FCA fines firm and reinforces its tough stance towards firms with weak market abuse controls

Background

WH Ireland Ltd (WHI) is a firm that offers private wealth management and corporate broking services to its clients.    Due to the nature of WHI's services and the way in which it provided those services, the FCA assessed that WHI was especially vulnerable to the potential risks of market abuse, particularly relating to the uncontrolled transfer of inside information within WHI and transactions that WHI carried out on behalf of clients. As a result, the FCA considered that it was important for WHI to establish properly documented and robust market abuse controls.  

FCA's findings 

In February 2016, the FCA found that WHI had breached Principle 3 of the FCA's Principles for Businesses (PRIN) in relation to its market abuse systems and controls. This is the requirement that "a firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems". WHI was also found to have breached various provisions of the chapter in the Senior Management Arrangements Systems and Controls sourcebook (SYSC) relating to management of conflicts of interest linked to the risk of market abuse. The FCA's findings about WHI related to a very short period of time: 1 January 2013 to 19 June 2013 (the Relevant Period). 

The FCA's findings focused on WHI's private wealth management and corporate broking divisions. Its findings regarding WHI's market abuse controls related to the following key areas:

• The handling of inside information (see Handling of inside information below).
• Personal account dealing (see Personal account dealing below).
• Conflicts of interest (see Conflicts of interest below).
• Compliance oversight of market abuse risks (see Compliance oversight below).
• Governance (see Governance below).
• Market abuse training (see Training below).

Handling of inside information

The FCA's findings focused on how WHI dealt with inside information, as well as its procedures for dealing with Chinese walls. The FCA found that:

• While WHI had a procedure for wall-crossing employees, there was no equivalent policy relating to the wall-crossing of clients.
• WHI's corporate broking team was not provided with clear guidance or a script as to what they could or could not disclose in communications with potential investors, prior to them being wall-crossed.
• Emails drafted by employees in WHI's corporate broking and research teams that set out information about potential investment opportunities were not reviewed by WHI's compliance division prior to circulation to check that they did not contain inside information.
• WHI's compliance division did not monitor calls made between employees and third parties to check that wall-crossing was taking place and/or make sure that market abuse was not occurring.
• Although WHI's corporate finance division was located separately, there was insufficient physical separation of research employees and corporate and private client employees. This meant that these teams could have overheard inside information, or have viewed such information on other peoples' computer screens.

The FCA concluded that these control weaknesses gave rise to a risk that inside information may have been communicated inappropriately to both internal and external third parties before they were wall-crossed. The FCA also added that "poor record keeping and inadequate monitoring" increased the risk that important information about communications was not recorded and that inappropriate disclosure of inside information went undetected.

Personal account dealing

The FCA described personal account dealing as "an area of inherent risk for any firm in this sector given the potential for employees to seek to make personal profit from inside information or other information that they became aware of in their professional capacity". The FCA requires firms to establish, implement and maintain adequate arrangements aimed at preventing employees from committing market abuse and from misusing or improperly disclosing confidential information (see 11.7.1R in the Conduct of Business sourcebook (COBS)).

Although WHI had personal account dealing rules in place, the FCA found that these rules were inadequate in the following ways:

• WHI's personal account dealing rules contained various inconsistencies. For example, they were not clear about whether employees were permitted to have external (that is, non-WHI) personal dealing accounts. They were also not clear about what trading instruments were subject to the personal account dealing rules (that is, instruments traded by WHI clients or all instruments).
• It was not clear from WHI's personal account dealing rules whether an employee's holdings must be declared at the commencement of their employment. In addition, there was no requirement for new employees to declare their external personal account dealing holdings on an annual basis.
• WHI required its employees to complete attestations to say that they had read and understood its personal account dealing rules. However, the attestations themselves were not clear and did not cover WHI's full personal account dealing rules. In addition, employees were not required to refresh their attestations on an annual basis, thereby – in the eyes of the FCA – giving rise to the risk that "staff might have misunderstood the importance of the [personal account dealing] rules, not known if [these rules] had changed and… records might not have been kept up to date".

The FCA also identified several shortcomings in terms of how WHI went about monitoring their personal account dealing rules, something which the FCA said is "crucial". For example:

• The personal account dealing register maintained by WHI was incomplete, meaning that there was no comprehensive record of employees' personal account dealings.
• The monitoring of employees' compliance with the personal account dealing rules was undertaken by a team of WHI compliance officers based in Manchester. However, this team did not cross-check employees' personal account dealings against a list of companies in relation to whom WHI was drafting research or in discussions about transactions (including fund raisings and acquisitions).
• No checks were performed to identify any personal account dealing in securities of companies that were discussed by research analysts at daily meetings.

