Remote and hybrid working in the financial services sector: FCA expectations

New guidance published by the Financial Conduct Authority 

The Financial Conduct Authority has published new guidance setting out its expectations on remote or hybrid working for financial services firms. This is an important read for all regulated firms and those applying to be regulated, particularly in view of the FCA’s position that supervisory and enforcement visits could take place wherever employees are based, including residential addresses of staff. Firms should consider their policies and processes in view of this statement by the FCA. 

The FCA recognises that due to Covid-19 firms are already familiar with remote working and adapting their systems and controls. The guidance is intended to help firms who wish to continue with such arrangements to plan for it and continue to meet their regulatory responsibilities.

Which firms are covered?

The FCA’s expectations apply to existing firms, firms applying to be regulated and firms proposing to submit further applications, such as a waiver, variation of permission and change of control.

International firms should continue to have an establishment or physical presence in the UK. 

What should existing firms be considering?

The FCA will evaluate firms that are considering remote or hybrid working on a case-by-case basis. Firms should consider how they operate their business, how they engage with the FCA and whether they need to notify the FCA of a change to their working arrangements.

Business operations

A firm should be able to prove that remote working arrangements or the lack of a centralised location does not or is unlikely to:

• Affect the firm’s location in the UK, or its ability to meet and continue to meet the threshold conditions for the regulated activities it has or will have permission for (or any equivalent requirements, where these do not apply)
• Prevent the FCA receiving information about the firm
• Reduce the accuracy of the Financial Services Register for others if, for example, consumers are not able to contact the firm at the principal place of business shown on the Register
• Affect the firm’s ability to oversee its functions, including any outsourced functions
• Harm consumers
• Damage the integrity of the market
• Increase the risk of financial crime
• Reduce competition

A firm must also prove satisfactory planning behind its remote working or decentralised arrangements. Relevant factors include:

• A plan, which has been reviewed before making any temporary arrangements permanent and which is reviewed periodically to identify new risks
• Appropriate governance and oversight by senior managers under the Senior Managers regime, and committees such as the Board, and by non-executive directors where applicable, and that this  governance is capable of being maintained
• That the firm can cascade policies and procedures to reduce any potential for financial crime arising from its working arrangements
• An appropriate culture can be put in place and maintained in a remote working environment
• Control functions such as risk, compliance and internal audit can carry out their functions unaffected, such as when listening to client calls or reviewing files
• The nature, scale and complexity of its activities, or legislation, does not require the presence of an office location
• It has robust systems and controls, including the necessary IT functionality, to support the above factors being in place
• It has considered any data, cyber and security risks, particularly as staff may transport confidential material and laptops more frequently in a hybrid arrangement
• It has appropriate record keeping procedures in place
• It can meet and continue to meet any specific regulatory requirements, such as call recordings, order and trade surveillance, and consumers being able to access services
• It has considered the effect on staff, including wellbeing, training and diversity and inclusion matters
• Where any staff will be working from abroad, it has considered the operational and legal risks

This an indicative and non-exhaustive list. It is important any form of remote or hybrid working adopted should not risk or compromise the firm's ability to follow all rules, regulatory standards and obligations, or lead to a failure to meet them.

Engaging with the FCA

Firms should consider if their details on the Financial Services Register need updating. For example, if a firm intends to use a private residential address as its principal place of business, it should consider the effect on any individuals and get necessary approvals. This includes those living at the property who are not employees.

The FCA should be able to access firms’ sites, records and employees. Firms must ensure employees understand that the FCA has powers to visit any location where work is performed, business is carried out and employees are based (including residential addresses) for any regulatory purposes. This includes both supervisory and enforcement visits.

Notifying the FCA of changes to working arrangements

Any material changes to how a firm intends to operate may require prior notification to the FCA. Under Principle 11 of the FCA’s Principles for Businesses, firms are required to deal with the FCA in an open and cooperative way and to disclose anything relating to the firm which the FCA would reasonably expect notice of.

SUP 15.3 sets out additional rules and guidance about when the FCA would expect notice of matters relating to a firm. Firms should continue to monitor any changes and speak to their usual supervisory contact with any questions.

What about firms applying to be authorised or registered?

The FCA also sets out its expectations for firms applying to be regulated, including details of the specific information the application should include about hybrid or remote working arrangements.  

The FCA’s expectations will evolve as more is understood about how firms intend to operate and so firms will need to keep on top of any changes in the FCA’s expectations.