The FCA’s Warning to Payments Firms

Niall Hearty of Rahman Ravelli details the action that the Financial Conduct Authority expects to see from hundreds of companies.

The Financial Conduct Authority (FCA) has written to the CEO’s of 291 payments firms to warn them they will be shut down if they do not tackle “unacceptable" risks to consumers and the integrity of the financial system.

In the letter entitled “FCA Priorities for Payments Firms’’, the FCA's director for payments and digital assets, Matthew Long, says the watchdog welcomes the competition and innovation that has flourished in the UK's payments sector.

But he adds: “We remain concerned that many payments firms do not have sufficiently robust controls and that as a result some firms present an unacceptable risk of harm to their customers and to financial system integrity."

Shortcomings

The letter highlights common shortcomings regarding the safeguarding of customers' money in the event of payments firms failing “in a disorderly way’’.

These are:

• Firms not having documented processes for consistently identifying which funds are ‘relevant funds’ (as defined in regulations) and must be safeguarded.
• Inadequate reconciliation procedures to ensure that the correct sums are protected on an ongoing basis.
• A lack of due diligence and acknowledgement of segregation from credit institutions providing safeguarding accounts.

In July 2020, the FCA published new guidance requiring payments firms which undertake a statutory audit to also conduct an annual audit of their safeguarding arrangements. The director’s letter says there has been evidence of audits resulting in safeguarding improvements. But it adds that some firms have not yet appointed auditors and states that the FCA is not being consistently informed of adverse findings or the actions being taken to address them.

It says that each firm must:

• Appropriately document its process to identify which funds are relevant funds for the purposes of safeguarding.
• Undertake internal and external reconciliations at least once a day to ensure that safeguarded funds are adequate and not excessive.
• Ensure that the accounts in which relevant funds are held (or the insurance policy or comparable guarantee) meet FCA requirements and are supported by the appropriate documentary evidence.
• Maintain appropriate records to enable the firm - or a third party, such as an insolvency practitioner - to identify the customer to which the funds it holds relate.

Risk Management

The letter states that the FCA has identified a need for improvement in firms’ prudential risk management. It identifies issues such as a lack of appropriate liquidity risk management, failure to consider whether the firm should hold capital above its regulatory requirement in order to adequately mitigate the risks it faces, and a lack of scenario planning and stress-testing.

The letter says firms should regularly review their prudential risk management arrangements to ensure they:

• Meet their regulatory capital requirement at all times.
• Consider the particular financial risks they face, based on the business model they operate - and how those risks may be heightened by macroeconomic conditions.
• Set or review their risk appetite, including key risk indicators.
• Forecast their likely financial performance in a range of plausible scenarios.
• Consider holding additional capital above the minimum requirement under the Payment Services Regulations 2017 or Electronic Money Regulations 2011, where that would be prudent based on the firm’s assessment of the risks it faces.
• Plan well ahead to ensure they have adequate financial resources on an ongoing basis. 

The FCA director also warns that companies are failing to put in place adequate money laundering and sanctions systems and processes and are falling short on tackling fraud.

He highlights the following areas as “material issues’’:

• Failure to carry out and/or to evidence adequate know your customer checks / due diligence.
• Business-wide risk assessments that are not supported by a robust and effective methodology.
• Enhanced due diligence that is not adequately risk based and not commensurate to the risk event and/or the customer.
• Failure to regularly review and refresh risk assessments and control frameworks in an evolving threat landscape.
• Policies and procedures that are not sufficiently detailed or tailored to firms' business models.
• Failure to maintain and evolve the control framework, in line with or ahead of business growth.
• Failure to ensure name screening solutions from third party providers are appropriately and adequately calibrated to meet their business requirements.
• Firms’ inability to reasonably justify and/or verify why their sanction screening solution does not generate alerts against certain names on the UK’s Office of Financial Sanctions Implementation list.

The letter concludes by saying: "We will continue to intervene using our full range of supervisory tools. In cases where firms can’t meet the conditions for authorisation, we will take more assertive action sooner and will remove or sanction firms who cannot or will not meet our standards."

In addressing what it sees as possible shortcomings, the FCA has reiterated its commitment to protecting consumers from bad actors and, by doing so, protecting the integrity of the UK financial system - two of its core objectives as the UK’s financial watchdog.