The FCA found that these weaknesses meant that there was a risk that WHI employees "may have repeatedly breached the [personal account dealing] rules exposing WHI to potential market abuse".

Conflicts of interest

The FCA linked two of its high priority areas of focus by saying that a "significant risk of market abuse arises from inadequate systems and controls to deal with conflicts of interest".

The FCA found that WHI's controls relating to conflicts of interest were inadequate. Specifically, the FCA found that WHI failed to maintain a record of where the kinds of service or activity carried out in which a conflict of interest entailing a material risk of damage to the interests of one or more clients has arisen or may arise (as is required by SYSC 10.1.6R). Rather, what WHI had in place was a document which outlined the systems, controls and procedures that WHI had in place to manage conflicts of interest. The FCA also felt that this document was inadequate, and did not meet the requirements set out in SYSC 10.1.10R.

Compliance oversight

The FCA identified a number of weaknesses in WHI’s compliance oversight of market abuse risks.

Compliance framework and risk assessment

During the Relevant Period, WHI had no formal risk assessment or risk management framework for market abuse. As a result, monitoring that was undertaken in relation to market abuse was not, in the FCA's view, based on a proper assessment of the nature and seriousness of market abuse risks and the probability and impact of market abuse risks crystallising.

Although WHI had a compliance plan which addressed market abuse, it merely set out some of the obvious ways in which market abuse could occur. It was not forward-looking and was not sufficiently detailed.

Monitoring and surveillance

WHI undertook various daily monitoring and surveillance activities. To assist with these activities, WHI had specialist software that was designed to flag exceptions, including trades not performed at best execution, where there was a risk of market abuse. However, the FCA found that these monitoring and surveillance activities were flawed:

• The specialist software used relied on WHI setting certain parameters which would identify potentially suspicious transactions. However, the FCA found that WHI set the parameters too narrowly and did not address specific activities or the full breadth of its market abuse risks.
• The parameters that WHI did set generated a significant volume of alerts. However, WHI's compliance division was unable to review this volume of alerts in a timely and consistent manner. For example, by the end of the Relevant Period, the FCA found that there was a backlog of 60 days between the date of a trade and the date when any alert generated by that trade.
• The FCA noted that the data generated by WHI's suspicious trade alerts was "only useful to the extent to which the data… was analysed by competent staff in the compliance department". However, the FCA appears to have doubts as to whether WHI's compliance officers (who were typically junior with limited experience) were properly equipped to review suspicious trade alerts. In particular, the FCA found that there was "no system or training in place to guide staff in the compliance department as to which alerts should be investigated".

Management information

In addition, WHI could not demonstrate to the FCA that there was any procedure for the escalation of market abuse issues to the board.

STRs

WHI's systems and controls relating to STRs were found to be inadequate for the following reasons:

• WHI's STR procedures relied on employees making judgments as to whether a transaction was sufficiently suspicious to require escalation to compliance, rather than requiring employees to escalate all suspicious transactions.
• The STR procedures were insufficiently detailed and did not provide information about how a suspicious transaction should be reported to compliance.
• WHI maintained no detailed log of suspicious incidents or an audit trail of surveillance alerts and escalations. Likewise, WHI maintained no records setting out why STRs were not submitted in certain cases. The FCA concluded that this meant that WHI had insufficient records of STRs to demonstrate compliance with its regulatory obligations.
• There was no documented procedure for the escalation of suspicious transactions to the FCA, or documented guidelines setting out factors which should be taken into account when deciding whether to submit an STR.

Governance

The FCA's findings regarding WHI's governance arrangements, stemmed from WHI's failure to clearly allocate responsibilities, reporting lines and accountabilities for market abuse.

Compliance and risk committee

WHI's compliance and risk committee met four times a year. However, it had no documented or formal role with regard to market abuse. Market abuse was not included as a standing agenda item and the committee did not receive any significant management information relating to market abuse.

The FCA also identified shortcomings in relation to the compliance and risk committee's minutes. For example, they contained no information about discussions held, decisions made or actions agreed. There was also no framework for the committee to escalate issues to WHI's board.

Internal audit and the audit committee

• The FCA reviewed WHI's internal audit plans for 2012 and 2013. The FCA found that these plans were insufficiently detailed.
• WHI's audit committee did not discuss market abuse risks in sufficient detail, and there was no evidence that the market abuse issues raised in audit reports produced during the Relevant Period were acted on.

WHI's board

During the Relevant Period, WHI’s board met three times. However, the FCA found that there was little documented discussion of market abuse issues and, to the extent that such issues were discussed, there was no evidence of that discussion or any action taken.

