Clifford Chance

On 11 January 2024, the Prudential Regulation Authority ("PRA") published its final notice issued to Iain Mark Hunter ("Mr Hunter"), former Chief Executive Officer ("CEO") of Wyelands Bank plc ("Wyelands"), fining him £118,808 for breaching three PRA Conduct Rules between 7 March 2016 and 28 May 2020.

This Final Notice follows on from the PRA's censure of Wyelands in April 2023 for wide-ranging significant regulatory failings relating to large exposure limits, capital reporting, governance and risk controls (for further information please read our previous blog post).

The PRA found that Mr Hunter failed both to act with due skill, care and diligence, and to take reasonable steps to ensure that Wyelands had adequate systems and controls in relation to the large exposures regime and PRA record keeping requirements.

In addition to holding the SMF1 CEO role throughout the relevant period, for part of the relevant period Mr Hunter was also SMF4 Chief Risk Officer ("CRO") and/or held SMF4 CRO responsibilities and assumed the reporting responsibilities of SMF2 Chief Financial Officer.

Failings

Mr Hunter was found to have breached PRA Individual Conduct Rule 2 ("ICR 2"), PRA Senior Manager Conduct Rule 1 ("SMCR 1") and PRA Senior Manager Conduct Rule 2 ("SMCR 2"):

• ICR 2 for failing to act with due skill, care and diligence, including by failing to comply with Wyelands' internal policy to mitigate potential conflicts of interest arising from its membership of the Gupta Family Group Alliance and failing to take appropriate steps to verify the accuracy of statements he made about Wyelands in two letters to the PRA.
• SMCR 1 for failing to take reasonable steps to ensure that the management and conduct of Wyelands' business was controlled effectively, including by failing to ensure that Wyelands clearly apportioned responsibility for conducting analysis of its' connected parties prior to March 2019.
• SMCR 2 for failing to take reasonable steps to ensure that Wyelands was complying with a number of relevant requirements and standards of the regulatory system, including by failing to ensure that Wyelands had in place a document retention policy in accordance with the record keeping obligations set out in the PRA Rulebook.

Penalty

The PRA fined Mr Hunter £118,808. In reaching this figure, the PRA applied a seriousness percentage of 25% (for reasons including Mr Hunter's experience, the persistence of his breaches and failings over several years, and his failure to take reasonable steps to ensure that Wyelands complied with its regulatory requirements) and also imposed an increase of the penalty for deterrence.

While Mr Hunter agreed to settle this matter, this agreement was reached after the end of the discount period and he therefore did not qualify for a 30% reduction in the penalty.

As part of the settlement, Mr Hunter gave an undertaking to the PRA that he would not apply for or perform any function relating to any regulated activity. In accepting the undertaking the PRA considered certain "exceptional factors" as particularly relevant, namely the fact that Mr Hunter's residence is outside the UK, his acceptance of the failings set out in the Final Notice and his agreement to pay the financial penalty.

Lessons for other regulated firms and individuals

1. Undertaking: The most notable aspect of this case is the fact that the PRA did not make a finding that Mr Hunter lacked fitness and propriety and, instead, accepted an undertaking from him that he would not apply for or perform any function relating to any regulated activity. There have been historic examples of undertakings being given following disciplinary action, but they are very rare and are likely to remain so. While the PRA cited certain "exceptional factors", it may be that getting the settlement over the line was as much of a relevant factor.

2. Individual accountability: This Final Notice highlights the continued focus of the PRA on individual accountability. It is the second time the PRA has issued a final notice to an individual for failures under the Senior Managers and Certification Regime within the last year (having fined the former Chief Information Officer of TSB Bank plc £81,620 in April 2023 for breaching PRA SMCR 2).

3. Higher standard of conduct expected of CEOs: In its Final Notice the PRA emphasised the importance of the CEO's role in ensuring their firm meets the standards expected of it. CEOs must exercise sound judgement, and the standards required of them are "more exacting" than for other employees of their firm.

4. Firms must have effective controls to manage conflicts and counterparty risk: The necessity of having effective risk management has been a theme of various PRA final notices over recent years. In the Final Notice issued to Mr Hunter the PRA highlighted the importance of effective controls relating to conflicts of interest and exposure to counterparties. A firm’s responsible senior management must take reasonable steps to identify, evaluate and manage potential or actual conflicts of interest which might threaten the safety and soundness of the firm and large exposures to individual counterparties or groups of connected counterparties.

According to the PRA, the weaknesses in Wyelands' controls resulted in it incurring a number of material exposures to counterparties which were significantly in excess of Wyelands' regulatory limits on large exposures, constituted a material portion of the firm’s loan book and resulted in an unacceptable concentration of risk in relation to those counterparties.

5. Record keeping: The PRA reiterated its criticism of the firm's document retention policy as stated in Wyelands' April 2023 censure. In particular the PRA called out the use of WhatsApp by some senior executives, directors and third parties for certain business activities, without there being formal record keeping policies or procedures in place to manage or retain such messages. The PRA noted that as CEO, Mr Hunter was required to take reasonable steps to ensure that Wyelands had adequate systems, controls and policies in place to meet its record keeping obligations, but he had failed to do so. The PRA emphasised that inadequate record keeping not only hinders a firm's ability to prudently manage risk but also hinders the PRA's ability to investigate that firm. In this case, Mr Hunter's failure to take reasonable steps to ensure Wyelands had adequate systems and controls to comply with record keeping obligations meant that Wyelands was unable to provide disclosure of documents of potential relevance to the PRA's investigation.

6. Importance of providing the PRA with accurate information: Mr Hunter made statements to the PRA about Wyelands without a sufficient basis to make them and without having taken adequate care to establish their accuracy. The PRA criticised this behaviour as the PRA relies upon firms and their senior representatives providing accurate, complete and timely information. The PRA has consistently emphasised the importance of providing it with accurate information and prudential data, and has brought disciplinary action on this theme a number of times. It will remain a key area of focus.

7. Continuing behaviour: The fact that Mr Hunter's breaches and failings persisted for several years contributed to the PRA's assessment of seriousness in ascertaining an appropriate level of penalty. Further, the PRA emphasised that a number of the failings had continued / occurred in the period after Mr Hunter received a letter from the PRA in July 2018 which identified weaknesses in Wyelands' risk management framework, noting that the PRA would have expected him to take "particular care" after the date of that letter.

The PRA has previously emphasised the importance of firms and individuals acting on the PRA's communications and warnings, and this is a factor that will not only act as an aggravating factor when setting the penalty, but will also make disciplinary action more likely in the first place.