Client Asset oversight … when one becomes two
13 September 2017
The Financial Conduct Authority (FCA) recently consulted to extend the Senior Managers and Certification Regime (SM&CR) to all sole FCA regulated firms. While wide ranging in scope, there are some particularly interesting Client Asset (CASS) requirements which firms need to consider, subject to the final policy statement.
Which firms are impacted?
The proposed SM&CR requires all regulated firms that hold client assets to allocate responsibility for the firm’s compliance with CASS to a specified Senior Manager, and importantly to appoint someone into an operational CASS Oversight Function (CASSOF). Existing requirements encompass both these requirements under the CF10a position, but the SM&CR will allow firms to split accountability from oversight, if they so wish.
Who will be accountable?
The overall accountability must sit with a senior manager. MiFID firms with client money or custody asset balances exceeding £425m or £7.8bn respectively (significant IFPRU firms) or any firm with client money or custody asset balances exceeding £1bn or £100bn respectively (CASS large firms) are classified as one of the 350 ‘enhanced’ firms and will have a choice of 18 Significant Management Functions (SMFs) to assign CASS accountability to. The remaining ‘core’ firms only have six SMFs.
Based on current structures, we expect that the CASS responsibility for enhanced firms will sit with the Chief Operations Function (SMF24) or the Chief Finance Function (SMF2). For core firms, there is much less choice and therefore CASS responsibility will likely sit with the Chief Executive (SMF1) or Executive Director (SMF3). The FCA has suggested in the consultation paper that CASS responsibility will often be allocated to the Compliance Oversight role (SMF 16). We do not think this aligns to current market practice or governance models and so firms will need to reflect on this and justify their position.
The Senior Manager responsible for CASS will need to demonstrate that they have taken 'reasonable steps' to ensure CASS compliance. Challenges that we have seen from the banking industry include:
- defining what 'reasonable steps' look like, what documentation is needed to support these and how they operate in practice;
- ensuring clarity of reporting lines and powers of authority, particularly when operating a matrix structure and with third party outsourcing; and,
- inadequate governance arrangements and management information meaning that the SMF cannot evidence that they have appropriate oversight in place.
But who will be responsible?
In addition to the SMF role, firms must allocate the CASSOF responsibility, which is a certification function. This effectively replaces the current CF10a role. But the individual will not be approved by the FCA, putting the onus on the firm (and the relevant SMF) to consider the fitness and proprietary of the person for the role. The process firms go through to determine fitness and proprietary of the person is likely to be of interest to the FCA and the CASS Supervision team.
Although the CASSOF can be allocated to the SMF responsible for CASS, given the size of most firms this is unlikely to be practical. Changes to the CASS rules as a result of MiFID II encourage firms to make sure that the individual who is allocated the CASSOF responsibility does not have any other roles within the organisation. We expect most firms to appoint a separate CASSOF who will be overseen by the relevant SMF. This is akin to the Head of CASS roles that we see currently.
What should you be doing now?
Firms should be considering the allocation of responsibility under the SM&CR in relation to CASS. In particular, you should consider how you are going to document the structure in place for oversight and governance to enable the SMF to demonstrate that 'reasonable steps' have been taken. Where a firm is appointing a separate CASSOF, they should also consider how they will demonstrate that this individual is appropriate for the role and should consider interviews and assessment processes.