Latest FCA Guidance on Remote or Hybrid Working Expectations for Firms
- What is the subject of the FCA Guidance and why has it been issued?
On the 11th October 2021 the FCA issued guidance on the standards expected of regulated firms that are currently operating, or plan to operate in the future, with an element of remote working. Whilst the coronavirus pandemic has already forced most firms to work remotely for over a year, the FCA is keen to ensure that firms who plan to make remote work a permanent feature of their business understand that their regulatory responsibilities have not changed and that these will need to be met, despite the lack of a centralized location.
The FCA will be reviewing their expectations of regulated firms as time progresses and more is learned about the strengths and shortfalls of remote working within a regulated context. It is therefore being advised that firms adopt thorough procedures and maintain high standards from the outset, in order to reduce the need for future measures to be made by the FCA in response to poor compliance at firms who adopt a working from home model.
- To whom is the Guidance applicable?
The Guidance applies to existing firms, firms applying to be regulated and firms proposing to submit further applications, such as waivers, variation of permission, change of control etc.
- What do these firms need to consider?
Generally speaking, firms need to be aware of their continuing obligation to meet the threshold conditions for their permitted regulated activities, their capacity to provide relevant information to the FCA, the accuracy of the FS Register and their ability to oversee various business functions. Broader considerations include the risk of financial crime and the desire to preserve the integrity of the financial markets.
In practical terms, firms which have a remote working element need to be able to ensure that they have appropriate systems and controls in place, particularly from an IT functionality perspective, to support compliance monitoring, data protection, and negate cyber risks. Where necessary, robust record keeping procedures will need to be implemented in order to ensure that firms can meet their ongoing reporting obligations. Firms also need to consider the impact of remote working on staff, including wellbeing, training and diversity and inclusion matters.
Firms also need to ensure that appropriate governance and oversight is being carried out by senior managers under the Senior Managers regime, as well as relevant internal committees and NEDs.
If the principal place of business for a firm is changed to a private residential address following a decision to adopt a remote working model, the firm should consider whether the FS Register needs updating, as well as the fact that the FCA has powers to physically access any principal place of business. The impact on any individuals who live at the private residence will therefore need to be taken into account.
Principle 11 of the FCA’s Principle for Businesses requires firms to deal with the FCA in an open and cooperative way and to disclose anything relating to the firm which the FCA may reasonably expect notice of. Firms may therefore need to notify the FCA of any material changes in how they operate (including a decision to adopt a home working model).
Finally, the new FCA Guidance indicates that applications to the FCA for authorisation/registration will need to be more detailed, in that information will need to be provided on the following (and more):
- the arrangements for remote working;
- legal implications for a remote working arrangement;
- how key functions will be performed, overseen and based; and
- location of senior managers and their plans to oversee the firm’s activities.
- Is any action required?
It appears that the latest FCA Guidance on WFH is a reminder to firms that the responsibilities of regulated firms remains the same, and that whatever measures are needed to ensure compliance with these responsibilities will need to be implemented. The Guidance does not therefore introduce a drastic change to the regulatory framework in which firms are operating, but instead is a firm reminder that there are rules in place and that these will need to be met, despite home working.
The extent to which action is required will ultimately differ from firm to firm. In terms of practical measures which could be taken in order to demonstrate compliance with the Guidance, an example includes issuing information to employees and ARs on how to protect data and avoid security risks, as well as implementing anti-virus and data protection software on all devices from which work will be carried out. Another example is frequent, documented conversations with staff about how they are finding working from home and what issues they are facing, in order to consider the wellbeing, training and development of staff.
The FCA have provided a non-exhaustive list of steps which could be taken by firms in order to ensure they comply with the rules and regulations to which they are subject. It is advised that recipients of the Guidance choose which are most relevant to their business and take action accordingly.
For the full Guidance, please visit https://www.fca.org.uk/firms/remote-hybrid-working-expectations.
