Extension of the Senior Managers and Certification Regime to insurers May 2018

Extension of the Senior Managers and Certification Regime to insurers May 2018

2 Extension of the Senior Managers and Certification Regime to insurers

Linklaters 3 Contents 1. Senior Managers Regime 6 2. Certification Regime 8 3. Conduct Rules 9 4. Incoming branches 10 5. How can we help? 11

4 Extension of the Senior Managers and Certification Regime to insurers Introduction New rules on individual accountability for insurers will apply from 10 December 2018. From this date, the Senior Managers and Certification Regime (SMCR) will be extended to cover all PRA- and FCA-regulated insurance and reinsurance firms. While insurers are already subject to the PRA s Senior Insurance Managers Regime (SIMR), which is similar to the existing Senior Managers Regime for banks and PRA-designated investment firms, there are significant elements of the SMCR which will be new to insurers. The PRA and FCA have published consultation papers on extending the SMCR to insurers, applying the duty of responsibility to insurers and on the operational aspects of implementing the SMCR, including transition. These consultations include proposals to: > > replace the FCA s Approved Persons Regime for insurers with the Senior Managers Regime; > > apply new individual accountability requirements to insurers, such as handover procedures and the duty of responsibility; > > extend the Certification Regime to apply to insurers for the first time; and > > make almost all employees of insurers subject to the Conduct Rules. The SMCR is part of the regulators drive to improve culture, governance and accountability within financial services firms. It aims to deter misconduct by improving individual accountability and awareness of conduct issues across firms. This note highlights some of the main changes and points to note for insurers based on the new rules proposed by the FCA and PRA. It focuses on the proposals for UK insurers but also comments on some of the key variations for UK branches of non-uk insurance firms. We have produced separate notes on the FCA s plans to extend the SMCR to all other FSMA-authorised firms in mid- to late-2019. 1 Please contact us if you have any queries. 1 Extension of the Senior Managers and Certification Regime, July 2017, and Operational aspects of the SMCR extension, January 2018

Linklaters 5 Overview of the application of the SMCR to insurers Solvency II firms and large Non- Directive Firms (NDFs) Small NDFs EEA branches Non-EEA branches Insurance Special Purpose Vehicles (ISPVs) Senior Management Functions 15 PRA SMFs and 7 FCA SMFs 2 3 PRA SMFs and 4 FCA SMFs No PRA SMFs and 2 FCA SMFs 14 PRA SMFs and 5 FCA SMFs 3 PRA SMFs and 3 FCA SMFs Overall responsibility function Duty of responsibility Applies to all firms Prescribed Responsibilities 19 in total, 3 FCA only 9 in total, 3 FCA only N/A 16 in total, 3 FCA only 5 in total, 2 FCA only Statements of Responsibilities Applies to all firms Management Responsibilities Maps Handover procedures Fitness and Propriety Applies to all firms Certification Regime Applies to all firms Conduct Rules Applies to all firms 2 Excluding SMFs that only apply to the Society of Lloyd s.

6 Extension of the Senior Managers and Certification Regime to insurers 1. Senior Managers Regime The PRA s SIMR and the FCA s Approved Persons Regime for insurers will be replaced by the Senior Managers Regime. Senior Management Functions (SMFs) > > Overall responsibility: Solvency II firms and large NDFs must ensure that every activity, business area and management function of the firm has a Senior Manager with overall responsibility for it. If that individual does not hold another Senior Manager role, they must be approved for the Other Overall Responsibility function (SMF18). Except for CASS oversight (Prescribed Responsibility Z), prescribed responsibilities cannot be allocated to SMF18s. > > Legal function: The overall responsibility rule applies to the firm s regulated and unregulated financial services activities (including any related ancillary activities). The FCA is currently reviewing its policy on whether a Senior Manager should be appointed to have overall responsibility for the Legal function and we expect the outcome of that review to apply equally to banks and insurers. > > Compliance function: The FCA s current Compliance Oversight function (CF10) applies to life insurers only in relation to certain parts of the FCA Handbook. Under the SMCR, the Compliance Oversight function (SMF16) will apply to all insurers for all requirements of the regulatory system for which the FCA is responsible. > > Chair of the With-Profits Committee: Firms may today have a with-profits advisory arrangement for which no individual requires regulatory approval. Under the SMCR, this type of arrangement will require a Senior Manager to be approved as Chair of the With-Profits Committee (SMF15). > > Territorial application: The Senior Managers Regime applies to anyone who performs a Senior Manager role, whether they are based in the UK or overseas. > > Conversion to SMCR: Where possible, Approved Persons at small NDFs and ISPVs will be automatically converted to the corresponding new SMF when the new regime takes effect and these firms need take no action. Every Senior Manager at one of these firms must have a Statement of Responsibility (SoR) in place which may be made available to the FCA on request but does not need to be submitted ahead of the commencement date. Solvency II firms and large NDFs will need to submit a SoR, their Management Responsibilities Map (MRM) and a Form K to convert each of their Approved Persons to SMFs.

