Update

COVID-19: Key regulatory considerations for financial services businesses

In this update, we look at some of the regulatory considerations for licensed financial services businesses (LFSBs) in the Channel Islands when responding to the COVID-19 outbreak. For further information please contact our financial services regulatory team

LFSBs are managing their response to the COVID-19 pandemic on a daily basis. Whilst prioritising the wellbeing of their people, communicating with customers and minimising the impact on financial success, they must also ensure compliance with their regulatory obligations. As well as responding to COVID-19, LFSBs should maintain a log of lessons learned along the way, to be reviewed in future and used to identify, prioritise and invest in improvements necessary for the business to respond to future disruptions.

Quick Read

In this practical update, we highlight some of the key regulatory obligations that LFSBs should be prioritising as part of their response to COVID-19, including resolving certain issues related to having a large number of employees working from home. LFSBs must continue to meet their legal and regulatory obligations. This will include ensuring that:

• a log of lessons learned is maintained to improve future disruption responses;

• relevant people are aware of their responsibilities and accountable for their part in ensuring that the business continues to operate properly;

• risk assessments are reviewed and updated to respond to higher risks of data breach, IT system failures, possible breakdown in oversight and supervision lines etc;

• policies and procedures are amended to ensure the business will continue to meet legal and regulatory obligations when people are working from home or not available;

• outsourced service providers have confirmed that service levels will continue to be met;

• managers can adequately supervise employees;

• essential compliance monitoring procedures can be followed;

• financial resource requirements continue to be met;

• notification obligations are followed; and

• if necessary, foreign licencing and tax consequences are addressed.

Operational Risk

Demonstrate that you have adequate risk management systems.

• Review existing risk assessments to determine whether or not all current operational risks are adequately recorded and ensure that appropriate steps are being taken to mitigate new or increased risks. Some risks are highlighted in this update but they will be different according to the particular services and operating procedures of each business.

• Consider whether or not your risk management measures have regard to the interests of customers, including ensuring that you can continue to deliver critical services. Identify the chain of activities involved in delivering services to customers, determine which pieces of the chain are critical for service delivery and, focussing on those critical activities, identify and respond to any risk that the business would not be able to carry out those activities with a reduced workforce or with employees working from home.

• Consider whether or not any critical activities have been outsourced. If they have, obtain assurances that the service provider will continue to meet the agreed service levels. If there are any concerns, consider what action to take to protect the interests of its customers and continue meeting legal and regulatory obligations.

• LFSB Boards may want to record their review of additional information on how their business is responding to COVID-19, to assess the adequacy of risk mitigation actions. For example, in the context of a significant increase in home working, what information does the board have on any increased risk of a data breach, an IT system failure and any necessary changes of oversight and supervision procedures.

Governance

Apportion individual responsibilities and ensure that accountabilities are clear.

• Is your governance structure still appropriate with clear individual responsibilities and accountabilities, given any changes to risks and working practices.

• Senior management who are responsible for risk and operations, in particular, should satisfy themselves that the business' response to COVID-19 continues to be adequate. Can you, for example evidence that adequate disaster recovery and other contingency arrangements are in place, tested and implemented, as appropriate.

Policies and Procedures

Operate robust arrangements for meeting legal and regulatory obligations with carefully designed policies and procedures for this purpose. In contemplation of significant numbers of employees working from home or being unavailable for unexpected and unknown periods of time:

• Consider whether or not any policies and procedures need to be updated to facilitate working from home.

• Only implement updates if they will enable the business to continue meeting legal and regulatory obligations. For example, before changing any service delivery timeframes, check that the change will meet any contractual or regulatory obligations in relation to executing customer instructions within a particular time.

• Identify any existing policies and procedures that might be especially vulnerable to employees using work-arounds that don't quite follow policies and procedures, in a changed working environment. Failures to comply with existing policies and procedures, even to accommodate difficult circumstances, could have serious consequences. It is essential to identify these risks and implement changes to policies and procedures that will ensure ongoing compliance. For example, if existing anti-money laundering procedures require employees to collect and review original customer identification documents, but employees will not be in the office to undertake that review, the procedure should be updated to enable customer identification by other permitted means.

Supervision and Monitoring

Ensure there is adequate supervision of employees and an effective compliance monitoring programme in place.

• Reconsider how supervision works in practice where employees are working from home. It will be essential to be able to demonstrate that managers have fulfilled their supervisory responsibilities, even when teams are not physically located together.

• Continue to monitor compliance, even with employees working from home and, if necessary, record amendments to compliance monitoring processes. For example, if you record telephone lines to monitor compliance, ensure that technology is in place for this to continue, consider your policy on the use of work mobiles for all work calls and determine what checks might be necessary to ensure that the policy is enforced.

Financial Resources

Maintain adequate financial resources, which involves meeting the particular prudential requirements applicable to the financial services licences that you hold.

• Given uncertainty in the financial markets and the possibility that some debtors may not pay as quickly as expected, consider whether or not any enhanced monitoring or other protective measures are necessary in relation to financial resources.

Notification Obligations

Be open and co-operative with regulators, including notifying the Jersey Financial Services Commission and Guernsey Financial Services Commission, as appropriate, in certain circumstances. As the situation develops in the Channel Islands, care should be taken to ensure that the regulator is notified of any issues or circumstances which may concern it.

Although this is not an exhaustive list, we are encouraging you to consider whether or not any of the following notifications need to be made to the JFSC/GFSC as you continue to respond to COVID-19:

• any matter that might reasonably be expected to affect your registration/licence or be in the interests of your customers/investors to disclose;

• any decision relating to business activities that is likely to have a material effect on your business or its profitability;

• if your compliance officer, MLRO or MLCO will be temporarily unavailable to fulfil their responsibilities or if you will not be meeting 'four eyes' or 'six eyes' requirements, as appropriate, as a result of substantial absence amongst senior personnel.

The Jersey Financial Services Commission published its first COVID-19 Industry Update on 13 March 2020 and the Guernsey Financial Services Commission published theirs on 16 March 2020. You should respond appropriately to updates from the Jersey and Guernsey regulators.

Foreign Licencing and Tax

Ordinarily, working from foreign countries whilst on holiday is not regarded as establishing a business elsewhere. Operating a business in foreign jurisdictions, however, should cause pause for thought.

• Consider the implications of providing your services from foreign jurisdictions if employees are working from foreign countries. For example, depending on circumstances, tax consequences and licencing obligations might arise as well as a possible need to notify the JFSC and GFSC.

If you have any questions or concerns about how your business will continue to meet its legal and regulatory obligations in the fast changing, unusual circumstances that the financial services sector finds itself in, our specialist FS Regulatory team is here to help and can advise you on how to respond.