Overview of the Certification Regime for FCA solo-regulated firms

Introduction

The Senior Managers & Certification Regime (SM&CR) is being extended with effect from 9 December 2019 to firms which are solo-regulated by the Financial Conduct Authority (FCA). As a result, solo-regulated firms will be subject to an individual accountability regime similar to that which was brought in for banks in March 2016, although adapted to take account of the broad range of firms which are solo-regulated to ensure a proportionate approach.

As the implementation date approaches, as well as bespoke client training, we have prepared a suite of briefings to help you understand how the SM&CR will impact your firm and what things you need to be thinking about now as part of your implementation planning. In this briefing, Grania Baird and Katy Ruddell provide an overview of the Certification Regime for solo-regulated firms.

1. Background

The Certification Regime applies to those individuals carrying out specific functions (Certification Functions) for a firm that can have a significant impact on the firm or its customers but are not Senior Management Functions. For more information about Senior Management Functions please read our Senior Managers Briefing which can be found here.

The Certification Regime requires a firm to take reasonable care to ensure that none of its employees perform a Certification Function unless that employee has a valid certificate issued by the firm. The FCA has set out the Certification Functions in its SYSC sourcebook and an employee performing one of these roles must have a certificate confirming that they are fit and proper to carry it out which must be confirmed (certified) at least once a year. Employees carrying out Certification Functions will not be approved by the FCA to do so.

This is a significant change from the current APER regime as the responsibility to approve and assess an employee as competent to carry out a Certification Function shifts from the FCA to the firm itself. The implication of the change is that if the firm does not properly certify its employees or an employee is found not to be fit and proper for the role, the FCA may take regulatory action against the firm and may also sanction the Senior Manager who has the prescribed responsibility for the performance by the firm of its obligations under the Certification Regime.

2. Certification Functions

A Certification Function is a significant-harm function, defined in section 63E(5) of the Financial Services and Markets Act 2000 (FSMA) as one which, in relation to the carrying on of a regulated activity:

“…(a) the function will require the person performing it to be involved in one or more aspects of the authorised person’s affairs, so far as relating to the activity and those aspects involve, or might involve, a risk of significant harm to the authorised person or any of its customers.”

The Certification Functions that the FCA has specified in its rules are:

This is a wider remit of roles than is currently the case under the approved persons regime and consequently, a larger pool of employees may potentially be within scope.

3. Identifying individuals performing a Certification Function

As a first step, a firm must identify those individuals who will be performing a Certification Function under the SM&CR. Although firms will have 12 months following the implementation of the Certification Regime to certify individuals performing a Certification Function, the firm must identify the relevant individuals from day one.

It is worth noting here that only employees of the firm are within scope of the Certification Regime.  Employee for this purpose is defined in section 63E(9) of FSMA and includes a person who:

a) “personally provides, or is under an obligation personally to provide, services to A under an arrangement made between A and the person providing the services or another person; and

b) is subject to (or to the right of) supervision, direction or control by A as to the manner in which   those services are provided.” 

The definition is sufficiently broad as to bring within scope individuals who are seconded to a firm and contractors.  It does not however, extend to appointed representatives or non-executive directors and such individuals remain outside the scope of the Certification Regime.

The Certification Regime applies to employees at UK firms who are based (or spend more than 30 days a year) in the United Kingdom and to overseas employees who are dealing with UK clients.  The Certification Regime also applies to individuals who are material risk takers wherever they are based.

4. Significant Management Certification Function

In most cases it will be apparent whether an individual is performing a Certification Function. However, whether an individual’s role falls within the scope of the significant management Certification Function requires the firm to apply an element of judgment.  

Broadly, a person will be carrying out a significant management Certification Function where they are responsible for a significant business unit. The FCA has provided a non-exhaustive list of examples of business units where the person responsible for them could be carrying on the significant management Certification Function, for example business units carrying on activities such as retail banking, personal or corporate lending, designated investment business and complaints handling.  FCA guidance confirms that a business unit is not limited to one that carries on commercial activities with customers, third parties and earns revenue, and may include internal departments such as HR, legal operations and IT. 

Once a firm has identified whether it has a potentially relevant business unit, the firm must then determine if the business unit is significant.  If the firm determines that the business unit is significant, the person responsible for the business unit will need to be certified as fit and proper to carry out the significant management Certification Function.  The FCA has helpfully provided guidance in the SYSC sourcebook on the factors the firm should consider about the firm and the business unit when making this determination.

5. Assessing employees and issuing a certificate

A firm may only issue a certificate to an individual if the firm is satisfied that the person is fit and proper to perform the relevant Certification Function.  As such, in addition to identifying those employees who will be carrying out a Certification Function the firm will have to establish a process for assessing whether the relevant individual is fit and proper to carry out the relevant Certification Function.  

A firm will have to carry out a fit and proper assessment for a new joiner, annually for existing employees and before an existing employee takes on a new role that means they will be carrying out a Certification Function for the first time or will be carrying out an additional Certification Function. It is also worth mentioning here that if an employee carries out more than one Certification Function they must be certified as fit and proper to carry out each role, although the assessment for each separate role can be carried out at the same time. 

