Conduct Risk framework – a guide for firms

Conduct risk: overview

Since its inception in April 2013 the FCA's regulatory approach has been underpinned by a strong Conduct Risk agenda. In particular, the FCA has made clear that it is determined to create a culture of good conduct at every level of the financial services industry to make markets work well and to produce a fair deal for customers. The FCA therefore expects all firms to have a strong Conduct Risk framework in place to facilitate a culture that delivers good outcomes both for consumers and the markets as a whole.

The FCA's key aim in relation to Conduct Risk is to ensure that firms do the right thing for their customers whilst keeping them, and the integrity of the markets in which they operate, at the heart of everything that they do. Firms should seek to promote good behaviour across all aspects of their organisation and develop a culture in which it is clear that there is no room for misconduct. Although "treating customers fairly" has long been part of the retail regulatory framework, Conduct Risk should not be seen as merely an extension of this. Linked to this is the commonly held misconception that Conduct Risk is only a retail issue. The FCA is just as interested in the role that wholesale conduct plays in underpinning the integrity of the markets in line with its objective to protect and enhance the integrity of the UK's financial system. It therefore expects both wholesale and retail firms to have properly functioning Conduct Risk policies and procedures in place.

Conduct Risk is not a defined term and the FCA has expressly stated that it is not suggesting that there is a single regulator-approved identikit culture that will suit every organisation. Rather, firms must develop their own Conduct Risk definition and strategy tailored to the specific risks that they are exposed to and the needs of their organisation. However, in a speech by Tracey McDermott in 2015, the key messages of which were repeated by Megan Butler, Director of Supervision on 28 September 2017, the FCA has set out five questions which every firm will be expected to answer.

Conduct risk: 5 key questions

The FCA has emphasised that, in line with its Conduct Risk agenda, it expects firms to move away from the following behaviours:

• prioritising profits over ethics and commercial interests over consumer interests;
• a tick-box and overly legalistic approach to compliance;
• the idea that disclosure at the point of sale absolves the seller from responsibility for ensuring that a product/service represents a good outcome for the customer (note the continued erosion of caveat emptor); and
• complying with only the letter (rather than the spirit) of laws and regulations.

It has also set out five key questions which it expects firms to ask themselves and be able to answer to the regulator.

1. What proactive steps does the firm take to identify conduct risks in its business?
2. How does the firm encourage people in front, middle, back office, control and support functions to feel responsible for managing conduct?
3. What support does the firm put in place to help its people improve the conduct of their business or function?
4. How does the firm’s board and executive committee get oversight of conduct in the organisation? And how do people bring it in to their discussions?
5. Has the firm looked at where there are any business activities it is engaged in that undermine its work to improve conduct?

These questions aim to probe how firms embed long term good business practice, or how a firm considers good conduct in its training and induction programme.

When assessing Conduct Risk, the FCA will consider a firm's approach to these matters, and also whether the board is engaged with these issues.

As an example, the FCA has stated that it will look to see whether the board of a firm probes high return products/services and the extent to which the board monitors whether products are being sold to the markets that they were designed for. This will become even more important with some of the changes brought in by MiFID II product governance and the PRIIPs KID Regulation. It also suggests, in our view, that product governance should be embedded within a firm's conduct risk framework.

The FCA has also given the example of cyber and information security having a ‘huge conduct element – including basics like clear desk policies and phishing scams’. The FCA notes that it is also seeing conduct risk in emerging areas such as algorithms.

The FCA also wants firms to consider the incentivisation of employees in the firm. This may include more than just financial incentives. The FCA gave the example of a firm where a member of staff with a good P&L gets promoted or rewarded if they bend the rules. Or where in contrast positive role models are identified and championed.

The change to embed these principles is likely to represent a significant cultural shift for some firms and accordingly it is important to ensure that this change in the regulatory environment is taken into account when designing a firm's Conduct Risk management framework.

In addition, the FCA has made clear that it intends to hold senior management to account for Conduct Risk failings, particularly through the Senior Managers' and Certification Regime rules, and accordingly, a strong Conduct Risk framework is an important tool in protecting senior management from such liability.