Telling the Regulator: What Senior Managers Need to Know About Breach Reporting
Every regulated firm will, at some point, discover something the regulator would want to know about: a breach, a control failure, a significant incident or a problem affecting customers. How the firm handles that moment matters enormously. Prompt, open notification can limit the damage. Delay or concealment can turn a manageable problem into a serious one, and put the Senior Managers involved personally at risk.
This article explains the duty to tell the regulator, what Senior Managers are personally required to disclose, and how firms can make good decisions about notification.
The Firm’s Duty to Be Open
Principle 11 of the FCA’s Principles for Businesses requires firms to deal with their regulators in an open and cooperative way, and to disclose appropriately anything relating to the firm of which the FCA would reasonably expect notice. The PRA has an equivalent requirement for the firms it regulates.
The FCA’s notification rules, set out in SUP 15, add specific requirements. Firms must notify the FCA of matters having a serious regulatory impact, significant breaches of rules, and certain other events, including civil or criminal proceedings, fraud and significant operational failures. The detail matters, but the underlying expectation is simple: if the regulator would reasonably expect to be told, tell it.
The Senior Manager’s Personal Duty
The Senior Managers regime makes openness personal. Under the Conduct Rules, all individuals covered by the rules must be open and cooperative with the FCA, the PRA and other regulators. Senior Managers are also subject to a specific Senior Manager Conduct Rule requiring them to disclose appropriately any information of which the FCA or PRA would reasonably expect notice.
In practice, this means a Senior Manager who becomes aware of a significant problem in their area can’t simply leave it to others to decide whether to tell the regulator. They need to make sure the information reaches the right people in the firm, that a decision about notification is made promptly, and that the regulator is told if it should be. SMF Capital’s guide to the Conduct Rules explains who they apply to and what they require.
What Typically Needs Reporting
- significant breaches of regulatory rules or requirements
- serious control failures, including in financial crime systems
- matters that could cause significant harm to customers, including where redress may be needed
- significant operational incidents, including technology failures and cyber attacks
- fraud, errors or other irregularities of significance
- matters affecting the firm’s financial position or ability to meet its obligations
- changes in Senior Managers and other matters covered by specific notification forms.
Personnel changes have their own forms and deadlines. SMF Capital’s guide to the SMCR notification forms B to E explains them.
Timing
The regulators expect to be told promptly. Firms sometimes delay notification until they fully understand a problem, have quantified it and have a remediation plan. That’s usually a mistake. The better approach is often to notify early with what is known, explain what the firm is doing to investigate, and follow up as the picture becomes clearer. Supervisors generally prefer an early, incomplete notification to a complete one that arrives weeks or months later.
Making Good Notification Decisions
A Clear Process
Firms should have a clear process for identifying, escalating and assessing potential notifications, usually led by compliance, with defined thresholds and decision-makers.
Senior Involvement
Significant matters should be escalated to the relevant Senior Managers and, where appropriate, the chief executive and the board. Senior Managers should make sure they’re told when something in their area might need reporting.
Err on the Side of Disclosure
Where it’s unclear whether a matter meets the threshold, the safer course is usually to discuss it with the supervisor. Firms that notify matters that turn out to be minor rarely suffer for it. Firms that fail to notify matters that turn out to be serious often do.
Record the Decision
Whatever the decision, record it with the reasons. If the firm decides not to notify, a clear record of why protects the firm and the Senior Managers involved if the question is revisited later.
Consistency
Firms should make sure information given to the regulator is accurate and consistent. Contradictory or incomplete information causes problems of its own.
Common Failings
- Waiting for certainty. Delaying notification until every fact is known.
- Minimising. Describing a significant issue as minor, which damages trust when the full picture emerges.
- Siloed knowledge. Information known in one part of the firm that never reaches the people who make notification decisions.
- Commercial pressure. Delaying notification because of a transaction, fundraising or reporting date.
- No record. Decisions not to notify made informally and not documented.
Self-Reporting and Enforcement
When the FCA decides whether to take enforcement action, and what penalty to impose, it considers how the firm behaved once it became aware of the problem. Prompt self-reporting, full cooperation with any investigation and proactive redress for affected customers are all relevant. A firm that identified a problem, told the regulator quickly and put things right is in a very different position from one whose problem was discovered by the regulator or reported by a whistleblower.
The same applies to individuals. A Senior Manager who escalated a problem promptly and pressed for it to be disclosed has clear evidence that they met their obligations. One who knew about a problem and stayed silent has a much harder case to make.
Working With the Supervisor
Many firms have a named supervisor or a supervisory team. Building an open, regular relationship with them makes notifications easier. Supervisors who hear from a firm regularly, including about smaller matters, are more likely to trust its judgement when something significant arises. Senior Managers in key roles should know who the firm’s supervisors are and how the firm engages with them.
Notification and Culture
How a firm handles notification reflects its culture. In firms where bad news travels quickly to senior management and the board, notification decisions are made promptly and well. In firms where people fear the consequences of raising problems, issues are hidden until they become crises. Senior Managers set the tone by how they react when someone brings them a problem.
Finance and Regulatory Reporting
Many notifiable issues surface first in finance: errors in regulatory returns, capital or liquidity concerns, client money reconciliation breaks or unexpected losses. Finance leaders need to understand when these issues cross the line into notifiable matters and make sure they’re escalated promptly. FD Capital, a sister practice of SMF Capital, places finance directors and CFOs in regulated firms who understand how financial issues interact with regulatory obligations.
A Checklist for Senior Managers
- Do I know what in my area might need to be reported to the regulator?
- Will I be told promptly when something significant happens?
- Is there a clear process for deciding whether to notify, and am I involved?
- When in doubt, do we discuss matters with our supervisor?
- Are notification decisions, including decisions not to notify, recorded with reasons?
The Bottom Line
Telling the regulator promptly and openly is one of the most important obligations a regulated firm has, and one that the Senior Managers regime makes personal. Firms with clear processes, a culture where bad news travels fast and Senior Managers who treat disclosure as part of their job are better placed when problems arise. For more on the accountability that comes with senior roles, see SMF Capital’s Senior Manager Functions guide and its analysis of FCA enforcement trends. This article is general information and doesn’t replace the detailed notification rules or legal advice.
Related Guides
Guides to Senior Manager obligations from SMF Capital. Every SMF search is led personally by Adrian Lawrence FCA
Control Functions
Who leads notification decisions.
→ SMF16 and SMF17
→ SMF4 Chief Risk
Structure
Making sure bad news travels.
→ Governance structure review
→ The Responsibilities Map
Every SMF search is led personally by Adrian Lawrence FCA
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads SMF Capital’s Senior Manager searches, including compliance and finance appointments where regulatory reporting is central to the role. View Adrian’s ICAEW profile.
Strengthening Your Compliance Leadership?
SMF Capital recruits compliance officers, MLROs and finance leaders who handle regulatory engagement with confidence. Get in touch for a confidential conversation.