FCA Publishes Expectations for Firms with Remote or Hybrid Working Arrangements

Key Points

• With remote or hybrid office/home working now becoming a permanent feature at some firms, the FCA has issued guidance on what firms need to think about going forward.
• In particular, the FCA is emphasising that remote and hybrid working should not risk or compromise a firm’s ability to follow all rules, regulatory standards and obligations, or lead to a failure to meet them.
• Further, the regulator is reminding firms that they are required to notify the FCA about material changes to how they intend to operate, which would likely include the firm’s working from home/hybrid working policies. The FCA will then evaluate remote and hybrid working arrangements on a case-by-case basis.
• The FCA reminds firms that, as part of its supervisory and enforcement powers, it may visit any location where work is performed, business is carried out or employees are based, and this may include residential addresses.

Introduction

Soon after the UK government issued working from home requirements in March 2020, the Financial Conduct Authority (FCA) issued guidance on what it expected firms to do in order to ensure that the transition was smooth. Of particular concern for the FCA was that firms needed to continue to ensure that personnel were appropriately monitored and that data collection and recording was not affected.

It is now apparent that, for some firms at least, remote or hybrid home/office working is likely to continue for the longer term. As firms put in place more permanent policies dealing with remote or hybrid working, the FCA has published a non-exhaustive document entitled, “Remote or hybrid working expectations for firms” (see here), giving guidance on what firms must consider when establishing the new procedures.

The new guidance applies to all authorised firms. There are also particular considerations set out for firms in the process of applying to be authorised, which are not discussed here.

Expectations

Firms should be able to prove that the lack of a centralised location or remote working does not, and is unlikely to, amongst other things: (i) affect the firm’s ability to meet the threshold conditions, (ii) prevent the FCA from receiving information about the firm, (iii) affect the firm’s ability to oversee its functions (including ensuring that compliance, risk and audit’s roles are not hindered) or (iv) increase the risk of financial crime.

Firms must prove that there is satisfactory planning in place, and that any planning which was done at the start of the pandemic has been reviewed before it is made permanent. The policies and procedures must be reviewed periodically to identify new risks. In particular, firms must make sure that (among other factors):

• There must be appropriate governance and oversight of the arrangements by senior managers under the Senior Managers Regime.
• Policies and procedures are in place to reduce the potential for financial crime which might be heightened by the working arrangements.
• Remote/hybrid working must not hinder the establishment and maintenance of a good culture at the firm.
• The firm must have assessed its systems and controls—including, for example, its IT function—to be sufficient to support remote or hybrid working, and that those systems are robust.
• The firm needs to have considered increased risks which arise from remote/hybrid working, including to data and cybersecurity, and additionally because personnel may be transporting confidential documents and materials on laptops more frequently between their homes and the office.
• Recordkeeping procedures must be in place which are appropriate to remote or hybrid working.
• The wellbeing of personnel and diversity and inclusion issues must also have been considered.
• The firm must have considered any operational or legal risks which might be associated with individuals working from abroad.
• The firm must ensure that specific requirements such as call recording and order and trade surveillance can be met.

In relation to this final point, the FCA has been especially clear since the start of the pandemic that working from home might permit or encourage poor market conduct by individuals, and there has been particular concern that individuals might use less traceable or harder-to-monitor messaging applications, including WhatsApp. We note that the United States Securities and Exchange Commission (SEC) has cited similar concerns for opening an inquiry into how banks are monitoring employees’ messages.¹

Notification and approvals

In accordance with Principle 11 of the FCA’s Principles for Businesses, firms are required to deal with the FCA in an open and co-operative way and to disclose anything relating to the firm which the FCA would reasonably expect notice of. This includes notifying the FCA about any material changes to how a firm intends to operate.

The FCA expects that it should be able to access firm sites, records and employees. Accordingly, firms should obtain necessary approvals from employees who will be working from home to permit the FCA to conduct supervisory visits. Firms should make sure that employees understand the FCA’s powers to visit any location where work is performed, and to obtain any necessary approvals from employees working from home to permit the FCA to conduct supervisory and enforcement visits, even to residential addresses.

Summary

In summary, firms which are currently considering whether to make remote or hybrid working a longer term mode of conducting business need to be considering whether they have sufficient planning and structures in place to ensure that the firm will be able to comply with its regulatory requirements, as well as considering the effects on the firm’s culture, and on the wellbeing, diversity and inclusion of its workforce.

Firms should be mindful that they may need to make notifications to the FCA to update the FCA on their policies and procedures.

The contribution of Phil Davies and Hallie Tucker is gratefully acknowledged.

¹ See Reuters article here: https://www.reuters.com/legal/litigation/exclusive-us-sec-opens-inquiry-into-wall-street-banks-staff-communications-2021-10-12/.