Martin Kisby, Head of Compliance at Equiniti Credit Services, explores the motivations behind the evolution of compliance functions in consumer credit firms.
Risk and compliance departments, once held in low esteem by other business units, have evolved into a crucial function for protecting profitability. This is still a controversial statement in the consumer credit industry, but it’s easily justifiable. To do so, let’s take a look back.
It’s 2008. The consumer credit market is regulated by the Office of Fair Trading (OFT). Firms have a set of guidelines they are required to adhere to, but in reality can interpret or even circumvent them entirely. Business objectives are often, if not always, placed ahead of consumer needs.
So what was the role of the compliance function back then? Well, it provided some assurance to the OFT that firms were not ignoring its guidelines in their pursuit of profits.
This often led to compliance functions being derided as the ‘Business Prevention Unit’ or ‘Profit Police’ and being allocated minimal resource.
Fast forward to 2014: the financial crash has altered the consumer credit landscape dramatically. Trends in mis-selling, together with poor consumer outcomes, have highlighted the need for fundamental change. The creation of the Financial Conduct Authority (FCA), by merging the OFT and Financial Services Association (FSA), is intended to add more stability and oversight to the sector, ensuring better service delivery for consumers.
Big changes ensued.
The FCA developed a more robust and detailed handbook, which not only provided guidance on how firms across the sector should be operating, but also changed what was previously ‘advice’ into hard and fast rules.
Firms were given only interim permissions and needed to complete an approval process to gain full FCA authorisation. This required firms to demonstrate strict adherence to the new and updated rules and guidelines.
From this point onwards, the role of compliance was transformed. Firms began to allocate significant resource to this function to ensure they could provide continued assurance to the FCA that its rules and guidelines were being followed. It became imperative to demonstrate that mis-selling, unreasonable collections practices, affordability issues and poor customer service were being eliminated.
The compliance department evolved from the ‘Profit Police’ into a pivotal function in every FCA regulated firm.
Risk management also became more prevalent under the new regulatory body, as the System and Controls section of the FCA’s handbook requires firms to assess and manage their risks, and have a Chief Risk Officer as one of their Approved Persons – individuals the FCA has approved to undertake one or more controlled functions.
These complimentary objectives meant that compliance and risk departments were consolidated. Compliance plans were established to monitor specific elements of the FCA handbook and verify adherence to them. Any identified control inadequacies could be migrated onto a firm’s risk register for monitoring and remediation.
Back to the present. Four years on from the introduction of the FCA, firms have, overall, implemented the necessary oversight to demonstrate that they are meeting their regulatory requirements and treating customers fairly.
But let’s be honest – there are selfish motivations too. A strong compliance department, empowered to change processes as best practice dictates, reduces the risk of both regulatory fines and exposure to defaults. This increases revenue and protects profit margins.
In a sector competing on cost at a scale never seen before, and where consumer brand loyalty is decreasing by the day, protecting a firm’s margins is crucial.
As compliance has increased in importance, technology has kept pace and evolved to reduce the time and cost burden regulation could otherwise have imposed. Now, best-of-breed credit management solutions seamlessly integrate compliance monitoring and reporting into their sourcing, approval and collections processes.
Happily, this combination of motivations and technological developments has created a win-win for lenders and borrowers alike: an established and proactive risk and compliance function that not only protects consumers but also contributes to the strategic objectives of the lender’s business.
The FCA has finally released its long-awaited consultation paper[1] (CP) on its planned extension to the Senior Managers and Certification Regime (SM&CR) to the vast majority of those firms regulated by it.
The FCA intends introducing this new extended regime on a proportionate basis and having regard to the plethora of activities undertaken by regulated firms, and the size and scale of individual firms. Here Douglas Cherry, Partner at Reed Smith, discusses with Finance Monthly.
The SM&CR consists of three principal elements which are the “core”, “enhanced” and “limited-scope” regimes.
The core regime applies to all affected firms and is the focus of this short discussion.
The enhanced regime will apply only to the very largest firms regulated by the FCA and is expected by the FCA to capture only around 350 firms in total. It requires additional detail, above the core regime and places additional individual responsibility in particular on risk, prudential and audit responsibilities.
The limited scope regime is effectively a ‘light’ version of the core regime for particular classes of FCA-regulated firms including: limited scope consumer credit, oil market participant and sole trader firms. These firms will not be required to implement the SMFs and are exempt from other requirements in the regimes too.
The core regime essentially sees those holding significant influence control functions under the existing regime mapping across to the newly defined Senior Management Functions “SMFs”. It also introduces the notion of the certification regime to firms.
Whilst the new SMFs are re-defined, there is little magic about those definitions, and those of you currently holding a Chief-Executive, Executive Director, Partner, Compliance Officer, MLRO and so on, will likely fall within these new SMF definitions. SMFs will be required to apply for the relevant designations and receive prior approval from the FCA before carrying out any duties at a regulated firm which fall within the definition of the relevant SMF.
The extended regime mandates adherence to a Statement of Responsibilities (SOR) by SMFs. The firm must articulate those duties for which the SMF holder is responsible and ensure that each impacted SMF-holder subscribes to that SOR. This is similar to the approved-persons regime, but in contrast to that regime, it creates a burden on the SMF holder to demonstrate to the FCA that they proactively discharge their prescribed responsibilities, and in the case of regulatory criticism; show that they took “reasonable steps” to meet their obligations.
Some staff will fall outside of the SMF definitions, and instead fall within the certification regime. These staff will not require pre-approval from the FCA. Rather, they must be assessed (on an ongoing basis) by the firm, as fit and proper to do their job. Certification staff will likely include those concerned with client assets and money (CASS oversight function), those heading up business units and those persons who have the ability to cause ‘significant harm’ to a regulated firm (including proprietary and algorithmic traders, and investment advisors amongst others.
The FCA expects to focus very precisely on how roles and defined and described and how the firm organises itself. From an employee perspective, firms may well start seeing senior staff being reluctant to be seen as SMF staff, where a role may be defined in manner that pushes it into the certification regime instead.
Whilst for may practical purposes, the regime changes do not fundamentally change the day to day approach at regulated firms, the very fact of the certification regime places a positive burden on firms (and the SMF individual with responsibility for this area of systems and controls as well) to actively certify at the outset an monitor on an ongoing basis, compliance with the fit and proper test.
The largest burden is likely to be the defining of roles and management time and effort spent in implementing these changes. The consultation runs through to 3rd November, and the new rules, in very similar form to the CP, to be in force from Q3 2018.
[1] Individual Accountability: Extending the Senior Managers & Certification Regime to all FCA firms CP17/25 July 2017
