Act now, don't pay later - FCA reminds firms to regularly review regulatory permissions

What has been said?

On 18 January 2021, the Financial Conduct Authority published a statement reminding firms to regularly review their regulatory permissions under FSMA to ensure that they are up-to-date and accurately reflect the firm's current activities.

The FCA expects firms to notify it of material changes and apply to make any necessary changes to permissions in a timely way. 

The FCA reminds firm that it has the power to cancel a firm's permissions if it has not carried on a regulated activity for at least 12 months.

The FCA also reminds firms that they must provide it with an annual attestation that the information held about it on the FCA Register is accurate.

Why it matters?

The FCA has the power to take action against firms where their activities and regulatory permissions differ. And the FCA's statement should be seen as fair warning to the industry that the FCA intends to address such inconsistencies going forward.

In the statement, the FCA says it is reminding firms now as new powers in the Financial Services Bill 2019-21 (currently making its way through Parliament) mean it will be able to act more quickly where it considers firms are no longer carrying out regulated activities. With the new powers, where the FCA believes that a firm is not carrying on a regulated activity, it will be able to serve notice on the firm, asking for a written response within 14 days. If the firm does not respond, the FCA will be able to publish a second, public notice, explaining it appears that the firm is not carrying on a regulated activity. It can then vary or cancel the firm's permissions after one month.

But that's potentially an extreme example. A less severe instance might involve the FCA noticing, or being made aware, that a firm's permissions are outdated on the register. Whilst that might not be a sizable issue taken on its own, maybe merely a case of administrative oversight, it does open the door for further investigation. Equally, for those firms already under scrutiny (or at risk of scrutiny) by the regulator, outdated permissions represent a further regulatory risk and can provide additional ammunition to any investigation.

What should firms do?

Now firms have been warned, and given this relates to matters entirely within a firm's control, firms should ask themselves whether they are comfortable that they have done all they can to ensure that their regulatory permissions are up to date. (And, under SMCR, this is the responsibility of the nitre senior management of a firm, not just the compliance officer.) 

Luckily, the solution is simple, if unglamorous - firms need to ensure they review and sense-check their FCA regulatory permissions at least annually and whenever there is a major change in the firm's business or activities. And whilst they're doing that, it makes sense to check all the standing data the form provides to the FCA to ensure that the firm's entry on the FCA register is accurate. 

These are not exciting tasks (or profit-generating in their own right), but they are matters within the control of every regulated firm and can go a long way to minimising risks, demonstrating robust systems and controls and showing good governance.

Of course, if firms have any questions about whether their permissions and activities are aligned, how to address any potential issues, how to handle changes to the firm's activity as its business evolves over time, or even where to start with all this, the team at Howard Kennedy would be delighted to assist.