Factors we consider when deciding to open an investigation, including how we assess serious misconduct.
On this page 
The statutory test
Under the Financial Services and Markets Act 2000 (FSMA), we may open specific investigations if there are circumstances suggesting that a firm or individual may have breached one or more of our rules or principles, or may be guilty of certain offences.
If the circumstances don’t suggest any specific breach or contravention, but we have good reason to be concerned about a firm, we may open a general investigation into the business, ownership or control of that firm.
Investigation opening criteria
We consider the following criteria when deciding whether opening an enforcement investigation is the right regulatory response to the potential serious misconduct we see.
The factors are non-exhaustive and we consider the particular circumstances of the case before deciding whether to appoint enforcement investigators. This means that not all the criteria will be relevant to every case and additional considerations may apply in certain cases. Any one of the factors may be sufficient for us to open an enforcement investigation and sometimes, including in cases where breaches are self-reported, misconduct might be so serious that enforcement action is the only option.
During an investigation, we aim to find out whether serious misconduct has occurred and get a full understanding of the facts so we can decide whether to take further action and, if so, what kind of action may be necessary. The opening of an investigation doesn’t mean we believe misconduct has definitely occurred or that anyone involved in the investigation is necessarily guilty of misconduct.
We also keep under review whether enforcement action is likely to be the right regulatory tool for any breaches. The opening criteria are not only relevant at the outset of an investigation, but also at subsequent stages, e.g. if the investigation reveals different failings from those identified at the outset of the investigation.
Overall, is enforcement action likely to drive impactful deterrence?
When deciding whether to open an investigation, the key question we ask ourselves is whether any enforcement action we may take would drive impactful deterrence, taking into account our regulatory priorities, the seriousness of the misconduct, the harm (or potential harm) caused, other available regulatory responses and other investigations which the FCA has underway. We will also consider the reaction of the specific firm or individual to the potential breach including any steps taken by them to remedy the harm caused.
This does not mean that we will only take enforcement action when it aligns to our strategic priorities. There will always be particularly serious cases or those where an enforcement investigation is appropriate to understand what has occurred.
An enforcement investigation is not the only way to resolve harm. We will use the appropriate regulatory response (including authorisation, supervision, competition and enforcement) to deliver our strategy. Enforcement action and other regulatory tools can be used together and are not mutually exclusive.
Focusing on whether enforcement action will drive impactful deterrence means that certain cases will be subject to enforcement action and others not, even where they may be similar in nature or impact. The FCA's[1] choice as to the appropriate enforcement tool or regulatory response is therefore a question of how the FCA[1] uses its resources effectively and efficiently and how it ensures that it is an effective regulator.
We also work closely with other regulators and law enforcement to identify the right response and may make referrals to those other bodies or support them in taking action.
How we assess serious misconduct
We use our experience and judgment to identify serious misconduct quickly, to reduce the impact on consumers, markets and firms.
Not all harm is caused by serious misconduct. However, serious misconduct is likely to cause harm to market integrity, confidence in the financial system or cause harm to consumers.
Harm can affect the whole industry, or can have serious ramifications for a small part of the market or a small number of consumers.
Examples of serious misconduct that could cause harm are:
- misconduct resulting from a lack of integrity
- serious failings in a firm’s systems and controls including governance and senior manager failings
- mis-selling of unsuitable products to consumers
In determining whether serious misconduct may have occurred or may occur, we use our experience and judgement to assess a range of factors. These may include:
- the nature and severity of the actual and potential harm arising from the suspected misconduct. This could include the extent to which the suspected misconduct has affected, or may affect, consumers, markets or firms if we do not take action
- whether the suspected misconduct has potentially wider or broader implications, and in particular whether vulnerable customers appear to have been exploited. A vulnerable consumer is someone who, due to their personal circumstances, is especially susceptible to harm - particularly when a firm is not acting with appropriate levels of care
- the extent to which the suspected misconduct may have involved any lack of fitness or propriety
- the public interest in investigating the matter
Individuals
We are committed to ensuring that senior managers of firms[2] fulfil their responsibilities. We expect senior management to take responsibility for ensuring firms[3] identify risks, develop appropriate systems and controls to manage those risks, and ensure that the systems and controls are effective in practice. Where senior managers have failed to meet our standards, we will, where appropriate, bring cases against individuals as well as, or instead of firms[4]. We believe that impactful deterrence will most effectively be achieved by making these individuals realise the consequences of their actions. For the FCA’s policy on enforcement action against senior management and against other individuals under section 66[2] of the Act[3] please see DEPP 6.2.4G[4] to DEPP 6.2.9-BG[5]. The FCA's[2] policy on prohibition and withdrawal of approval is set out in EG 9[5].
