FRSGlobal. Conduct Risk and the FCA: What s your next move?

Transcription

1 FRSGlobal Conduct Risk and the FCA: What s your next move?

2 Conduct Risk and the FCA: What s your next move? This paper provides an overview and, to some extent a prediction, of what life will be like for firms under the supervision of the new Financial Conduct Authority and will consider some of the key components of an effective approach to Conduct Risk. It is based not only on what the FSA are saying, but also on the current responses being developed by a range of firms across the financial services spectrum. It will be of interest to the Board, Executive Committee and senior management team as well as to risk, compliance and audit functions within firms. Whilst Conduct Risk is a particular concern to firms regulated by the FCA, this paper will also be of interest to all firms who operate in the UK regulatory environment and to subsidiaries and operations of UK based businesses operating in other jurisdictions. FRSGlobal

3 Conduct Risk and the FCA: What s your next move? Definition What is Conduct Risk? A good starting point for thinking about Conduct Risk, and crafting your firms own definition of, and framework for managing, Conduct Risk, is the FSA s Core Conduct Programme which was rolled-out by the FSA as its main supervisory tool to assess conduct. It covers five core areas which will be considered in more detail throughout this paper. These are; Business Model Culture, Governance & Controls Product Development & Approval Sales Post Sales Handling 1. Business Model When we consider authorising a firm, we will look at its business model to ensure it meets the needs of consumers and does not place them, or the financial system as a whole, at undue risk. We will balance these high standards with allowing innovation and appropriate access to the market by new firms. Martin Wheatley Journey to the FCA So what do firms need to consider as regards the business model? The FCA will expect firms to be able to provide very clear answers to the following types of questions; l What is the target market for the firm s products and services? l How does the firm identify, understand and test the needs of the target market? l How does the structure of the business ensure that their customers needs are at the heart of the business? l How does the firm identify potential conduct risk? l How are the needs of the customer considered in the distribution model for the business? l How will the firm ensure that the assets of the clients are protected? 2. Culture, Governance and Controls 2.1 Culture Public trust in the financial services industry (and in those who regulate them) is widely considered to be at an all time low. Trust is very hard to earn, extremely fragile and easily shattered. Whilst many firms complain that they have been tarred with the same brush as those which have more blatantly breached the consumers trust, for example by continuing to sell payment protection products long after the alarm bells started ringing, they too will need to regain the trust and confidence so badly damaged by the perceived conduct of the wider industry. Barclays is a good example of a firm that has gone very public in its attempts to change the culture of the business. For our Values to have true meaning, employees need to live and breathe them. Antony Jenkins Barclays Group Chief Executive (Jan 2013) 3

4 So how will the regulators measure and assess the culture of a firm? The FCA will approach culture by considering a range of questions such as; l Do management model good behaviour, i.e. make their values live? l Do management articulate a clearly understandable strategy? l Do management offer guidance and training to assist in good decisionmaking for example, on ensuring the fair treatment of customers and effective risk management? l Do management incentivise good behaviour and deter poor behaviour - and how? l Do management encourage the required diversity to facilitate challenge to groupthink? l Do management articulate their vision of the right culture? It is highly unlikely that the FCA will prescribe what values and ethics should apply to any given firm. This is all but impossible. But firms should be under no illusion that they will be closely scrutinised in this regard. And they will need to be able to demonstrate to the FCA that they have the right culture and values and that employees live and breathe them. So from the boardroom to point of sale and beyond, firms behaviour, attitudes and motivations must be about good conduct especially in terms of the experiences and outcomes they offer their customers and clients, whether it is someone buying a basic product or completing a complex transaction. Martin Wheatley Journey to the FCA 2.2 Governance The Board The Chief Executive Officer, Board and Senior Management must recognise the importance of their roles in ensuring the fair treatment of customers and effectively managing Conduct Risk. The FCA will expect to see evidence of senior management commitment to the fair treatment of customers. In particular, as well as establishing a culture within the firm which ensures the fair treatment of customers, the senior team will be expected to ensure that; l Conduct and customer treatment risks are identified and effectively managed; l All business units within the firm have in place appropriate policies, procedures, systems and controls to manage Conduct Risk; l Senior individuals, at group and business unit levels, have the necessary resources and influence to oversee and enforce adherence to these Conduct Risk and customer treatment policies and procedures; l All staff are trained and made aware of the Conduct Risk and customer treatment policies and their obligations under them, and procedures exist to implement appropriate training and awareness; l They understand and can articulate the Conduct Risk Appetite of the business. Customer Committees Many large firms, particularly those with a substantial retail customer base, have established a senior forum with oversight of all aspects of conduct risk and customer treatment. Membership of these committees will typically include senior representatives from sales, customer service, complaints, product development, legal, risk and compliance functions as well as individuals with specific Conduct Risk responsibilities. Typically, the role of this Committee will include: l Approving the Customer or Conduct Risk Policy, and reviewing any substantive amendments from time to time, prior to presentation to the Board for final approval; l Receiving, considering and acting upon relevant customer treatment and Conduct Risk management information; l Reviewing the suitability of recruitment, training and awareness requirements as they relate to Conduct Risk; and l Reporting to the Board and Senior Management on significant issues or concerns under this Policy, as needed. It is highly unlikely that the FCA will prescribe what values and ethics should apply to any given firm. This is all but impossible. But firms should be under no illusion that they will be closely scrutinised in this regard. And they will need to be able to demonstrate to the FCA that they have the right culture and values and that employees live and breathe them. 4

