SUPERVISION AND OVERSIGHT FSA S APPROCH TO SUPERVISION AND RISK STATUTORY FRAMEWORK

SUPERVISION AND OVERSIGHT FSA S APPROACH TO SUPERVISION AND RISK STATUTORY FRAMEWORK I FSA S APPROCH TO SUPERVISION AND RISK 1. FSA: THE STATUTORY FUNCTIONS The FSA has a series of statutory functions: granting authorisation; making rules and guidance; supervising authorised firms; supervising markets; and taking enforcement action. This is all done in the context of four regulatory objectives, effectively, a statutory mission statement: In discharging its general functions the Authority must, so far as is reasonably possible, act in a way - (a) (b) which is compatible with the regulatory objectives; and which the Authority considers most appropriate for the purpose of meeting those objectives. (2000 FSMA s. 2(1)) There are four regulatory objectives : Market confidence: maintaining confidence in the financial system (2000 FSMA s. 3(1)). Hence, FSA makes rules on: market abuse and listing/offering of securities and exchanges and clearing houses. Public awareness: promoting public understanding of the financial system (2000 FSMA s. 4(1)). Hence, FSA: publishes leaflets/booklets on investor protection issues and is involved in school curricula for financial education. Protection of consumers: securing the appropriate degree of protection for consumers (2000 FSMA s. 5(1)). Hence, there are FSA rules on: disclosure AND conduct AND 1

compensation scheme AND complaints handling by firms AND the Financial Ombudsman. Reduction of financial crime: reducing the extent to which it is possible for a business carried on (a) by a regulated person or (b) in contravention of the licensing requirement to be used for a purpose connected with financial crime ( 2000 FSMA s. 6(1)). Hence, FSA makes rules on: Licensing; and market abuse; and money laundering 2. FSA S GENERAL FUNCTIONS The FSA s general functions are: Making rules under FSMA Preparing and issuing codes under FSMA Giving general guidance; and Determining the general policy and principles by reference to which it performs those functions. (2000 FSMA s. 2(4)) In discharging these general functions FSA must have regard to 7 so-called principles of good regulation : (a) (b) (c) (d) (e) (f) (g) the need to use its resources in the most efficient and economic way; the responsibilities of those who manage the affairs of authorised persons; the principle that a burden or restriction which is imposed on a person, or on the carrying on of an activity, should be proportionate to the benefits, considered in general terms, which are expected to result from the imposition of that burden or restriction; the desirability of facilitating innovation in connection with regulated activities; the international character of financial services and markets and the desirability of maintaining the competitive position of the United Kingdom; the need to minimise the adverse effects on competition that may arise from anything done in the discharge of those functions; the desirability of facilitating competition between those who are subject to any form of regulation by the Authority. (2000 FSMA s. 2(3)) 3. FSA S RULEMAKING POWERS 2

FSA has general rule-making powers (2000 FSMA s. 138) which apply to authorised person with respect to the carrying on by them of regulated activities or with respect to the carrying on by them of activities which are not regulated activities but which appear to be necessary or expedient for the purpose of protecting the interests of consumers 1. (2000 FSMA s 138(1)) In addition, the FSA may also make rules applying to authorised persons who are investment firms or credit institutions with respect to the provision by them of relevant ancillary services 2 which appear to be necessary or expedient. (2000 FSMA s. 138(1A)) Rules made under s. 138 are referred to as FSA s general rules. The general rules may include requirements that where the authorised person is a member of a group it may take into account any activity of another member of the group and make provisions applying to authorised persons even though there is no relationship between the authorised persons to whom the rules will apply and the persons whose interest will be protected by the rules. FSA s power to make general rules is not, however, limited by any other power which the FSA has under FSMA (or other legislation such as the Consumer Credit Act) to make regulating provisions. The general rules may not, however make any provision incompatible with the UK s European obligations or in relation to any matter which is reserved to the EEA firm s home state regulator under the Single Market Directive. It may also not prohibit an EEA firm from carrying on or holding itself out as carrying on any activity which it has permission to carry on under Schedule 3 of FSMA. 4 FSA S MISCELLANEOUS RULE MAKING POWERS 1 Consumers in this context means persons who use, have used or are or may be contemplating using any of the services provided by authorised persons carrying on regulated activities or authorised persons who are investment firms or credit institutions in providing a relevant ancillary service or persons acting as appointed representatives who have rights or interest which are derived from or are otherwise attributable to the use of any such services by other persons or who have rights or interests which may be adversely affected by the use of any such services by persons acting on their behalf of or in a fiduciary capacity in relation to them. (2000 FSMA s 138(7)) Consumer also includes a person who deals with an authorised person in the course of the authorised person s carrying on of a regulated activity. (2000 FSMA s. 138(9)) 2 A relevant ancillary services means any service of a kind mentioned in Section B of Annex I of MiFID the provision of which does not involve the carrying on of a regulated activity for example granting credits or loans to an investor to allow him to carry out a transaction in financial instruments or giving corporate finance advice which is not investment advice or foreign exchange services where these are connected to the provision of investment services. 3