Investigating and taking action against individuals is different from action against corporate entities. We are mindful that an individual will generally face greater risks from enforcement action in terms of financial implications, reputation and livelihood than would a corporate entity. As such, cases against individuals tend to be more strongly contested, and at many practical levels are harder to prove. They also take longer to resolve. However, taking action against individuals sends an important message about the FCA's[10] statutory objectives[4] and priorities and we consider that such cases have important deterrent impact. The FCA[12] is therefore committed to pursuing appropriate cases robustly, and will dedicate sufficient resources to them to achieve effective outcomes.
Addressing harm
Firms and individuals should do the right thing and be proactive to put right any harm or damage that may have been caused to consumers and not wait for us to open an investigation or if we do, to wait for its findings.
This doesn’t mean that if a firm or individual has taken remedial action we won’t take enforcement action where we consider that serious misconduct appears to have occurred and that taking enforcement action would drive impactful deterrence. When we decide on the appropriate sanction, we will acknowledge and give appropriate credit to wrongdoers who quickly address wrongdoing.
Co-Operation
Firms[5] may also bring their own rule breaches to the FCA's[14] attention, as they are obliged to do under Principle 11 of the Principles for Businesses[-4] and rules[-3] in the FCA's[16] Supervision manual.
Before opening an enforcement investigation we will consider the nature of a firm’s overall relationship with the FCA and whether, against that background, the use of enforcement will lead to impactful deterrence. For any similar set of facts, using enforcement tools will be less likely if a firm has built up over time a strong track record of taking its senior management responsibilities seriously and been open and communicative with the FCA[19]. In addition, a firm’s[15] conduct in response to the specific issue which has raised concerns will also be relevant. In this respect, relevant matters may include whether the person[-16] has self-reported, helped the FCA[20] establish the facts and/or taken remedial action such as addressing any systems and controls issues and compensating any consumers who have lost out. Such matters will not, however, necessarily mean that enforcement tools will not be used. The FCA[23] has to consider each case on its merits and in the wider regulatory context, and any such steps cannot automatically lead to no enforcement sanction. However, they may in any event be factors which will mitigate the penalty.
Where a firm[21] or individual has failed to comply with our requirements, it may be appropriate to deal with this without the need for formal or other enforcement action. The proactive supervision and monitoring of firms,[25] and an open and cooperative relationship between firms[26] and their supervisors, will, in some cases where a contravention has taken place, lead the FCA[24] to decide against taking formal enforcement action. However, in those cases, the FCA[28] will expect the firm[27] to act promptly in taking the necessary remedial action agreed with its supervisors to deal with the FCA's[29] concerns. If the firm[30] does not do this, the FCA[31] may take enforcement action in respect of the original contravention.
When we have opened an investigation firms and individuals should not wait for an investigation to end before acting in a way they think is right. When we assess the nature of the sanction we consider all relevant circumstances, including steps taken by the firm or individual to address harm and their cooperation with us.
Joint investigations with the PRA
A need for a joint investigation with the PRA[-127] may arise where either the FCA[37] or the PRA[38] identifies circumstances which suggest that a firm[32] or individual has committed misconduct that adversely affects both regulators’ statutory objectives[13]. In such cases, the regulators will determine whether they should carry out separate but coordinated investigations, or whether it would be more appropriate for one of the regulators to carry out an investigation, keeping the other informed.
In certain circumstances, it will be appropriate and expedient for the FCA[39] and PRA[40] to issue a joint information request where there is a joint investigation. Where a joint information request is issued to a firm[41] or individual[-177], the request will make it clear to which investigation(s) it relates.