5 Conduct Risk and the FCA: What s your next move? Individuals roles and responsibilities There is no specific FSA or FCA requirement for firms to appoint a Conduct Risk Officer or equivalent and firms have adopted a variety of approaches. Whilst some firms still use the Risk or Compliance functions to oversee Conduct Risk, as the subject impacts so many different areas of the business, more and more firms have appointed a very senior individual to lead and oversee all Conduct Risk and customer treatment activities across the firm. Conduct Risks will also change from time to time so the Conduct Risk Assessment will need to be regularly reviewed and refreshed. Figure 1 below sets out an approach to the identification of Conduct Risk and illustrates how firms might use the Risk Assessment to form the basis of their approach to; l Designing controls; l Implementing appropriate monitoring; and l Creating meaningful and actionable management information. The challenge for many firms will be making sense of, and drawing appropriate conclusions and actions from, the sheer volume of data that a Conduct Risk Assessment will generate. Large firms will need to consider whether this is done on a business unit basis or whether it makes sense to aggregate the data and address the risks in a consistent way across the wider group. Management Information requirements Evidence of effective management of Conduct Risk is of critical importance. The specific content of the management information will vary from firm to firm but for many the FSA will expect to see many of the following subjects covered; l Conduct Risk training performance; l Conduct Risk Incidents and outcomes/ recommendations for change; l Breaches of Conduct Risk Policy, remedial actions and root cause analysis; l Treating Customers Fairly management information; l New Product Approval and Product Testing Management Information l Complaints Management Information; and l Reports of any Conduct Risk monitoring activity or external reviews or audits Figure 1: how firms might use Risk Assessment Review of Conduct Risk MI Action on actual and potential Conduct Risks Identify potential Conduct Risks Identify potential risks to TCF outcomes Identify actual Conduct and TCF Risks 2.3 Risk Assessment and Controls As with any significant risk, firms must put in place a process to systematically identify the potential Conduct Risks and risks of unfair treatment of customers across all products and business units throughout the product lifecycle. These risks may well be different, for example, for the same product distributed through different channels or to different target markets. Identify Conduct Risk reporting and MI Identify Conduct Risk Monitoring Articulate Conduct Risk Appetite Identify Conduct Risk & TCF Controls 5

