Reflections on PRA and FCA enforcement under the twin peaks system

A decade is a long time in financial regulation.

On 1 April 2023 the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) will both celebrate their 10th birthdays since being formed as part of the suite of regulatory reforms following the 2008 financial crisis.

Back in 2013 it was clear that the two bodies had very different approaches to how they supervised firms and also to disciplinary action against firms and individuals suspected of breaching their rules.

From the outset the FCA was equipped with a substantial Enforcement Division which, over the years – particularly during the most recent period under Mark Steward – has lowered its internal evidential threshold for kicking off investigations and therefore significantly increased the numbers of individuals as well as firms placed under investigation. This has led to a significant increase in the length of time taken to conclude its investigations, and criticism for leaving firms and individuals waiting (in some cases for years) while other cases are prioritised.

In contrast, the PRA made clear from the outset that it would not be an enforcement-led regulator and therefore maintained a much smaller team capable of handling regulatory investigations. In the early days, the actual investigation of issues was largely outsourced by the PRA to members of the FCA's Enforcement Division, particularly where issues were being investigated by both regulators.

Over time the PRA has increasingly embraced the world of Enforcement as an effective method of communicating its regulatory priorities to the market and making senior management sit up and take note. As a result the PRA's Enforcement unit is now far more independent and considerably larger than it was 10 years ago.

Cases pursued by the PRA have been in a number of its priority areas such as operational resilience, governance and management of risk, and regulatory reporting. Many of the fines against firms have been very substantial. However the flow of disciplinary outcomes has never grown to more than a handful of cases each year, which has often resulted in Final Notices issued by the PRA having more impact within the market than those issued by the FCA.

The PRA has also developed its own style of investigating suspected breaches which is distinct and different from the FCA. For example, the PRA has not embraced the FCA's fondness for early interviews with witnesses and subjects, in which individuals are pressed for information on the areas of concern, often with limited contemporaneous documentation available to them. Rather, the PRA's increasing preference appears to be requesting narrative accounts from firms and their senior managers on the systems and controls in place and the steps taken to ensure that the relevant risks were managed appropriately. Witnesses and subjects of investigations can then be questioned on the answers provided.

One area that the two regulators certainly have in common is their desire to achieve regulatory outcomes against Senior Manager Function holders ('SMFs') in relation to failings in management over the area of the business for which they are responsible. After seven years of the Senior Managers & Certification Regime, both regulators have placed plenty of SMFs under investigation in relation to suspected failings in their managerial responsibilities but those investigations have either been discontinued (on the basis that the individual was shown to have acted appropriately) or have not yet made their way through the regulatory system.

This topic of individual accountability is clearly high on the regulators' priority list and we expect a real focus from both the PRA and FCA on achieving public outcomes against SMFs for managerial failings as they head into their 11th year.

Authors: Nathan Wilmott, Partner; Adam Jamieson, Partner and Max De Tommaso, Junior Associate