned to your SM&CR arrangements. It is essential this review takes a holistic view of how governance and decision making actually operates within your business.

These reviews will enable you to identify what is working well and highlight areas that need to be enhanced, thereby enabling you to create an action plan of what still needs to be done.

If you would like to discuss any in this article or understand how we can help you, please get in touch.

Clare Hughes
Partner
Addleshaw Goddard