6 3. Product Development and Approval Provider firms will be expected to have robust procedures to assess their target market, perform adequate stress testing, and manage the product risks for consumers. We would expect the sorts of standards that consumers associate with basic vehicle safety or overthe-counter medicines, for example, to be the norm for widely sold financial products. Firms should also consider making their own pre-approval processes more transparent; the aim should be to increase the level of trust consumers have in financial products. Journey to the FCA, October New Product Development The FCA have made it abundantly clear that they intend to intervene earlier in a product s lifespan and seek to address root causes of problems for consumers. The FSA have already adopted this approach and have subjected new product approval processes to rigorous review in many firms. The FCA say that they will do this in future by scrutinising firms product governance and how firms design, operate and sell products. This may include assessing, for example, whether the target consumers needs were taken into account in the product design; whether there is sufficient product oversight and monitoring of practical outcomes for consumers; and whether the distribution strategies are appropriate. In terms of Product Approval the FCA will expect firms to demonstrate that they; 1. Identify the target audience and design a product that meets their needs. So it has to be very clear who the product is aimed at, and for which customers it will not be suitable. 2. Test these products to make sure they can deliver fair outcomes. This could involve looking to see how the product would fare under different scenarios, across the product lifecycle, to basically see if it will do exactly what the firm says it will do. 3. Have a robust approval process in place before products go on sale. This will mean that the sales process gets the product in the right people s hands. It doesn t, for example, allow very elderly customers to invest in long-term or very high-risk investments. 4. Monitor the product to see who is buying it and how it is performing. This is not just about selling it and moving on, but taking an interest in how it is actually working in practice. All firms should therefore ensure that their new product approval processes; 1. Have clearly defined roles and responsibilities for those operating them; 2. Incorporate effective scrutiny and challenge, including from functions like legal, risk and compliance where appropriate; 3. Embed the delivery of fair outcomes for customers; 4. Include comprehensive reviews of sales processes and any additional training needs required for the new product; 5. Manage any conflicts between the firm and the customer; and 6. Have clear criteria for when an abridged or light process may be used and for what constitutes a new product. 3.2 Existing Products Many firms have now developed a risk-based Product Testing Programme, under which all existing products are systematically subjected to a regular review from a Conduct Risk perspective. Performance against the Product Testing Programme will be audited and reported. Risk-based criteria for assessing the priority and frequency of existing product testing will be determined by the firms Senior Management and will include, but not be limited to; 1. Number of customers holding the product; 2. Importance/criticality of product to customer; 3. Potential for Conduct Risk or unfair treatment in the product; 4. External factors, including, but not limited to, any regulatory focus (or fine) for the same or similar products; 5. Complaint volumes in relation to the product type (including any material increase in volumes of complaints); and The Product Testing process will include a formal and documented review of; 1. Product features; 2. Financial promotions; 3. Target market and those for whom product may not be suitable; 4. Product terms and conditions; 5. Sales processes and sales quality performance; 6. Sales incentives; 7. Claims performance (where applicable); 8. Customer feed-back (where available); 9. Barriers to changing the product; 10. Other products which could replace the product and deliver better customer outcomes; 11. Complaints history and trend data; and 12. Other relevant data 6

7 Conduct Risk and the FCA: What s your next move? 3.3 Financial Promotions One of our new powers enables us to ban misleading financial promotions. This power means we can remove promotions immediately from the market, or prevent them from being used in the first place, without going through our enforcement process. By removing the risk of harm we help consumers; and other firms will benefit from a more transparent process Journey to the FCA, October 2012 The current FSA rules in relation to financial promotions, as set out in the Conduct of Business sections of the FSA Handbook, are not expected to change to any great extent under the new regime. There are clearly sector specific requirements (for banking, investment, insurance, mortgages and other products) but in all cases there is an overarching principle that promotional material should be fair, clear and not misleading. Firms need to satisfy themselves that they have robust systems and controls to comply with the detailed financial promotions rules relevant to the products and services they are promoting. This should give the firm confidence that; l All communications, through whatever medium, and all financial promotions are fair, clear and not misleading; l Financial promotions addressed to clients are clearly identifiable as such; l Information is sufficient for, and presented in a way that is likely to be understood by, the average member of the group to whom it is directed, or by whom it is likely to be received; l Information for customers is accurate and, in particular, does not emphasise any potential benefits of products without also giving a fair and prominent indication of any relevant risks; and l Important items, statements or warnings are not disguised or obscured. Digital Media It is very important for firms to consider the impact of the financial promotions rules in relation to their use of digital media. This is becoming an increasingly powerful tool for firms to promote their services to clients and some commentators believe there is something of a vacuum in terms of regulatory requirements. The FSA disagree! We appreciate that digital media allows for very effective ways to promote your business. Unfortunately we continue to see examples where the customer s best interest is not at the heart of digital promotions. For whatever reason, too many firms seem to assume that because the medium is different then the rules must be different too. Let me say again that this is not the case. Facebook and blogs are not real time media and are not exempt from requirements to describe risk and disclose other key information. 18 Sep 2012 Speech by Clive Gordon - Financial promotions: keeping connected and compliant Mr Gordon then provided some very useful guidance on digital media as set out below. l Firstly, digital media may stay in circulation longer than traditional media channels. For example, a press advert is usually discarded the same day, whereas a social media advert has a longer shelf life. So you will need to conduct regular reviews to ensure that the information is up-to-date. l Secondly, consider whether the media channel is a suitable method for the type of product or service promoted. For example, advertising a complex product on Twitter would clearly not be fit for purpose. l Thirdly, make sure that risk information is prominent and clearly displayed. l Fourthly, ensure the promotions and communications meet our requirements for stand-alone compliance. By standalone compliance, I mean our expectation that every financial promotion must meet all the relevant financial promotion rules, regardless of where or how it appears. l And finally, if you can t make the promotion compliant within the allocated space, you can t advertise. For example, Twitter limits the number of characters that can be used, which may be insufficient to provide balanced and sufficient information It is very important for firms to consider the impact of the financial promotions rules in relation to their use of digital media. This is becoming an increasingly powerful tool for firms to promote their services to clients and some commentators believe there is something of a vacuum in terms of regulatory requirements. 7

