The Employment Lifecycle through a SMCR lens: Episode 1 - Recruitment

Jonathan Chamberlain: Hello. I'm Jonathan Chamberlain, I'm a partner here in the Employment, Labour and Equalities team at Gowling WLG and this is the first in a series of six podcasts that we are bringing to you, in conjunction with members from our employment and financial services regulation teams. We will be discussing the issues that might arise from an SMCR perspective at each stage in the employment cycle. Now we're going to take it as read that those of you who are listening are relatively familiar with the SMCR and what it is. It came into force for all FCA regulated businesses on 9 December 2019 and three years prior to that, in March 2016, for banks and the PRA designated investment firms, but for anybody who would like a re-cap on this, can I suggest you hit "pause" on this podcast and check out a podcast that Ian Mason, a partner in our financial services regulatory team and I delivered in January and that's available on our website.

For those of you still with us, I am delighted to be joined this morning by Emma Bufton, a principal associate in the employment team.

Emma Bufton: Hi Jonathan.

Jonathan: And Sushil Kuner, a principal associate in our financial services regulatory team.

Sushil Kuner: Hi Jonathan, hi everyone.

Jonathan: So first, welcome to the podcast. Now I expect that many of our listeners are familiar with the recruitment process so what Emma, are the key changes that they need to be aware of in light of the SMCR?

Emma: That's a great question Jonathan. Before we get into the detail of the specific changes which will impact on recruitment, a key point that I did want to start off by flagging is for firms to be alive to timing considerations. And what I mean by this is that the on-boarding process is going to take a little more time than firms may previously have been used to, and that's due to some of the additional requirements the Senior Manager and Certification Regime has imposed. So there is a link there to your initial question.

Firstly, it is now a requirement for firms to request regulatory references for candidates looking to take on roles either as Senior Managers, Non-Executive Directors or Certified Persons and for these references to go back six years. Now the process for obtaining these references, and then considering them, is going to take time. So, firms will need to factor that into their processes.

And secondly, although not a new requirement, Senior Managers and Non-Executive Directors are required under the Senior Managers and Certification Regime to be DBS, that's criminal records checked. So whilst there is no legal requirement for Certified Persons to be criminal record checked, as a matter of good practice, and because firms will need to certify annually that they are fit and proper, they may wish to do that. Getting these checks processed and returned again is going to take time so allowing for that needs to be built into that recruitment process.

A final point I did want to mention which applies to Senior Managers only, is the need for firms to obtain approval from the FCA for a particular Senior Manager function that that individual is going to perform and that process can take up to three months.

Jonathan: Yes, so it sounds as though the timing for getting approval from the FCA for a new Senior Manager to perform a Senior Manager function could be quite a barrier in practice to bringing employees on-board quickly. Sushil is there a workaround? Are there are any other options available to employers who can't wait for that FCA approval and want to get their Senior Managers on-board more quickly?

Sushil: In theory yes, it is possible for a prospective Senior Manager to be on-boarded and to have them working under the supervision of another whilst the FCA is considering the approval request, provided of course they are not, themselves, performing the senior management function for which they are intended to occupy. As a reminder, the FCA has the power to impose penalties on any person carrying out a controlled function without prior approval from the FCA. It may also question the adequacy of the firm's governance arrangements and systems and controls for potentially allowing this to happen. Consideration would need to be given to the specific activities the individual would be performing in the interim and ensuring that if the individual would be classified as a Certified Function, then the relevant procedures are complied with. However, this isn't an option that is encouraged by the FCA because the candidate is likely to become privy to confidential information before their fitness and propriety for their role as Senior Manager is determined and moreover, there is a risk that the FCA may refuse a particular application, leaving the firm in a difficult position.

However, we should remember that the three month timeframe is the FCA's statutory target and an absolute backstop for complete applications. In practice, the timescale for the FCA to consider and determine Senior Manager applications is much shorter. The FCA sets out its own service standards and voluntary targets and at the end of each year publishes its performance against these metrics. So the last set of data covering performance was for the period covering 1 April 2019 to 31 March 2020.  Given that the SMCR for the vast majority of regulated firms was only introduced on 9 December last year, unfortunately there isn't any data to cover response times for applications under the SMCR.  