In order to be in a position to issue a certificate, the employee must have been assessed by the firm as fit and proper to carry out the relevant Certification Function, and the certificate should:

• state that the firm is satisfied that the employee is a fit and proper person to perform the function to which the certificate relates; and
   
• set out the aspects of the affairs of the firm in which the employee will be involved in performing the function.  

Firms should, as part of their project to transition to the SM&CR, consider the form and content of the certificates that they will be issuing. 

When deciding if an individual is fit and proper to perform a Certification Function FSMA requires the firm to take into account whether the employee:

• has obtained a qualification;
  
  
• has undergone, or is undergoing, training;
  
  
• possesses a level of competence; or
  
  
• has the personal characteristics,

required to perform the relevant Certification Function. The assessment will need to be appropriate for the business and tailored to the relevant role. A certificate is only valid for a maximum of 12 months from the date of issue, so firms will also have to reassess the fitness and propriety of all their Certification Function staff on an annual basis. As part of an SM&CR implementation project firms should be thinking carefully about how the fit and proper assessment process can be woven into their recruitment and appraisal processes. 

If, following an assessment, a firm decides that it will not issue a certificate confirming that a person is fit and proper to perform a Certification Function, the firm must notify the individual of this in writing and set out what steps, if any, the firm intends to take as a result of the decision and the reason for proposing to take those steps. As part of an SM&CR implementation project a firm may want to consider whether employment policies and procedures need to be modified to set out what rights, if any, an employee has to challenge a decision not to issue them with a certificate.

The firm must keep a record of all employees who have valid certificates issued by it.

6. The Certification Regime and Senior Managers

There is a clear distinction between Senior Management Functions and Certification Functions and in some cases, particularly in smaller firms, a Senior Manager may also be performing a Certification Function that is different to their Senior Management Function. An example might be where an SMF3 (Executive Director) also acts as a mortgage adviser.  Being a mortgage adviser is a Certification Function because it is subject to a qualification requirement. Where this is the case, the firm will need to assess the individual as being fit and proper for both roles. There is no requirement to carry out separate assessments for each role and a firm can opt to build the assessment process so that it combines the two assessments. 

In contrast, if a Certification Function is closely aligned to the individual’s role as a Senior Manager then the individual will not need to be assessed and certified under the Certification Regime, for example, the Senior Manager with the prescribed responsibility for CASS compliance would not need to be certified for the CASS oversight function, if they were also carrying out this role.  

One of the prescribed responsibilities that must be allocated to a Senior Manager is the prescribed responsibility for the performance by the firm of its obligations under the Certification Regime. As such, each firm must identify who that person will be. It is helpful to do this early in the SM&CR implementation process so that the relevant Senior Manager can be involved in the development of the aspects for which they will have ultimate responsibility.

7. Directory

One of the key concerns when the FCA first consulted on the Certification Regime was that the information about certified individuals would not be available to the public, as is currently the case under the approved persons regime. Firms were concerned that their clients would no longer be able to check the regulatory status of their advisers and get comfort from the data that is available publicly on the Financial Services Register (FS Register). The FCA has acknowledged how important this is and is introducing a new public directory (Directory) that will provide information about financial services professionals. Solo-regulated firms can start submitting data for the Directory on 9 December 2019 and the information must be uploaded by 9 December 2020.

The Directory will be separate from the FS Register and will allow the public to access information about an individual carrying on Certification Functions as well as directors who are not Senior Managers, both executives and non-executives. The FS Register will continue, and this will contain information about regulated firms and Senior Managers approved by the FCA.  

The Senior Manager who has responsibility for the performance by the firm of its obligations under the Certification Regime will be responsible for keeping the firm’s entries in the Directory up-to-date and must submit relevant information within 7 business days of a change. The FCA will charge the firm a £250 administration fee for late or inaccurate data submissions unless the firm promptly self-identifies and corrects the data.

8. What to do now?

Although the implementation date for SM&CR is still a few months away, our experience of working with the banks to implement the regime in 2016, indicated that early planning is key to transitioning smoothly to the SM&CR. Below we have set out some practical things businesses can be doing now to facilitate this.

• Identify which Senior Manager will have the prescribed responsibility within the organisation for obligations under the Certification Regime and who within the business will work with them to develop the policies and procedures necessary to transition to the Certification Regime.
  
  
• Identify those individuals within the organisation who are performing Certification Functions and will therefore require certification once the new regime becomes active. As mentioned above, although a firm will have a year from the start of the SM&CR to certify an individual a firm must be able to identify those of its employees who are carrying out a Certification Function from day one.
  
  
• Develop an assessment that can be incorporated into the annual appraisal process for current employees and into the recruitment process for new employees.  
  
  
• Establish a process for what happens if the firm decides not to issue a certificate.
  
  
• Prepare employment policies setting out the details of the new rules and, for example, the processes (and relevant employee obligations) relating to the certification process.
  
  
• Develop template certificates that can be issued to employees. 
  
  
• Set up a process for recording which employees have a valid certificate issued.
  
  
• Provide training to those employees who will be carrying out Certification Functions so that they understand the new regime and what is expected of them.
  
  
• Review the current employment contracts to establish whether they need amending and consider whether the firm’s precedent contract for new employees needs to be updated.

If you require further information about anything covered in this briefing, please contact Grania Baird or Katy Ruddell or your usual contact at the firm on +44 (0)20 3375 7000.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, August 2019