8 4. Sales and Sales Incentives Provider firms will be expected to have robust procedures to assess their target market, perform adequate stress testing, and manage the product risks for consumers. We would expect the sorts of standards that consumers associate with basic vehicle safety or overthe-counter medicines, for example, to be the norm for widely sold financial products. Firms should also consider making their own pre-approval processes more transparent; the aim should be to increase the level of trust consumers have in financial products. Journey to the FCA October 2012 Sales Processes Most firms now have a programme in place under which sales processes for all of their products and services are subjected to a regular review from a Conduct Risk and Customer Treatment perspective. Sales processes must be designed to ensure that: 1. The needs of the customer are fully understood and documented; 2. Each sale is suitable for the particular customer; and that 3. Products are only sold to the correct and appropriate target customers. Sales processes will include detailed provisions for records of the sale to be maintained and readily recoverable in line with statutory requirements. Robust record retention and recovery processes are critical in the context of future potential mis-selling. In many of the large scale remediation cases to date, the problems firms have faced have been, at least in part, the result of not being able to produce the evidence that the right product was sold in the right way to the right customer Sales Incentives. This bonus-based approach has played a role in many scandals we have seen over the years. Incentive schemes on PPI were rotten to the core and made a bad problem worse. Speech by Martin Wheatley Managing Director, FSA 05 September 2012 Firms are expected by the FCA to have in place effective controls to manage the increased risk of mis-selling arising from their incentive schemes. In addition effective controls should be applied to manage the risk from sales targets and performance management. (Risks to customers from incentive schemes may also arise in areas such as complaints handling, claims processing, mortgage arrears and customers retention and these need to be considered). Effective controls and governance will include, as required: 1. Robust risk-based business quality monitoring and adequate controls to mitigate the risk of inappropriate behaviour during sales conversations; 2. Management information to identify, and act upon, trends or patterns in individual sales staff activity that could indicate an increased risk of mis-selling as a result of features in the incentive scheme. 3. Using this management information to inform the approach to monitoring sale staff incentive risks; 4. Proper management of sales managers conflicts of interest; 5. Effective oversight of incentive schemes by appropriate Senior Management, including approval of the incentive schemes; and 6. An effective risk identification and mitigation process, including regular reviews of incentive schemes and the effectiveness of controls, taking into account customers interests Senior management in all firms are expected to identify and assess the specific features of their incentive schemes that might increase the risk of mis-selling and ensure controls are in place to adequately mitigate the increased risks. Senior management will approve incentive schemes with input from risk management and compliance functions into the design and review of incentive policies and in doing this they will need to consider how incentive scheme features can lead to poor customer outcomes. There should be frequent and effective reviews of incentive schemes, at least annually, with sufficient attention given to risks to the fair treatment of customers. Management information will be collected and used by Senior Management to assess if risks are crystallising and if controls are effective in mitigating the risks. Firms are expected by the FCA to have in place effective controls to manage the increased risk of mis-selling arising from their incentive schemes. In addition effective controls should be applied to manage the risk from sales targets and performance management. 8

