FCA’s expectations of senior managers in the context of Russian sanctions

This article was first published by Lexis®PSL Corporate crime on 14 March 2022 and is republished with permission. The original article can be accessed here (subject to subscription).

What are the FCA’s expectations around senior management responsibility for sanctions risk?

Which senior managers will be responsible?

It is likely that there will be a number of members of senior management within FCA authorised firms with either individual or collective responsibility for managing sanctions risk under the SM&CR.

At an individual level, primary responsibility for sanctions compliance will generally be held by the senior manager who is allocated the prescribed responsibility for ‘the policies and procedures for countering the risk that the firm might be used to further financial crime’. This prescribed responsibility is often allocated to the Money Laundering Reporting Officer (MLRO); however, it does not have to be. To the extent that this responsibility is held by a different senior manager, that individual will need to work closely with the MLRO and/or financial crime team to ensure the firm is complying with financial sanctions measures.

Senior managers responsible for specific business areas must also ensure that their business area complies with relevant regulatory requirements, including financial sanctions, and that their teams follow the firm’s internal policies and procedures as they relate to sanctions.

Separately, other members of senior management may have collective responsibility for ensuring compliance with financial sanctions. In particular, the board of directors as a whole are responsible for ensuring that the business complies with relevant legal and regulatory standards. It follows that directors (both executives and non-executives) should ensure that they are comfortable that the firm has taken the steps to ensure compliance and that the board has oversight of the requisite level of oversight (for example, through management information).

What are the most critical points for senior management to note in discharging their regulatory duties relating to sanctions risk?

In order for senior managers with responsibility for sanctions compliance to evidence that they have taken reasonable steps to comply with their personal regulatory duties under the SM&CR, they may wish to consider the following:

• policies and procedures—ensuring there is an effective framework in place to identify and manage sanctions risks (including clearly documented policies and procedures)
• monitoring and updates—ensuring new sanctions measures are being monitored and processes updated to ensure ongoing compliance
• delegation—ensuring that staff carrying out the day-today processes such as sanctions screening, or advising on sanctions issues, have the requisite level of capacity and expertise to do so effectively (including where such functions are outsourced either externally or intra-group)
• resourcing—ensuring any resourcing issues that may adversely impact on the firm’s ability to comply with its sanctions obligations are addressed promptly
• training and awareness—ensuring that staff have had adequate training and receive updates in order to understand the firm’s obligations in relation to sanctions and what is expected of them in relation to sanctions procedures
• oversight and assurance—ensuring that they receive high quality and up-to-date management information in relation to sanctions compliance, including exception reporting, and details of ongoing monitoring and/or quality assurance checks of sanctions processes
• escalation and notifications—ensuring there is a process in place to identify and escalate issues (including any potential breaches of sanctions), and that the firm has a process in place to ensure it complies with its legal and regulatory notification obligations, eg if a sanctions breach occurs

What are the risks for senior management if the firm breaches sanctions?

The SM&CR has introduced an unprecedented level of personal accountability for senior managers.

In the event that a sanctions breach occurs, and the FCA chooses to investigate it, there is a significant risk that individual members of senior management may be placed under investigation (alongside the firm).

If the FCA is able to establish that the senior manager(s) concerned did not take reasonable steps to discharge their personal regulatory obligations under the Conduct Rules (including the Senior Manager Conduct Rules) and/or the Duty of Responsibility, then it may choose to take disciplinary action against the relevant senior manager(s). A senior manager can also be liable if they are found to be ‘knowingly concerned’ in a breach by the firm of its regulatory obligations.

The consequences for individuals in the event the FCA takes successful disciplinary action against them are severe. Such an outcome would likely result in the imposition of a public censure and a financial penalty (which the individual would be required to pay themselves). In the most serious cases, the FCA may also impose a form of prohibition order (or ban) on the individual. It is therefore critical that senior managers are able to evidence that they have managed the risks for which they are responsible effectively.