The FCA published its Senior Managers and Certification Regime (SMCR) near final rules on 4th July 2018, which mainly confirms its proposed rules released last summer. In these new rules, the FCA has introduced a new Prescribed Responsibility for firms’ compliance with CASS which will require firms to reflect on the interaction of roles and responsibilities between the “CASS Prescribed Responsibility” (to be allocated to a Senior Manager) and the significant-harm “CASS Oversight function” (certified function).
The FCA now makes a clear distinction between the activities of performing CASS oversight from an operational perspective, and being ultimately accountable for a firm’s compliance with the CASS obligations. This also reinforces enforcement trends whereby accountability for failings has so far been attributed to senior management, rather than the CASS Oversight function (currently with the job title of “CF10a”) itself. The upshot of this is that the CF10a will no longer require FCA approval, but instead will be subject to firm’s own “fit and proper” assessment. These individuals will therefore, not be converted to a Senior Manager Function (SMF) unless they currently hold a Controlled Function that maps to an SMF, or are newly eligible for such a function following re-allocation of responsibilities.
So… how the SMCR might challenge and/or change existing CASS arrangements is the question we have asked ourselves. Below is a list of what we believe are the key impacted areas for CASS that are worth firms reflecting on:
- Large CASS firms will be “enhanced firms” and as a result, have to implement additional requirements (e.g. Management Responsibilities Maps and Handover Procedures). For those, the approach and timelines will have to be tailored accordingly
- Allocation of responsibilities: The SMCR will further emphasise the distribution of CASS responsibilities of management, making the boundaries clearer as a result of the distinction made between CASS oversight and compliance. However splitting those responsibilities might not be a simple process for smaller firms, and pros and cons will need to be considered. It is worth noting that any re-allocation of responsibilities will come with potential challenges around the sensitivities of discussions to be held with individuals
- Empowering the right individual(s): The individual fulfilling the CASS Oversight Significant-Harm Function will need to have a seat at the table of the firm’s governing body or forum with the same level of influence. Indeed, they will also be responsible for the day-to-day CASS compliance whether a Senior Manager or not and, therefore, will need to be part of the decision-making process to ensure actions are taken when needed. For example, as part of their responsibility for ensuring adequate systems and controls are in place, they must be able to raise any concern around a control’s failure and take corrective action where necessary (either individually or collectively)
- Stronger and more effective governance arrangements: Improved governance and incident management processes will enhance firms’ abilities to identify CASS-related incidents and ensure these are not only reactive but also forward-looking. It is, however, important that firms embed their CASS governance arrangements into their wider governance frameworks for consistency and transparency.
With those additional points to reflect on, CASS firms are assured to have a busy schedule to work on ahead of the 10th December 2019, and no time to lose!