9 Conduct Risk and the FCA: What s your next move? 5. Post Sales Handling delivering on promises 5.1. Information The provision of clear and easily understood information throughout the lifecycle of the product is crucial to ensuring consumers are treated fairly. In particular, where consumers do not take advice, they must rely on the clarity of information when making decisions on products and services. This is reflected particularly in TCF Outcome 3. Outcome 3: Consumers are provided with clear information and are kept appropriately informed before, during and after the point of sale. As regards post-sales information, firms will need to ensure that they have in place systems and controls to ensure that; 1. Customers are provided with clear and intelligible information, by the most effective delivery channel, for the duration of their relationship with the firm. 2. Technical terms are explained clearly using commonly understood language. 3. The firm provides information at all times in accordance with commitments made so to do. If customers seek information from the business at any time and through any appropriate means of communication, the firm must deal with all such requests in a timely and efficient manner 5.2 Claims Where a firm offers products under which consumers will be entitled to make claims, particularly insurance products, the firm must ensure that their claims processes and procedures ensure the fair treatment of customers throughout the claims process. Claims performance must be closely monitored through claims monitoring and claims performance management information which should include, where appropriate; 1. Volume of successful claims and rejected claims including any trends over relevant periods of time. 2. Speed of settlement and payment of the claim. 3. Customer feedback from post-claim surveys. 4. Complaints about claims and root cause analysis of those complaints. 5.3 Barriers to Switching The FSA believe that good consumer outcomes are more likely to be achieved where customers can compare products effectively and where customers do not face unreasonable post-sale barriers to change product or switch provider. The FCA will have the same view. Unreasonable barriers to switching might include the following illustrative but nonexhaustive deterrent factors which firms should look out for; 1. High/disproportionate penalties for switching or closing accounts/products; 2. Excessive complication and administration for the customer before they are able to switch / close; 3. Unreasonable risk to the customer arising from potential exposure during the switching/closure process 4. Long initial exclusion periods (during which a claim cannot be made) or extensive exclusions 5.4 Complaints Effective complaints management is fundamental to Conduct Risk and Customer Treatment and the FSA and FCA will continue to monitor activity and performance in this area very closely. Senior Management will be expected to demonstrate a culture which does not view complaints negatively and which will: 1. Make it easier for customers to complain and express their dissatisfaction; 2. Improve the investigation and prompt and appropriate decision making of complaints; 3. Communicate clearly with complainants; 4. Generate meaningful and granular management information and use this to guide decisions; and 5. Identify and tackle the root causes of complaints to prevent similar problems re-occurring. Firms will already have appointed an individual, to have responsibility for oversight of compliance with the FSA s complaint handling rules in the FSA Handbook in relation to disputes ( DISP ). The individual appointed must hold a governing function at the firm (or in the overall Group). The Complaints Officer s typical responsibilities will be to; 1. Provide oversight of the firm s compliance with DISP; 2. Act as a single point of contact for the FSA for complaints handling; 3. Ensure that the firm complies with requirements to publish complaints data, either by business unit or in aggregated format, within time limits and in the format required by the FSA (where required); 4. Ensure that sufficient resources are allocated to the complaints-handling function; 5. Exert pressure on other parts of the business to take appropriate action where failures elsewhere are leading to complaints; 9

