CASS The legal perspective recent developments and handling FCA investigations

Transcription

1 CASS The legal perspective recent developments and handling FCA investigations Alison McHaffie and Tom Callaby Edinburgh and London 4 th and 16 th October 2018

2 What are we covering today? Recent developments, Tom Callaby Beaufort Securities and the costs of returning client assets SMCR IDD, unbreakable deposits Brexit Handling FCA investigations, Alison McHaffie What goes wrong? How to identify and deal with breaches Questions 2

3 Recent developments, Tom Callaby 3

4 The costs of an administration Who bears the costs of distributing client assets? Beaufort Securities Limited and Beaufort Asset Clearing Services Limited Relevant rules: CASS 7A client money distribution and transfer Investment Bank Special Administration Regulations + Rules 2011 Insolvency Act 1986 (as modified by the IBSA Regulations) Allocation of costs of administration From client assets expenses properly incurred in pursuing return/transfer of client assets Clients bear own costs of proving claims, providing documents etc. FSCS protected? Costs/shortfall up to 50,000 covered for eligible clients assets From firm s assets all other costs/expenses And administration costs incurred due to firm s failure to comply with CASS rules 4

5 Senior Managers and Certification Regime (SMCR) (1) Background New individual accountability regime for financial services sector Has applied to banks since March 2016 Will replace Senior Insurance Managers Regime (SIMR) for insurers from 10 December 2018 FCA solo-regulated firms Near final rules published on 4 July 2018 (PS 18/14) Will be extended to all firms on 9 December 2019 Three categories of firm: Core regime majority of solo-regulated firms Enhanced regime additional requirements Includes CASS large firms Limited scope firms subject to lighter touch requirements 5

6 Senior Managers and Certification Regime (SMCR) (2) Changes to CF10a role Under SMCR CASS Operational Oversight Function (current CF10a) is a certified function CF10a will not automatically convert Firms will need to self-certify relevant person Annual certification of fitness and propriety going forwards CASS prescribed responsibility to be allocated to a senior manager Core and Enhanced firms Firms can split roles, or have senior manager adopt both roles (less likely for larger firms) What should firms be doing? Scoping/planning who will be senior managers, who will be certified persons? Statements of responsibilities, FCA forms, certification of staff, training etc. 6

7 Other recent developments Insurance Distribution Directive (IDD) Implemented on 1 October 2018 Reinsurance distribution must now comply with CASS 5 on a mandatory basis Client money must now be subject to Risk transfer; or Statutory or non-statutory client money trust Unbreakable deposits (PS 18/2) Allows firms to place client money in accounts with unbreakable terms of up to 95 days (previous maximum 30 days) Came into force on 22 January 2018 Questions from clients on internal policies (need to be realistic/achievable) and risk warnings Warnings of risks in client terms might be delays in returning cash in exceptional circumstances 7

8 Brexit What are some of the potential implications? Providing services to EU clients MiFID client assets provisions envisage third country custodians, sub-custodians etc. Custody services may be deemed to take place in the UK and/or can be provided as standalone ancillary services without engaging MiFID (but not UCITS/AIFMD depositary services) But, will custody be retained/taken up, if dealing/management services are terminated? Client bank accounts CASS recognises third country banks firms will not need to close EEA bank accounts Potential issue with client money deposits in qualifying money market funds Not clear whether QMMFs authorised in EU will continue to be recognised Will the CASS rules change? FCA/UK has always led the way with client money rules EU/MiFID level protections much less detailed/prescriptive Expect FCA to maintain high standards and focus The FCA does not see the UK s withdrawal from the European Union as an opportunity to join a race to the bottom in regulatory standards quite the contrary. Charles Randell, Chairman of the FCA quoted in FT on 2 October

9 Handling FCA investigations, Alison McHaffie 9

10 The FCA s focus on CASS An area of focus for the FCA Recent examples.. Beaufort Securities insolvency (ongoing) One Call Insurance Services Limited (August 2018) Failure to achieve risk transfer led to fine ( 684,000) and a restriction and personal fine for director General trend towards more intrusive visits and desk-based reviews Scrutiny of auditor s submission of annual CASS report or firm s submission of monthly Client Money and Asset Return (CMAR) Oversight of Third Party Administrators (TPAs) 10 Increasing use of attestations & focus on personal accountability CF10a asked to take personal responsibility In line with move to SMCR one of the prescribed responsibilities and a CASS Oversight Function in Certification Regime We have issued repeated warnings to the industry on the importance of complying with client money rules which are designed to ensure that client money is adequately protected in the event of a firm failing. There can be no excuses given these warnings and the stakes involved.senior management are ultimately responsible for ensuring that firms are following our rules. Mark Steward, July 2016