4.1 Client Money Rules In addition to the general rules, FSA may make client money rules relating to the handling of money held by an authorised person in specified circumstances 3 such that the money held will be held on trust in accordance with the rules. (2000 FSMA s 139(1)) The client money rules may also specify the treatment of two or more accounts as a single account for certain purposes in relation to the distribution rules in the event of a default by an authorised person and authorise the retention of interest accruing on client money held on trust. 4.2 Restrictions on managers of collective investment schemes The FSA may also make rules prohibiting authorised persons who act as managers of an authorised unit trust scheme or the management company of an authorised UCITS scheme from carrying on certain other activities, including regulated activities. (2000 FSMA s. 140(1)) 4.3 Restrictions on those effecting or carrying out contracts of insurance The FSA 4 may also make rules prohibiting authorised persons who have permission to effect or carry out contracts of insurance from carrying on certain specified activities and to make rules in relation to the contracts entered into by authorised persons carrying on business which involves the effecting or carrying out of contracts of long term insurance. (2000 FSMA s. 141(1) and (3)) 4.4 Price stabilisation rules The FSA may make rules as to the circumstances and manner and conditions subject to which action can be taken for the purpose of stabilising the price of investments of a kind specified in the general rules. The FSA may also make rules which provide that a person who acts or engages in conduct in accordance with the price stabilising rules will not be in breach of FSMA s. 397 (market manipulation). 4.5 Financial promotion rules 3 See FSA Handbook, CASS. 4 HM Treasury also has certain powers to make regulations supplementing the FSA s rules in relation to insurance business and, in particular, in relation to any acts which would lessen the effectiveness of the FSA s asset identification rules (2000 FSMA s. 142) 4

The FSA may make rules applying to authorised persons about the communication by them or their approval of communications made by other of invitations or inducements to engage in investment activities or to participate in a collective investment scheme but only communications which if made by a person other than an authorised person without the approval of an authorised person would contravene section 21 of FSMA or may be made by an authorised person without contravening s. 238 of FSMA in relation to the promotion of unregulated collective investment schemes 5. (2000 FSMA s. 145(1)) These rules may include provisions regarding the form and content of such communications. 4.6 Money laundering rules The FSA may make rules in relation to the prevention and detection of money laundering in connection with the carrying on of regulated activities by authorised persons. 6 4.7 Control of information or Chinese Wall rules The FSA may also make rules (control of information rules) about the disclosure and use of information held by authorised persons. (2000 FSMA s. 147(1)) These rules may require authorised persons to withhold information which the authorised person would otherwise have to disclose to a person for or with whom the authorised firm does business int eh course of carrying on a regulated activity or specifying the circumstances in which the authorised person may withhold information which he would otherwise have to disclose or require the authorised person not to use information which the authorised information hold for the benefit of another person or to specify the circumstance in which the authorised person may decide not to use that information for the benefit of another person. 5 MODIFICATION AND WAIVER OF FSA S RULES 5 The FSA may also make rules in relation to a communication what would not contravene s. 21 if made by a person other than an authorised person without the approval of an authored person if the communication is a communication to which Treasury regulations apply and that the authority considers that any of the requirements of paragraphs 1 to 8 of Article 19 (conduct of business) of MiFID or any implementing measure made under paragraph 10 of Article 19 of MiFID apply (marketing communications) and the FSA considers such rules necessary to ensure that the communication satisfied those MiFID requirements. 6 Although the FSA has made rules in relation to money laundering, the FSA repealed its Money Laundering Sourcebook in its entirety from 31 August 2006. 5