The FCA found that some board packs raised "potentially significant market abuse issues". However, the FCA found no evidence that action plans were put in place to deal with these issues, nor did the board request further management information from WHI's compliance division.

Training

The FCA emphasised that the purpose of firms' market abuse training should be two-fold. First, training should ensure that employees are aware of their obligations in relation to market abuse. Secondly, training should ensure that employees have sufficient understanding to recognise behaviour that might constitute market abuse in their day to day business.

The FCA found that, with the exception of new joiners, WHI employees received no formal training in relation to market abuse during the Relevant Period. The training that was provided to WHI employees outside the Relevant Period was found to be either too informal or inaccurate in terms of the way it defined market abuse. Where employees failed to complete their market abuse training, the FCA found no evidence of any sanctions being applied to them.

The FCA expressed concerns about the "high level" nature of WHI's market abuse training for employees, but did note that informal training "can form part of a wider training programme".

The market abuse training that was provided to WHI's compliance division was also found to be insufficient. For example, those working in the compliance division did not receive any additional training, over and above that which was provided to other WHI employees. The FCA noted that this "significantly compromised" WHI's ability to mitigate against market abuse.

Sanctions

Financial penalty

The FCA imposed a financial penalty of GBP 1.2 million on WHI. This may appear to be quite a small financial penalty when compared to some of the larger financial penalties imposed by the FCA in recent years, as well as in the light of the extent of the FCA's findings regarding WHI's systems and controls. However, the short duration of the Relevant Period in this case (just under six months) appears to have been a key driving factor behind the relatively low financial penalty imposed on WHI in this case.

One factor that did increase the financial penalty imposed on WHI, was how WHI reacted to certain recommendations made by a skilled person, which the FCA required WHI to appoint in July 2013. The report produced by the skilled person identified a number of weaknesses in relation to WHI's market abuse controls (which largely corresponded with the findings made by the FCA, as outlined above). The skilled person report also made a series of recommendations as to how WHI could improve its market abuse controls. WHI agreed to implement these recommendations. A year later, in July 2014, WHI asked the skilled person to return to assess how well WHI had implemented its recommendations. The skilled person found that a number of its recommendations had not been implemented adequately. WHI's failure to implement these recommendations contributed to the FCA increasing WHI's financial penalty by 20%. Although not expressly stated in the final notice issued to WHI, it may have been WHI's failure to implement the skilled person's recommendations that contributed to the FCA's decision to refer WHI to Enforcement.

Restriction

In addition to imposing a financial penalty on WHI, the FCA also decided to impose a restriction on WHI under section 206A of the Financial Services and Markets Act 2000 (FSMA) (the third time the FCA has used this power). The restriction prevented WHI's corporate broking division from taking on new clients in relation to the carrying on of regulated activities for 72 days.

The FCA indicated that the following two factors were instrumental in it deciding to impose a restriction on WHI:

• WHI failed to properly implement the recommendations made by the skilled person in July 2013.
• The failings identified in relation to WHI's systems and controls relating to market abuse suggested "a poor compliance culture" that "gave rise to a substantive risk of market abuse occurring".

Comment

The FCA's message to firms with weak market abuse controls is a strong one:

1.      "If we continue to find firms that fail to identify or mitigate risks associated with market abuse, or fail to report to the FCA instances where market abuse has occurred, then we will take stringent action against those firms" (FCA Market Watch Newsletter, Issue No. 50 (April 2016)).

The prospect of taking enforcement action against WHI in this case is likely to have been appealing to the FCA. Although the FCA was only able to impose a relatively small financial penalty on WHI, its findings relating to WHI's market abuse controls are broad, and touch on most aspects of firms' market abuse controls. As a result, this case has given the FCA a good opportunity to set out its expectations of firms and their market abuse controls, which will no doubt prompt a number of other firms to review their existing market abuse controls. The regulatory spotlight shone on firms' market abuse controls is only likely to get brighter as we fast approach the implementation date for the Market Abuse Regulation (2014/596/EU) (3 July 2016).

One question that is not answered in the (quite lengthy) final notice issued to WHI in this case, is what prompted the FCA to first look at WHI's market abuse controls. Firms that find themselves contacted by the FCA's Markets Division with enquiries relating to potentially suspicious transactions may also find that the adequacy of their market abuse controls is scrutinised by the FCA, as part of those enquiries.

Final notice

W H Ireland Ltd (22 February 2016).

This article first appeared in Practical Law and is published with the permission of the publishers.

For information and commentary on the latest trends, risks and developments in financial services investigations, please see Allen & Overy's Investigations Insight blog.