However, as a guide, under the FCA's old Approved Persons Regime, the FCA reported that it set itself a voluntary target of 85%25 to respond within five days for applications relating to the Customer Function and ten days for Significant Influence Functions. Largely, the FCA met those targets so you may like to breathe a sigh of relief that there is a good chance of obtaining a relatively quick response. The application would of course need to be complete and if it has any urgency attached to it, we recommend alerting the FCA to this in the application itself.

I should also point out that, so far, we've been focusing on new recruits to the firm and that there may well be circumstances where a Senior Manager has unexpectedly left the firm at no or short notice. The FCA has a 12 week rule which allows a firm to appoint an individual to perform a Senior Management function without prior approval of the FCA where the appointment is to provide cover for a Senior Manager whose absence is temporary, or reasonably unforeseen and the appointment is for less than 12 weeks in any consecutive 12 month period. In many cases, it may not be possible to recruit a replacement within 12 weeks and therefore the FCA may approve an individual already at the firm to perform a Senior Management function on a time-limited basis if it is satisfied that the individual is capable of fulfilling the role on an interim basis, but not permanently. It would also consider using this power for a person who is in the running for the long-term appointment if the individual is capable of carrying out its function on a day to day BAU basis, for example, but lacks experience of key aspects of the role. In such a case, the applicant would be expected to demonstrate that he or she has gained the required skills and experience by the end of the given timeframe.

Jonathan: Thanks. It sounds like in reality that most firms will want to wait for the FCA's approval of a candidate performing a particular Senior Management function and that might well, in any event, tie in with the candidate's notice period that they need to work out with their employer first.

Just taking a step out for a moment, Emma you mentioned regulatory references earlier. Could you tell us a bit more about those?

Emma: Sure.

So regulatory references were introduced really to prevent "bad apples" rolling from one firm to another. Now the obligation means that firms must request and then they must be provided with a reference for candidates for Senior Manager functions, NED roles and for Certified Persons they are looking to hire. Now the new employer must take reasonable steps to obtain the required information from each firm the candidate was employed by within the previous 6 years, and that obligation applies to firms based overseas and the non-financial sector.

When the information is received this will form part of the firm's initial fitness and propriety assessment for the candidate.

Now in terms of the information that must be provided, there is a template on the FCA's website which sets out the minimum information required and the onus is on the firm who drafts that reference to ensure that all of the information required is included. If a reference discloses something negative, the firm must consider whether it is appropriate in the circumstances to then withdraw that offer.

Broadly speaking, the reference should include detail of any breaches of the Conduct Rules, any findings that the individual was not "fit and proper" and whether any disciplinary action has been taken against that candidate.

The general rule is that information given must be accurate and fair and firms should investigate allegations before including them in a reference. The FCA has commented that fairness would normally require that an employee has the opportunity to comment on the information included in a reference. Now ordinarily this might occur at the time of a disciplinary process, or at the time the reference, if they have not previously had this opportunity, is provided.

Good practice should mean that there are no surprises for the individual, especially given the serious consequences of adverse references and as you can imagine, this can be quite a contentious area and we will be looking at regulatory references later on in the podcast series from the point of view of the firm being tasked with drafting them.

It is worth mentioning here, and again this is something that will be picked up in more detail in the second of these podcasts, but it's about the need to make sure that contracts and policies are reviewed so that the approach to how firms will obtain regulatory references is clear, and also reserve the right to take disciplinary action if something comes up on an amended reference. The point here is that the obligations with regards to regulatory references are that they need to be accurate, so if something later materialises which means that that reference needs to be updated, it will then need to be amended.

We'll talk later as well about how important it is that different teams in the organisation , so be that certification managers, on-boarding/off-boarding teams, compliance, all of those teams link up so that information is not missed.

Jonathan: Thanks Emma, and that covers on-boarding, I think very thoroughly. We'll be returning to the topic of regulatory references when we look at the end of the employment relationship, or off-board as apparently some call it, later on in our podcast series.

Anyway, I think most people who have heard of the regime have heard about regulatory references, they've heard about the need to get FCA approval, but actually there are even more far-reaching implications. Job descriptions, the SMCR has an impact on job descriptions. Sushil do you want to pick this up?

Sushil: Absolutely, thanks Jonathan. The SMCR's ultimate aim is to reduce harm to consumers and strengthen market integrity by creating a system that enables firms and regulators to hold people to account. Now part of this means ensuring that firms and staff clearly understand and can show who does what.