The FSA may, in certain circumstances, modify or waive certain of its rules such that all or any of those rules (other than rules made under s. 247 or 248 of FSMA) may not apply to that person or are to be applied to him with such modifications as FSA may direct. (2000 FSMA s. 148). In making such modifications or waivers, the FSA must take into account whether the direction relates to a rule contravention of which is actionable under s. 150 of FSMA and consider whether the publication of the direction would prejudice to an unreasonable degree the commercial interests of the person concerned or any other member of that persons immediate group and whether the publication would be contrary to any international obligation of the UK 7. 6 CONTRAVENTION OF FSA RULES A person is not guilty of an offence by reason of a contravention of a rule 8 made by the FSA and the contravention of a rule does not render a transaction void or unenforceable. (2000 FSMA s. 151) However, the contravention of certain rules 9 is actionable at the suit of a private person 10 who suffers loss as a result of the contravention subject to the defences and other incidents applying to actions for a breach of statutory duty. (2000 FSMA s. 150) 7 Because MiFID is a maximum harmonising directive, FSA s ability to modify or waive conduct of business rules derived from MiFID is strictly limited by Article 4 of Commission Directive 2006/73/EC (the Implementing Directive) which provides that if Member States wish to retain or impose requirements additional to those in that directive they may only do so in exceptional cases where such requirements are objectively justified and are proportionate so as to address specific risks to investor protection or to market integrity that are not addressed in the Implementing Directive and provided certain conditions are met. 8 S. 417 of FSMA defines rule as a rule made under FSMA therefore including the general rules as well as those other rules made under Part X of the Act. 9 This does not include the Part 6 rules in relation to prospectuses or the financial resources rules. (2000 FSMA s. 150(4)) 10 HM Treasury has made regulations under the Financial Services and markets Act 2000 (Rights of Action) Regulations 2001, SI 2001/2256 and the Financial Services and Markets Act 2000 (Fourth Motor Insurance Directive) Regulations 2002, SI 2002/2706 defining a private person for the purposes of this section. 6

II FSA S APPROACH TO SUPERVISION AND RISK 1. THE FINANCIAL MARKETS ARE BASED ON RISK Commercially, a return requires some form of risk-taking. The issue, therefore, is what constitutes an acceptable level of risk. If you are investing your own money the acceptable level of risk depends on your appetite for risk. However, even then, the risk you take can have a knock-on effect to other people. And when you are responsible for other people s money, there may be a need to limit risk-taking. Thus, the FSA acknowledges that risk must exist and does NOT seek to eliminate risk, but sets parameters/limits for risk. FSA looks at risk in two ways: how it is going to ensure that firms within the system manage their risks to the mandated levels. Here the regulator itself has only finite resources and, therefore, must decide how best to use them; AND how the firm itself is going to manage its risk. The regulator prescribes a methodology for the firm to follow in its Systems and Controls and Regulatory Capital rules. 1 FSA ALLOCATES ITS RESOURCES BY LOOKING AT THE RISK POSED TO ITS STATUTORY OBJECTIVES The risks that we. focus on are those that pose a risk to the achievement of our statutory objectives this is a different perspective of risk than that normally managed by a firm ( The Risk Assessment Framework, FSA, February 2003). This is so-called Risk based regulation, as a result of three factors. First, limited regulatory resources. Second, a wish to differentiate between regulation of (a) retail investors, which is relatively heavy, and (b) wholesale markets with professional investors, which is relatively light. And, third, the reality that no (proper) regulatory regime in (risky) financial markets can or should be a zero failure regime: Given the many possible events that could have a negative effect on the financial markets and our limited resources, our risk-based approach is based on a clear statement of the realistic aims and limits of regulation. In other words, we accept that we can never entirely eliminate risks to the statutory objectives - our non-zero failure approach. And although the idea that regulation should seek to eliminate all failures may look superficially appealing, in practice this would impose prohibitive costs on the industry and consumers. Consumers benefit from healthy, competitive markets, where different firms try to meet their needs, and this is recognised in the Financial Services and Markets Act 2000 (FSMA). ( The FSA s Risk Assessment Framework, August 2006) 3 HOW FSA MEASURES RISK The FSA has said that it considers its risk priorities on the basis of the impact of the problem occurring multiplied by the probability of the problem occurring, taking into account such factors as the size of the firm, the type and number of consumers/customers affected, the perceived importance of the risk, the risk to the ongoing business of the firm and the control measures which have been or could be put in place to mitigate the risk. 7