10 6. Reviewing management information (MI) in relation to complaints and assessing whether it is fit for purpose. Specifically, the MI should be robust and detailed enough to allow meaningful root cause analysis to be carried out, in accordance with the requirements of the FSA rules, and to enable the firm to be sure that it is treating its customers fairly; 7. Reviewing MI and assessing whether appropriate actions are taken in response to the results of root cause analysis; and 8. Ensuring that sufficiently senior individuals lead complaints activities across the firm. Firms should take into account the nature, scale and complexity of its business (including, in particular, the number of complaints the business unit receives) and will put in place appropriate processes, systems and controls in order to comply with the FSA s requirements. Root Cause Analysis Root cause analysis remains a key focus of the FSA so every firm should ensure that they have in place robust and proportionate systems and controls to ensure; 1. The collection of management information on the causes of complaints and the products and services complaints relate to, 2. A process for analysing the causes of individual complaints so as to identify root causes common to types of complaint 3. A process to prioritise dealing with the root causes of complaints; 4. A process to consider whether the root causes identified may affect other processes or products 5. A process for deciding whether root causes discovered should be corrected and how this should be done; 6. Regular reporting to the Senior Management where information on recurring or systemic problems may be needed for them to play their part in identifying, measuring, managing and controlling risks of regulatory concern; and 7. Maintenance of records of analysis and decisions taken by senior personnel in response to management information on the root causes of complaints. Final thoughts and conclusions l There is no right way to manage Conduct Risk effectively. l Senior Management, from the CEO down, must be fully engaged in the approach to Conduct Risk employed by the firm. l Each firm must consider and articulate very clearly what Conduct Risk means to them. l Every firm should be able to demonstrate that they have identified potential Conduct Risks and put in place appropriate and proportionate controls and management information to mitigate the risks identified. l Firms must ensure that they have devoted sufficient resources to the effective management of Conduct Risk. l The focus on conduct issues by the FCA will be relentless. l The expectations of the FCA will continue to evolve. l TCF has not gone away and firms need to ensure that their approach to conduct risk builds on, and incorporates their approach to TCF. l Conduct Risk is all about delivering the right outcomes for consumers and fixing things when this does not happen. l Effective management of conduct risk will deliver better results for customers and could even be used to enhance the reputation of the firm. Essentially, we will be looking for firms to base their business model, their culture, and how they run the business, on a foundation of fair treatment of customers as set out in the Treating Customers Fairly (TCF) initiative. While we recognise that firms need to be sustainable, we will not let a firm compromise fair treatment of customers to achieve financial success. Journey to the FCA 10

11 Conduct Risk and the FCA: What s your next move? The Group s Conduct Strategy and supporting framework have been designed to support its vision and strategic aim to put the customer at the heart of everything it does. The Group has developed and implemented a framework to enable it to deliver the right outcomes for its customers, which is supported by policies and standards in key areas, including product governance, customer treatment, sales, responsible lending, customers in financial difficulties, claims and complaints handling. The Group actively engages with regulatory bodies and other stakeholders in developing its understanding of current customer treatment concerns. The Group develops colleagues awareness of these and other expected standards of conduct through these and other policies and standards and codes of responsibility. It also undertakes root cause analysis of complaints and makes use of technology and metrics to facilitate earlier detection and mitigations of conduct issues. Extract from LBG 2012 Results PRINCIPAL RISKS AND UNCERTAINTIES

12 Copyright 2013 Wolters Kluwer Financial Services. All rights reserved. All other registered or unregistered trademarks and service marks are property of their respective companies and should be treated as such. No part of this publication may be reproduced, transcribed, transmitted, stored in a retrieval system, computer or otherwise, in any form or by any means, magnetic, mechanical, electronic, optical, manual or otherwise, and may not be translated into any language without the express written permission of Wolters Kluwer Financial Services. About Wolters Kluwer Financial Services Whether complying with regulatory requirements, addressing a single key risk, or working toward a holistic risk management strategy, more than 15,000 customers worldwide count on Wolters Kluwer Financial Services for a comprehensive and dynamic view of risk management and compliance. Wolters Kluwer Financial Services provides audit, risk, finance and compliance solutions that help financial organizations improve efficiency and effectiveness across their enterprise. With more than 30 offices in 20 countries, the company s prominent brands include: FRSGlobal, FinArch, ARC Logics for Financial Services, Bankers Systems, VMP Mortgage Solutions, AppOne, GainsKeeper, Capital Changes, NILS, AuthenticWeb and Uniform Forms. Wolters Kluwer Financial Services is part of Wolters Kluwer, a leading global information services and solutions provider with annual revenues of (2012) 3.6 billion ($4.6 billion) and approximately 19,000 employees worldwide. Please visit our website for more information. Wolters Kluwer Financial Services FRSGlobal