Linklaters 7 Other new requirements > > Duty of responsibility: The wellpublicised statutory duty of responsibility that already applies to Senior Managers within banks will be applied to all Senior Managers of insurers. If a firm breaches a regulatory requirement, the Senior Manager with responsibility for the area in which the breach occurred could be held to account if they failed to take reasonable steps to prevent the breach from occurring or continuing. > > Handover of responsibilities: Solvency II firms and large NDFs must take all reasonable steps to ensure Senior Managers are provided with the information and materials they could reasonably expect to perform their responsibilities effectively. Those firms must also have a policy explaining how they comply with this requirement and maintain adequate records of the steps they have taken. > > PRA prescribed responsibilities: These are focussed on the PRA s objectives for prudential soundness and the PRA has amended some of the responsibilities set out in SIMR. Solvency II firms and large NDFs must allocate four prescribed responsibilities (which are shared with the FCA) on ensuring that the firm meets its SMCR obligations, including responsibility for obligations arising under the new Certification Regime. ISPVs and small NDFs must also allocate responsibilities for the operation of SMCR. > > FCA prescribed responsibilities: The FCA specifies additional prescribed responsibilities and a shorter list of prescribed responsibilities applies for small NDFs and ISPVs than for Solvency II firms and large NDFs. > > SoRs: Scope of Responsibilities under the SIMR will be renamed Statements of Responsibility. Significant changes to a Senior Manager s functions will require an updated SoR to be provided to the PRA/FCA. > > MRMs: Governance Maps for Solvency II firms and large NDFs will be renamed Management Responsibilities Maps. Firms should include a record of any matters reserved to the governing body in the MRM. Small NDFs and ISPVs are not required to have an MRM but must continue to identify an individual who has responsibility for keeping up to date records of how responsibilities have been apportioned. > > Moving between insurers and banks: Following the extension of the SMCR to insurers, individuals may seek to move from an SMF at a bank to an SMF at an insurance firm (and vice versa) by submitting to the PRA either a Short Form A or a Form E. > > Criminal record checks: Insurers must undertake a criminal record check as part of each Senior Manager approval application. This will also apply to NEDs who are not Senior Managers where a fitness requirement already applies to them. The SIMR already requires criminal record checks to be carried out on prospective Senior Managers. Accordingly, firms do not need to perform checks on Approved Persons who are converting to the SMCR. > > Checking conversion: Insurance firms must check that the financial services register correctly reflects their senior management population and notify the FCA of any errors by 17 January 2019. Comment > > Most of the differences between the SIMR and the new SMCR are incremental. However, work is needed to appropriately allocate new and amended prescribed responsibilities among the expanded Senior Manager population. > > Moving from the Approved Persons Regime to the SMCR requires preparation to ensure that, where necessary, the current Controlled Functions map to their corresponding SMFs. The deadline for Solvency II firms and large NDFs to submit their Form K, together with the SoRs for their Senior Managers, is 3 December 2018.