PRIORITY = IMPACT X PROBABILITY To assess probability the FSA uses a high-level schematic of a firm which groups its assessment of that firm based on three risk types divided into five risk groups under ten headings. (FSA, SUP 1) Business Risk including: Environmental Risk including Economic environment Legislative / political environment Competitive environment Capital market efficiency Customers, Products and Markets including: Institutional Client / Counterparty Characteristics Retail customer characteristics Institutional product / market characteristics Retail product characteristics Distribution channels Conflicts of interest Business Processes including Litigation / legal risk People risk IT systems Structure and ownership Other business process risk Prudential Risk including Element 1 - Credit Risk, comprising: - Corporate credit risk - Retail credit risk - Credit risk in a trading environment, or counterparty risk Element 1 - Market Risk, comprising: - Market risk in the trading book Element 1 - Operational Risk Insurance Underwriting Risk Liquidity Risk Element 2 Risks (Pillar 2 related) Element 4 Risks (Pillar 2 related) Control Risk including: Customer, Product & Market Controls including: Accepting customers Sales process and product development Post sale handling of customers / counterparties Market conduct controls Conflicts of interest management Membership arrangements 8

Financial & Operating Controls including: Clearing and settlement arrangements Financial controls IT security and controls Policies, procedures and controls Human resources controls Security of client assets or money Business continuity planning Prudential Risk Controls including: Element 1 - Credit Risk Controls, comprising: - Corporate credit risk controls - Retail credit risk controls - Credit risk controls in a trading environment Element 1 - Market Risk controls Element 1 - Operational Risk controls Insurance Risk controls Liquidity Risk controls Element 2 controls (Pillar 2 related) Element 4 controls (Pillar 2 related) Oversight & Governance Risk including: Control Functions including: Compliance monitoring and guidance Internal audit Enterprise-wide risk management Management, Governance & Culture including: Culture and management Corporate governance Relationship with regulators Strategic planning Relationship with rest of group Quality of ICAAP These headings capture the essential components of a firm that are of interest to the FSA. The main steps in the FSA s risk assessment process are: preliminary assessment of a firm's potential impact on the regulatory objectives; probability assessment - the level of detail depends on the impact rating and the complexity of the firm (in the case of low impact firms, the firm-specific probability analysis will be minimal); for a sample of firms, validation panel for peer review of risk grading and resource allocation; letter to firm regarding risk assessment and any remedial actions (see SUP 1.3.10 G); and continuing review of risk assessment as necessary. 9

This covers the inherent risks a firm chooses to take when determining its business model and how it controls those risks, both in a direct way and through the secondary controls it puts in place. When making its assessment FSA uses a simple four-point scale to rate each of the ten risk groups: High Medium High Medium Low Low FSA has said that over 95% of its authorised firms are classed as small (Low impact). These firms usually require no further assessment (aside from thematic work) and they do not have a single regulatory relationship manager and inspections are likely to occur only on an exceptions basis. Firms with an impact score of Medium-low or above receive periodic full assessments. The High Risk firms account for 64% of the total FSA impact score and 98% of traded market volumes. 4 FSA S APPROACH TO SUPERVISION The FSA's relationship with firms has five main elements: Determining satisfaction of the threshold conditions: in order to carry on regulated activities, a firm must demonstrate that it can satisfy, initially and on a continuing basis, the threshold conditions (see COND) (for example, the need to maintain adequate resources). Baseline monitoring which is designed to ensure that firms comply, on a continuing basis, with the regulatory requirements which apply to them (see SUP 1.1.2 G): the FSA collects and analyses data supplied by firms (see for example SUP 16) and by third parties such as the Financial Ombudsman Service Limited, consumers, and by other regulators. Sectoral reviews and thematic work which will be used, for example, to validate information provided by a firm and to collect up to date information on a particular sector, in order to assess whether a firm meets required standards: thematic work is carried out to assess the risks posed by a particular issue (rather than by a sector or group of firms). The issues selected for such work are likely to be broader and proportionately more significant to the FSA's regulatory objectives. 10

