April 1 2023 marks the 10th birthday of both the Prudential Regulation Authority and the Financial Conduct Authority, since being formed as part of the suite of regulatory reforms following the 2008 financial crisis.
When the two bodies were set up in in 2013, it was clear that they had their own distinct mandates. They also had very different approaches to how they would supervise firms and how they planned to use disciplinary action against firms and individuals suspected of breaching their rules.
From the outset the FCA was equipped with a substantial enforcement division that over the years, particularly during the most recent period under Mark Steward, has lowered its internal evidential threshold for kicking off investigations and therefore significantly increased the numbers of individuals and firms placed under investigation.
At the last count (March 31 2022) the FCA had a massive 603 ongoing enforcement investigations. This has led to a significant increase in the length of time taken to conclude its investigations, and criticism for leaving firms and individuals waiting (in some cases for a number of years) while other cases are prioritised.
The PRA method
In contrast, the PRA made clear from the outset that it would not be an enforcement-led regulator and therefore maintained a much smaller team capable of handling regulatory investigations – at the outset just a handful of individuals.
In the early days, the actual investigation of issues was largely outsourced by the PRA to members of the FCA's enforcement division, particularly where issues were being investigated by both regulators.
The intention of both regulators to land enforcement action against individuals is reflected in the statistics.Since 2013 the PRA has increasingly embraced the world of enforcement as an effective method of communicating its regulatory priorities to the market and making senior management sit up and take note.
As a result the PRA's enforcement unit is now far more independent and considerably larger, with a clear mandate to pursue firms and individuals where the regulator's expectations have not been met.
Cases pursued by the PRA have focused on a number of its priority areas such as operational resilience, governance and management of risk, and regulatory reporting. Many of the fines against firms have been very substantial.
However the flow of disciplinary outcomes has never grown to more than a handful of cases each year, which can result in final notices issued by the PRA having more impact within the market than those issued by the FCA.
The PRA has also developed its own style of investigating suspected breaches that is distinct and different from the FCA.
The PRA has increasingly embraced the world of enforcement as an effective method of communicating its regulatory priorities.For example, the PRA has not embraced the FCA's fondness for early interviews with witnesses and subjects, in which individuals are pressed for their recollections on what happened and why, often on complex issues dating back several years and with little or no contemporaneous documentation available to assist them in explaining the chain of events.
Rather, the PRA's increasing preference appears to be requesting narrative accounts from firms and their senior managers on the systems and controls in place and the steps taken to ensure that the relevant risks were managed appropriately. Witnesses and subjects of investigations can then be questioned on the answers provided.
Management failings
One area that the two regulators certainly have in common is their desire to achieve regulatory outcomes against senior individuals in relation to failings in management over the area of the business for which they are responsible.
After seven years of the senior managers and certification regime, both regulators have placed significant numbers of individuals under investigation in relation to suspected failings in their managerial responsibilities, but those investigations have either been discontinued (on the basis that the individual was shown to have acted appropriately) or have not yet made their way through the regulatory system.
Nevertheless, parallel enforcement investigations in which a number of senior individuals are investigated alongside the relevant firm have become commonplace in recent years, with the regulators focusing on individuals across both primary and secondary line business functions.
We expect a real focus from both the PRA and FCA on achieving public outcomes against senior individuals for managerial failings.The intention of both regulators to land enforcement action against individuals is reflected in the statistics. Of those 603 cases the FCA had open a year ago, 61 per cent related to individuals. 109 new investigations against individuals were commenced by the FCA during the year to March 31 2022.
Similarly, of the 17 investigations that the PRA was running as at December 31 2022, 11 of those investigations were into the conduct of individuals.
Almost invariably those cases are examining whether a senior manager ensured that risks were being managed effectively in the area of the business for which he or she was responsible – the point where accountability means culpability unless the individual can evidence that all reasonable steps to manage the risks were taken.
This topic of individual accountability remains high on the priority list and we expect a real focus from both the PRA and FCA on achieving public outcomes against senior individuals for managerial failings as they head into their 11th year.
Nathan Willmott is a partner and Max De Tommaso is a solicitor specialising in PRA and FCA investigations at Ashurst LLP
What do you think about the issues raised by this story? Email us on ftadviser.newsdesk@ft.com to let us know