The SMCR therefore created a requirement for every Senior Manager to have a single document, called a "Statement of Responsibilities", which clearly sets out their role and responsibilities.  There are fairly detailed requirements in respect of the form and content of the statement but, at a high level, it needs to set out what that Senior Manager is responsible and accountable for, rather than how they carry out those responsibilities. The statement should clearly show how the responsibilities of that Senior Manager fits in with the firm's overall governance and management arrangements and should be consistent with the statement of responsibilities for the firm's other Senior Managers and, if applicable, the firm's Management Responsibilities Map, now more about that later. The statement needs to be self-contained and not refer to other documents and should be succinct and clear without unnecessary detail.

Now if a Senior Manager holds multiple Senior Management Functions at the same firm, they will only need one statement, but this must clearly describe all of their responsibilities. If a Senior Manager holds multiple Senior Management functions across different firms in the same Group, they will need one statement of responsibilities per firm.

Turning then to the Responsibilities Map, not all regulated firms are required to have these in place. The requirements governing these apply to systemically important firms, so for example banks, building societies, credit unions, PRA-designated investment firms, Solvency II firms etc. They also apply to a limited number of solo regulated firms which are deemed be "enhanced scope firms" under the SMCR.

So now that we've considered who they apply to, well what are they? A Responsibilities Map is a single document that sets out the firm's management and governance arrangements. This includes how certain FCA prescribed responsibilities have been allocated, details on who has overall responsibility for the firm's activities, business area and management functions, details of individuals' and committees' reporting lines, and how any responsibilities are shared or divided between different people.

They are designed to give a collective view of the allocation of responsibilities across the firm and to make sure that there are no gaps in the Senior Managers' Statements of Responsibilities. Of course, they also help the FCA and the PRA to identify who to speak to about particular issues and who is accountable if something goes wrong.

It is vitally important that Statements of Responsibilities and the Responsibilities Maps are accurate and kept up to date. Accountability in financial services is one of the FCA's focus areas and firms should expect the FCA to be closely reviewing the adequacy of the implementation of the regime. Needless to say, firms should ensure they maintain adequate records of the steps that they have taken to implement the regime as well as keeping key documents up to date. Firms should also revisit their record-keeping and retention policies to ensure that they are fit for purpose and allow firms to meet their obligations under the SMCR.

Jonathan: Thanks Sushil.

So Emma we've covered references, we've covered on-boarding, we've looked at job descriptions. A fundamental part of most recruitment processes at least for any jobs with any seniority as one might say, is the interview. What changes will SMCR require to be made there do you think?

Emma: I think broadly speaking firms shouldn't need to make too many changes to their interview assessments, and that is because they should already have built into that process ways in which they can effectively assess a candidate's fitness and propriety, because that was a requirement under the old Approved Persons Regime. You'd also expect them to already be looking to test whether the candidate's competencies will align with the responsibilities they will have.

I think the big change with the Senior Managers and Certification Regime is the importance of accountability and culture, so processes should be adapted to ensure this is tested.

Jonathan: Thanks Emma. Moving on from recruitment process in isolation, we know that the regime requires compliance with the FCA's Conduct Rules and that that compliance is likely to capture most people working in the firm.

Sushil, this is potentially a very demanding area for regulated firms. What can you tell us about this and offer any practical advice and tips you can share on monitoring and recording compliance with those rules, which would seem to be quite an onerous obligation?

Sushil: Yes, certainly. So the Conduct Rules relate to professional conduct, rather than conduct of business, and aim to improve conduct at all levels of the firm's staff, with the exception of ancillary staff, so for example, cleaners and receptionists, they apply to all employees within a firm and not just approved individuals, and they comprise a set of enforceable rules that set basic standards of good personal conduct, against which the FCA can hold people to account. As the Conduct Rules apply to staff directly, the FCA hopes that they will help shape the culture, standards and policies of firms as a whole and promote positive behaviours that reduce harm.

There are two tiers of Conduct Rules; the first tier applies to all individuals within scope and the second tier applies to Senior Managers only. Examples of rules which will now apply to all employees are the requirements to pay due regard to the interests of customers and treat them fairly, to act with integrity and act with due care, skill and diligence.

