Clifford Chance

On 30 March 2023, the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) published joint Discussion Paper PRA DP1/23 and FCA DP23/3 - Review of the Senior Managers & Certification Regime (the DP), inviting views on potential improvements to the Senior Managers & Certification Regime (SMCR).

The DP, which forms part of the Government's Edinburgh Reforms package announced in December 2022, seeks views on the effectiveness, scope, and proportionality of the SMCR regime by asking firms to respond to 22 specific questions. The responses to the DP will aid the regulators in determining whether there are enhancements that might be made to the rules and guidance which implement the SMCR.

Separately, but in tandem, HMT has published a Call for Evidence (CFE) to examine the legislative framework of the regime.

Together, the DP and CFE are the first full review of the SMCR since its introduction in 2016 (although there have been more limited reviews previously), and will therefore offer a valuable insight into the overall effectiveness of the regime to date.

Of particular note, the DP includes several questions on the effectiveness of enforcement under the SMCR, and the responses to those questions are likely to offer interesting feedback on the regulators' approach to enforcement to-date.

Approach to enforcement under the SMCR to date

Since its introduction, the key aim of the SMCR has been to make individuals, and particularly the most senior individuals, within financial services firms more accountable for their conduct and competence. Under the regime, senior managers are allocated senior management functions (SMFs), and each SMF holder has a statutory "Duty of Responsibility". Under this duty, if a firm breaches a regulatory requirement, the regulators can take action against the SMF holder responsible for the part of the firm where the breach occurred if the senior manager did not take "reasonable steps" to prevent or stop the breach.

Senior mangers are also subject to Senior Manager Conduct Rules, in addition to the individual Conduct Rules that apply to nearly everyone in a regulated firm. These rules require each senior manager to take "reasonable steps" to ensure that the business of the firm for which they are responsible is controlled effectively, and complies with relevant regulatory requirements and standards. Further each senior manager must take reasonable steps to ensure that any delegation of their responsibilities is to an appropriate person and that they oversee the discharge of the delegated responsibility effectively. They must also disclose appropriately any information of which the regulators would reasonably expect notice.

The obligations imposed on senior managers under the SMCR mean that senior managers must not only take their own behaviour seriously, but must also seek to ensure that the behaviour of others within their area of responsibility is appropriate. As Jonathan Davidson, then Director of Supervision – retail and authorisations at the FCA, stated in a 2016 speech:
"We want senior individuals to feel genuine responsibility, and be held accountable for, the decisions they make and oversee."

In support of these aims, the regulators have extensive enforcement powers to take action against senior managers and other individuals where firms fail to comply with the SMCR. This includes the power to issue financial penalties and to prohibit individuals from performing certain functions.

In practice, however, the SMCR has been characterised by a lack of formal enforcement action. As at June 2022, a total of 120 enforcement investigations had been opened into SMCR individuals (71 concerning senior managers) since the introduction of the regime in 2016, but of the 57 closed cases (20 concerning senior managers), all but five were closed without any formal enforcement action and there have been no enforcement outcomes under the Duty of Responsibility or the Senior Manager Conduct Rules.

Why has there been a lack of enforcement outcomes in relation to accountability?

Views differ as to why there have been so few enforcement outcomes.

The regulators believe that the regime has been effective in raising standards of conduct amongst senior managers, meaning there has only been a limited number of potential accountability issues to investigate. So, whilst there have been more than 70 investigations into senior managers, only some of those have concerned the Duty of Responsibility and/or the Senior Manager Conduct Rules. Other investigations have involved other parts of the regime such as the individual Conduct Rules.

But it is also true that, in cases investigating whether there has been a breach of the Duty of Responsibility, the regulators have struggled to find the evidence necessary to take action. Whilst, when the regime was introduced, the Government and regulators were at pains to emphasise that they would be able to take action against senior managers for wrongdoing on their watch, regulators are still required to show individual fault on the part of a senior manager in discharging the Duty or in breaching the Senior Manager Conduct Rules and so far they have not managed to do so.

It is also noted that many of the investigations which have been opened, remain ongoing. As at June 2022, of the 71 investigations opened into senior managers only 24 had been closed. Most investigations last at least a year and a significant minority have lasted more than three years.

Is enforcement operating as an effective deterrent?

The DP indicates that the number of enforcement actions are low as the SMCR's aims have been pursued primarily through "preventative supervisory engagement". This perhaps implies an emerging belief by the regulators that the regime can be effective with limited enforcement. Given the extensive nature of the regulators' enforcement powers, the mere threat of enforcement, however remote, may be sufficient to promote compliance with the regime. Certainly in the early years of the regime, the uncertainty as to how the regulator might enforce likely acted as a deterrent. However, as the years have passed, and the level of enforcement has remained low, the deterrence value of the SMCR may have fallen. It will be interesting to see the extent to which this is reflected in the responses to the DP and, if so, what structural changes might address this concern.

Some may argue that the number of opened investigations is more relevant than the number of enforcement actions. Being under investigation by a regulator is inherently stressful and professionally disruptive, so the threat of an investigation may, of itself act as a deterrent in its own right. This is particularly notable in circumstances where the threshold for opening an investigation is so low – merely "circumstances suggesting" a serious issue.

Even so, the chances of being investigated appears to be fairly remote given that only 120 investigations were opened into individuals between 2016 and June 2022, and over 47,000 firms are now covered by the SMCR.

How can I input to the DP and CFE, and when will the results be known?

Respondents are asked to respond to the DP by completing an online survey linked in the DP. Respondents to the CFE are required to send their responses by email to SMCR@HMTreasury.gov.uk or by post.

Responses to the DP and CFE are requested by 1 June 2023, so it will be some time until the output of this exercise will be known.