Programmes designed to mitigate specific risks in individual firms these programmes depend on the firm's priority for the FSA (see SUP 1.3.5 G). Work undertaken after particular risks have escalated or crystallised: once the FSA has identified an issue, it will need to use its regulatory judgment to determine how it should respond, if at all. The exact mixture of elements will thus vary with the firm's risk categorisation. Moreover, the elements being used at a particular time will depend on the firm's circumstances - for example, whether it is applying for permission to conduct other regulated activities, or is being investigated by the FSA. (SUP 1.3.12) 5 FSA s SUPERVISORY TOOLS In order to meet the regulatory objectives and address identified risks to those objectives, the FSA has a range of supervisory tools available to it. The FSA classifies these tools under four headings: diagnostic: designed to identify, assess and measure risks; monitoring: to track the development of identified risks, wherever these arise; preventative: to limit or reduce identified risks and so prevent them crystallising or increasing; and remedial: to respond to risks when they have crystallised. (SUP 1.4.2) Tools may serve more than one purpose. For example, supervisory powers can be used to address risks which have materialised or to assist in preventing risks from escalating. In the first instance they are remedial, in the second, preventative. Certain of these tools, for example the use of public statements to deliver messages to firms or consumers of financial services, do not involve the FSA in direct oversight of the business of firms. Other tools do involve a direct relationship with firms. The FSA also has powers to act on its own initiative to impose individual requirements on a firm (see SUP 7). The FSA uses a variety of tools to monitor whether a firm, once authorised, remains in compliance with regulatory requirements. These tools include: desk-based reviews; liaison with other agencies or regulators; 11

meetings with management and other representatives of a firm; on-site inspections; reviews and analysis of periodic returns and notifications; reviews of past business; transaction monitoring; use of auditors; use of skilled persons. (SUP 1.4.5 ) The FSA also uses a variety of tools to address specific risks identified in firms. These tools include: making recommendations for preventative or remedial action; giving other individual guidance to a firm; imposing individual requirements; varying a firm's permission in another way. 6 FSA S OPERATING FRAMEWORK In essence, FSA operates according to the following framework: How did FSA do in managing the risks to its Objectives? PERFORMANCE EVALUATION RISK IDENTIFICATION (1) (2) RISK ASSESSMENT AND PRIORITISATION (3) I.e. the FSMA powers to: supervise regulate enforce USING REGULATORY TOOLS (5) (4) RESOURCE ALLOCATION to the risks faced by: firms markets consumers products DECISION ON REGULATORY RESPONSE ARROW assesses each firm against the criteria in (2) to come up with a firm s: risks rating AND programme to manage the risk 12

Boxes (1) and (2) are explained as follows: (1) Risk Identification This is carried out by reference to FSA s view of the market, for example, now the perceived risks of (lack of) MiFID implementation. Annually FSA publish a Financial Risk Outlook and, based on it, a Business Plan which sets out its proposed activities/ actions by reference to its four Statutory Objectives. Here, FSA identifies both Thematic Risks AND Firm specific Risks. (2) Risk Assessment and Prioritisation FSA has a sophisticated methodology to relate risks in the Firm to the risks to its own Objectives which it has reviewed in the light of the supervisory issues relating to Northern Rock plc. See a summary of the review s recommendations at http://www.fsa.gov.uk/pubs/other/recommendations.pdf. 13