8 Extension of the Senior Managers and Certification Regime to insurers 2. Certification Regime The Certification Regime is a significant element of the proposals to extend the SMCR because insurers have not been subject to these requirements previously. > > Certifying staff: Firms must issue certificates each year to individual employees performing certification functions to show that they are satisfied that the individual is fit and proper to perform that function. Firms must keep a record of all valid certificates. Certified Staff will not be subject to any separate fit and proper assessment by the PRA or FCA (although an assessment by the PRA will still need to be carried out for all new Key Function Holders (KFHs) under the Solvency II regime). > > PRA certification functions: Solvency II firms, large NDFs and ISPVs will be expected to certify KFHs who are not otherwise Senior Managers or NEDs. Material risk takers (MRTs) at Solvency II firms and large NDFs that are large firms 3 should also be certified. The PRA expects firms to consider whether individuals responsible for certain functions or activities (such as investment management, claims management and reinsurance) should be KFHs or MRTs. For small NDFs, the proposed PRA rules require individuals who are members of a firm s governing body (other than Senior Managers and NEDs) and employees who report directly to the governing body to be certified. > > FCA certification functions: The FCA will extend its Certification Regime to all insurers. The FCA recognises that in practice some of its eight certification functions (such as algorithmic trading) are more relevant to banks/investment firms and will not in practice apply to insurance firms. Only persons located in the UK or who deal with UK clients will fall within the FCA s Certification Regime. > > FS Register: The FCA has announced its intention to consult in summer 2018 on the scope of individuals listed on the Financial Services register, following public feedback about the fact that Certified Staff will not be listed after the extended SMCR takes effect. > > Four-week rule: Firms need not certify individuals appointed solely to cover the absence of an employee in a certification function whose absence is reasonably unforeseen and is for less than four weeks. > > Regulatory references: Solvency II firms and large NDFs must already obtain a regulatory reference going back six years before appointing a KFH. Under the SMCR, this requirement will be extended to include all those who are to perform a certification function and any NEDs who are not Senior Managers. The obligation will also apply to small NDFs in respect of candidates to perform a certification function or a SMF. When requested to provide a reference, firms must also include mandatory information, provide the reference in a standard template and update the reference if new, significant information comes to light. > > Conversion to SMCR: The new requirement for insurers to certify employees performing certification functions as fit and proper will come into effect a year after the commencement date of the SMCR for insurers, i.e. 10 December 2019. Firms do not need to obtain regulatory references for Certified Staff until the time at which they decide whether to issue a certificate to those employees. Comment > > Based on our experience of working with banks, the task of mapping and identifying all certification roles within an organisation can be challenging, particularly given the inexact nature of the read-across from the existing Approved Persons Regime. > > As a Senior Manager must take on responsibility for the ongoing operation of, and compliance with, the Certification Regime, it will also be important to establish robust tracking and monitoring procedures as part of the initial identification exercise. 3 The PRA intends that a large firm would be a firm with an annual premium income (gross of reinsurance) of more than 1 billion in each of the previous three financial years, or with assets (including any reinsurance) related to regulatory activities of more than 10 billion at the end of each of the last three financial years.

Linklaters 9 3. Conduct Rules The extension of the Conduct Rules means that virtually everyone who works in the insurance industry will be expected to meet specified standards of behaviour. > > FCA Conduct Rules: The FCA will extend its Individual Conduct Rules to apply to all employees at all insurers, other than ancillary staff (e.g. catering staff, receptionists, etc). Senior Managers must also observe the FCA Senior Manager Conduct Rules. The Conduct Rules apply to all regulated and unregulated financial services activities of the firm (including any ancillary activities carried on in connection with a regulated activity). > > PRA Conduct Rules: The PRA will extend the application of its Individual Conduct Rules to all PRA Senior Managers, specified FCA Senior Managers and Certified Staff (including KFHs) at Solvency II firms, large NDFs and ISPVs. As under the SIMR, PRA Senior Managers, specified FCA Senior Managers and KFHs must also observe the additional Senior Manager Conduct Rules. For small NDFs, the PRA will only apply its three Individual Conduct Rules to Senior Managers and Certified Staff. Any person performing a Senior Manager role on a temporary basis (in accordance with Conduct Rules the twelve week rule) will be subject to the PRA s Individual Conduct Rules. > > NEDs: NEDs who are not Senior Managers will be subject to the Individual Conduct Rules plus FCA Senior Manager Conduct Rule 4 and PRA Senior Manager Conduct Rules 4 and 5. > > Training: Firms must take all reasonable steps to ensure that staff subject to the Conduct Rules understand how those rules apply to them. > > Notification of Conduct Rule breaches: Firms will need to notify the PRA and FCA of disciplinary action taken against a person in relation to an action which amounts to a breach of a Conduct Rule. A shorter timeframe for notification applies where disciplinary action has been taken in relation to a Senior Manager, a NED or someone who is PRA Certified Staff. Firms continue to be subject to overarching reporting obligations pursuant to Principle 11 and Fundamental Rule 7. > > Transitional arrangements: The Conduct Rules will apply to all Senior Managers and Certified Staff from 10 December 2018 and firms must have trained them on the Conduct Rules by this date. The FCA proposes allowing a further 12 months before applying the Conduct Rules to other relevant staff to give firms time to train employees on the new standards. Comment > > In addition to designing and delivering appropriate training ahead of commencement, firms will need to put in place policies and procedures to cover the training of new personnel (potentially including personnel based overseas) on an ongoing basis and supplement existing disciplinary processes in order to comply with the breach notification requirements. This is likely to require a combination of input from Compliance, HR and other parts of the firm, with a robust policy framework being important both to support the firm s continuing compliance with the SMCR and enable the Senior Manager with the prescribed responsibility for the firm s performance of its obligations under the Conduct Rules to discharge his/her individual responsibility. Individual Conduct Rules Senior Manager Conduct Rules 1 You must act with integrity. 1 You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively. 2 You must act with due skill, care and diligence. 3 You must be open and co-operative with the FCA, the PRA and other regulators. 4 You must pay due regard to the interests of customers and treat them fairly. (FCA only) 5 You must observe proper standards of market conduct. (FCA only) 2 You must take reasonable steps to ensure that the business of the firm for which you are responsible complies with the relevant requirements and standards of the regulatory system. 3 You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively. 4 You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice. 5 When exercising your responsibilities, you must pay due regard to the interests of current and potential future policyholders in ensuring the provision by the firm of an appropriate degree of protection for their insured benefits. (PRA only)

