Market Watch 66

The pandemic has had a significant effect on how businesses are run, with changes to technology and increased homeworking, which may in some cases be long lasting. We expect firms to continue to comply with the recording obligations in our Senior Management Arrangements, Systems and Controls sourcebook (SYSC 10A), which remain the same.

Risks from misconduct may be heightened or increased by homeworking. This includes increased use of unmonitored and/or encrypted communication applications (apps) such as WhatsApp for sharing potentially sensitive information connected with work. Use of such apps can present challenges and significant compliance risks, since firms will be less able to effectively monitor communications using these channels.

Firms will need to ensure that, if such apps are used for in-scope activities on business devices, they are recorded and auditable. A broad range of activities are included, such as arranging of deals and dealing (as principal or agent) in investments, managing investments, as well as managing a UCITS, an AIF and/or establishing, operating or winding up a collective investment scheme.

We have acted against individuals and firms for misconduct which involved the use of WhatsApp and other social media platforms to arrange deals and provide investment advice. This included transmitting lists of trades to copy (‘trading signals’) and making other investment recommendations to clients. We view these actions as serious and have sought orders preventing such individuals from carrying out these activities in the future. We expect this to remain an area of focus.

It is important for firms to proactively review their recording policies and procedures every time the context and environment they operate in changes. We expect firms to have a rigorous monitoring regime, commensurate to the increased risks, where in-scope activities may be conducted outside the controlled office environment. As part of this, individual Senior Managers have an important part to play in establishing and embedding the right culture and governance within firms to continuously improve the standard of conduct at all levels.

Without effective recording and monitoring controls, there is a real risk of loss of monitoring and surveillance capability, and the absence of protection through loss of evidence to resolve disputes between a firm and its clients over transaction terms. It is also vital to help with supervisory work, help deter and detect market abuse and to facilitate enforcement. 

The recording obligations apply to conversations and communications made with, sent from, or received on, equipment provided or permitted to be used for business purposes.

A firm to which the recording regime in SYSC 10A applies, must take reasonable steps to record telephone conversations and keep a copy of electronic communications of activities falling within scope of the recording rules. Firms must ensure that their recording policies can identify calls and communications that directly relate to the performance of in-scope activities.

They should also identify communications intended to lead up to these activities being performed or where there is a reasonable prospect of such activities being performed. Depending on the circumstances, this may also include internal conversations concerning in-scope activities.

Robust policies

As a reminder, firms must have effective, up to date recording policies and they must be able to demonstrate to us, on request, that their policies, procedures and management oversight meet the recording rules. This includes policies and procedures adopted for home working arrangements.

These policies should identify which telephone conversations and electronic communications are subject to recording requirements. They must also contain procedures to follow where breaches or gaps have been identified.

Where new or amended recording policies are needed, these should be clearly set out in writing, documented and signed off under appropriate governance arrangements. Any necessary additional measures should be implemented before the firm accepts or permits a new medium of communication.

Firms should assess policies and controls for the use of privately owned devices to connect to their organisational networks and access work-related systems and potentially sensitive or confidential data, to ensure that these provide sufficient scope for effective recording. This might include ensuring clear policies banning the use of privately owned devices for in-scope activities where recording cannot be carried out by the firm. In all cases, arrangements should be clear that new communication mediums must be approved by the firms before being used by employees to conduct business activities. 

Training

If new or amended policies are introduced, or new technologies used, we expect firms to provide enhanced or refreshed training to staff covering the use of new technologies and conduct risks arising.