11 What goes wrong? (1) Breach of FCA principles (as well as breaches of specific CASS rules) A firm must arrange adequate protection for client assets (Principle 10) The elements of adequate protection include: Documented procedures Management oversight Regular testing and reporting Segregation and protection Reconciliations Common breaches Failure to recognise client money Inadequate senior management oversight / management information (MI) Overcomplicated processes Failure to segregate Operational/systems changes not thought through Failure to obtain client bank account trust letters Failure to perform internal/external reconciliations accurately and on time Failure to adequately oversee Third Party Administrators Inadequate resolution packs FCA/auditors will check compliance with CASS 10 11

12 What goes wrong? (2) 12 Triggers for investigation and enforcement action: Actual or risk of loss to clients (including risk of set off by banks) Risk of delay in return of money Failure to heed warnings from the FCA to industry to strengthen oversight Failure to respond to auditor concerns Lengthy breaches Systemic importance of firm Failure to identify or notify breaches/failure to deal with the FCA in open and cooperative manner Significant systems & controls failings False attestations Governance or cultural failings failure to train Previous fines These failures may have arisen as a result of honest mistakes but failures to comply with these rules mean client money was not adequately protected. One Call Insurance Services Limited (August 2018)

13 Identifying and dealing with breaches What should you do if you identify a potential CASS breach? Scoping exercise what has gone wrong? How material is the breach? 1. Quantum of sums affected, subject to the following caveats Should not be deciding factor (e.g. may still be serious systems and controls failing); and No loss is not a defence to FCA enforcement action 2. Frequency/recurrence of the breach 3. Length of the breach, including length of time breach went undetected; 4. Evidence of weak systems and controls; and 5. Potential impact of the breach on firm, its clients and/or other market participants What remedial action is required? Take pro-active steps Notifying the FCA of CASS breaches CassRiskInbox@fca.org.uk CASS reporting rules Without delay in specified circumstances for material failures or non compliance or inability to comply Principle 11 anything which regulator might reasonably expect notice of SUP R significant rule breaches 13

14 Handling FCA investigations Seeking to avoid an enforcement investigation referral Robust systems and controls kept under review Prompt and effective notification of any breaches (note, not a defence ) Accurate attestations Firm identifies and carries out remedial action on own initiative No risk of loss or delay Maintaining good and constructive relationship with the FCA supervisors Managing an investigation effectively Prompt and well ordered response to requests for information and well prepared interviewees Put issues in context and show actions were reasonable Seek to understand FCA s concerns and address them early in the process Show lack of risk to clients consider expert insolvency practitioner evidence Show lessons learned and acted on by firm Settle where appropriate 14

15 Protection against CASS breaches Step 1 gaining fundamental assurance Review every cash flow, client agreement and outsourcing Step 2 validating segregation Review banks, due diligence, trust letters etc. Step 3 validating systems and controls Review procedures, reconciliations and oversight of outsourcing Step 4 validating governance Review senior management oversight, change management, review procedures and training etc. 15

16 Any questions? 16

17 Your free online legal information service. A subscription service for legal articles on a variety of topics delivered by . cms-lawnow.com Your expert legal publications online. In-depth international legal research and insights that can be personalised. eguides.cmslegal.com CMS Legal Services EEIG (CMS EEIG) is a European Economic Interest Grouping that coordinates an organisation of independent law firms. CMS EEIG provides no client services. Such services are solely provided by CMS EEIG s member firms in their respective jurisdictions. CMS EEIG and each of its member firms are separate and legally distinct entities, and no such entity has any authority to bind any other. CMS EEIG and each member firm are liable only for their own acts or omissions and not those of each other. The brand name CMS and the term firm are used to refer to some or all of the member firms or their offices. CMS locations: Aberdeen, Algiers, Amsterdam, Antwerp, Barcelona, Beijing, Belgrade, Bogotá, Berlin, Bratislava, Bristol, Brussels, Bucharest, Budapest, Casablanca, Cologne, Dubai, Dusseldorf, Edinburgh, Frankfurt, Geneva, Glasgow, Hamburg, Hong Kong, Istanbul, Kyiv, Leipzig, Lima, Lisbon, Ljubljana, London, Luxembourg, Lyon, Madrid, Manchester, Medellín, Mexico City, Milan, Monaco, Moscow, Munich, Muscat, Paris, Podgorica, Poznań, Prague, Rio de Janeiro, Reading, Rome, Santiago de Chile, Sarajevo, Seville, Shanghai, Sheffield, Singapore, Sofia, Strasbourg, Stuttgart, Tehran, Utrecht, Vienna, Warsaw, Zagreb and Zurich. This presentation is intended to highlight potential issues and provide general information and not to provide legal advice. You should not take, or refrain from taking, action based on its content. If you have any questions, please contact your main contact partner at the relevant CMS member firm. cms.law 17