10 Extension of the Senior Managers and Certification Regime to insurers 4. Incoming branches As is the case under the SMCR for banks, a more limited application of the SMCR will apply to UK branches of non-uk firms. The rules vary depending on whether the branch is a UK branch of an EEA firm (EEA branches) or a UK branch of a third country firm (Non-EEA branches). EEA branches > > The only SMFs being proposed for EEA branches are the EEA Branch Senior Manager function and the Money Laundering Reporting Officer function (both FCA SMFs). > > The prescribed responsibilities and requirement for handover procedures will not apply to EEA branches. EEA branches will, however, be required to produce MRMs unless their home Member State sets equivalent rules. > > The Certification Regime and Conduct Rules will apply to EEA branches as for Solvency II firms. However, the Certification Regime and the Conduct Rules will only apply to individuals who are based in the UK. Non-EEA branches > > The PRA SMFs for Non-EEA branches reflect those that currently apply under the SIMR. > > The FCA s new Other Local Responsibility (SMF22) function will operate in a similar way to the Other Overall Responsibility (SMF18) function. It will include any individuals who have local responsibility for any of the activities, business areas or management functions of the branch. Therefore, if a branch has allocated local responsibility for all the activities, business areas and management functions of the branch between its other SMFs, it will not need to have any individuals approved under the Other Local Responsibility function. > > The Systems and Control (CF28), the Significant Management (CF29) and the Chair of the Nominations Committee (CF2a) functions are not separate Senior Manager roles under the SMCR. However, these functions map to the Other Local Responsibility function (or in the case of the CF29 function to a certification function) and so the FCA does not expect the proposals to result in a significant change from the current regime. > > 16 prescribed responsibilities are intended to apply to Non-EEA branches. FCA prescribed responsibilities can only be allocated to individuals performing executive functions in the branch and (other than the CASS prescribed responsibility) they cannot be allocated to those holding the Other Local Responsibility function. > > UK branches of non-eea firms will be required to submit a MRM. > > The Certification Regime and Conduct Rules will apply in the same way as for Solvency II firms. However they will apply only to the activities of the branch and to individuals based in the UK. Comment > > Non-EEA branches will need to consider the best approach for communicating how their management and governance arrangements for the branch fit with those of the overseas head office and wider group as part of their MRMs.

Linklaters 11 5. How can we help? In summer 2018, the PRA and the FCA will publish the final rules that will apply to PRA- and FCA-regulated insurance and reinsurance firms from 10 December 2018. Linklaters has an unparalleled depth and breadth of expertise in advising on the SMCR and related governance and risk management issues, in both the advisory and contentious context. We were instructed by over 15 global banks and insurers in relation to the implementation of the SMCR and the SIMR, are currently advising a number of firms on the proposed extension, and continue to have regular dialogue with regulators and the industry in relation to its operation. Our work on the existing SMCR and SIMR regimes enables us to provide firms facing the challenge of implementing the PRA and FCA s proposed new rules with valuable insights in relation to the tasks they face, including industry / peer benchmarking as well as details of regulatory and industry perspectives on common areas of concern and how other firms have addressed these previously. Please contact one of your usual Linklaters contacts if you would like to discuss further how we might be able to assist you. Contacts Duncan Barber Partner (Insurance) Tel: +44 20 7456 3356 duncan.barber@linklaters.com Victoria Sander Partner (Insurance) Tel: +44 20 7456 3395 victoria.sander@linklaters.com Nik Kiri Partner (Financial Regulation Group) Tel: +44 20 7456 3256 nikunj.kiri@linklaters.com Julia Dixon Partner (Financial Regulation Group) Tel: +44 20 7456 4406 julia.dixon@linklaters.com

linklaters.com Linklaters LLP. All Rights reserved 2018 Linklaters LLP is a limited liability partnership registered in England and Wales with registered number OC326345. It is a law firm authorised and regulated by the Solicitors Regulation Authority. The term partner in relation to Linklaters LLP is used to refer to a member of Linklaters LLP or an employee or consultant of Linklaters LLP or any of its affiliated firms or entities with equivalent standing and qualifications. A list of the names of the members of Linklaters LLP and of the non-members who are designated as partners and their professional qualifications is open to inspection at its registered office, One Silk Street, London EC2Y 8HQ, England or on www.linklaters.com and such persons are either solicitors, registered foreign lawyers or European lawyers. Please refer to www.linklaters.com/regulation for important information on our regulatory position. 8208_F/05.18