Firms are required to provide training to all staff about the Conduct Rules so that all staff understand how the rules apply to them. Of course, firms will need to maintain accurate training records and be able to demonstrate to the FCA that they have provided the appropriate training. Providing a robust overview of the applicable Conduct Rules, along with clear examples of how the rules apply practically and the consequences of failing to follow the rules is essential to meet the FCA's requirements. Now of course we regularly provide bespoke training and if you would like to discuss this then do get in touch!

The Conduct Rules apply to a firm's regulated and unregulated financial services activities and any employee at a regulated firm may therefore be held to account by the FCA. Internal consequence management will need to take this into account and firms will need to be able to report on conduct breaches internally as well as to the FCA. Where disciplinary action is taken against a person for a Conduct Rules breach, notification of this is required to be given to the FCA and firms must also make an annual notification about Conduct Rules breaches even if there haven't in fact been any.

It is therefore important that firms are able to monitor the performance of their staff against the Conduct Rules and keep accurate records. Steps which firms could take to help ensure that their employees follow the Conduct Rules in practice, include updating the code of conduct policies to specifically reference the Conduct Rules under the SMCR and specifically drawing any attention to the changes, incorporating clauses within employment contracts around adhering to the Conduct Rules and incorporating employee compliance within the Conduct Rules into the appraisal cycle.

Monitoring of employees could be particularly problematic where employees are working from home as a result of COVID-19. The FCA has made clear and has been continuing to make clear since the early days of the pandemic that activities ordinarily subject to routine oversight and monitoring in the workplace should be continued to be monitored when working remotely. However, risks of breaches of Conduct Rules are naturally heightened with homeworking, for example, confidential information being inadvertently shared with others or deliberate insider dealing. It is of course difficult to prevent "bad apples" from contravening the Conduct Rules but for the rest of your staff, it is important to deliver regular training, have effective team engagement and create an environment in which it is safe for all to speak up.

Breaches of conduct rules are also likely to have to be reflected in regulatory references including updating references already given when subsequent breaches are uncovered. This includes references requested for employees moving from a non-certified role to a certified role, further demonstrating the need for accurate tracking and linked-up processes.

Jonathan: Thank you Sushil. I knew this point had a link to recruitment and that was it, so thank you very much.

Just before we bring this podcast to a close, Emma I would like to pick up if I may on something that you referred to earlier, which I know can be a tricky issue in some recruitment processes. Criminal record checks. What do firms need to be thinking about?

Emma: Well I mentioned at the outset that it is a mandatory requirement of the Senior Managers and Certification Regime that firms do conduct a DBS so that's your criminal records checks on any persons who will be performing a Senior Manager function. Now the type of DBS check required for persons who will be performing that function is a "standard" check, and what that means is that details of both spent and unspent convictions need to be provided.

It is also a mandatory requirement for NEDs, so Non-Executive Directors who are not occupying Senior Manager functions to also be subjected to criminal records checks, but the requirements for them is a "basic" check – which will detail unspent convictions only.

Now criminal records checks are not mandatory for Certified Persons. However, as I mentioned earlier as a matter of good practice, most firms will want to obtain a "basic" level check and that is because it will help firms to comply with their obligations to assess that individual's fitness and propriety. That said, there are GDPR considerations to be aware of and so firms shouldn't blanketly be carrying out checks if they can't evidence a legal basis for this. And they also obviously to comply with the other GDPR requirements.

Firms should also be considering international criminal record checks where an individual has spent a considerable amount of time working or living outside the UK.  The FCA recommends firms should undertake appropriate checks in those overseas locations to ensure they can make a good determination as to the individual's fitness and propriety.

As well as criminal records checks there are other checks that firms may wish to consider as part of the recruitment process. These are not mandated by the Senior Manager and Certification Regime and indeed they may already well be built into firms existing processes, but in case they are not some typical examples might include requesting qualification certificates, financial integrity checks and also directorship checks if that is appropriate.

Now many firms will also, particularly for senior hires, carry out social and "adverse" media checks. Now firms do need to be careful about their sources and where they are getting their information for this but carrying out these types of checks can be useful for fitness and propriety checks.

Jonathan: Well thank you both very much, that's been really useful, very interesting but I think as they say on all the best programmes that's all we've got time for this week or rather on this podcast.

Do please keep a look out for our further podcasts in this series and have a good rest of your day.

Thank you.

Emma: Thanks everyone.