SYSC 4.1 General requirements

1. (1)

   A firm must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems.8

2. (2)

   [deleted]

   1313

[Note: article 74 (1) of CRD, article 1621(5) second paragraph of MiFID,12 article 12(1)(a) of the UCITS Directive, and article 18(1) of AIFMD12]10

1. (3)

   Without prejudice to the ability of the FCA or any other relevant competent authority to require access to communications in accordance with MiFID and MiFIR, a common platform firm must have sound security mechanisms in place for the following, while maintaining the confidentiality of the data at all times:21

   1. (a)

      to guarantee the security and authentication of the means of transfer of information;21

   2. (b)

      to minimise the risk of data corruption and unauthorised access; and21

   3. (c)

      to prevent information leakage. 21

[Note: article 16(5) third paragraph of MiFID]21

14A full-scope UK AIFM must comply with the AIFM Remuneration Code.

14A full-scope UK AIFM must, in particular:

1. (1)

   have rules for personal transactions by its employees or for the holding or management of investments it invests on its own account;

2. (2)

   ensure that each transaction involving the AIFs may be reconstructed according to its origin, the parties to it, its nature, and the time and place at which it was effected; and

3. (3)

   ensure that the assets of the AIFs managed by the AIFM are invested in accordance with the instrument constituting the fund and the legal provisions in force.

15A BIPRU firm and a third country BIPRU firm must comply with the BIPRU Remuneration Code.

19A UK UCITS management company must comply with the UCITS Remuneration Code if it:

1. (1)

   manages a UCITS scheme; or

2. (2)

   manages an EEA UCITS scheme.

[Note: article 14a(1) of the UCITS Directive]

19A UK UCITS management company must have appropriate procedures for its employees to report potential or actual breaches of national provisions transposing the UCITS Directive internally through a specific, independent and autonomous channel.

For a common platform firm, the 3 arrangements, processes and mechanisms referred to in SYSC 4.1.1 R must be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and of13 the common platform firm's activities and must take into account the specific technical criteria described in article 21(3) of the MiFID Org Regulation21, SYSC 5.1.7 R, SYSC 7 and whichever of the following as applicable:

1. (1)

   (for a firm to which SYSC 19A applies) SYSC 19A (IFPRU Remuneration Code);

2. (2)

   (for a full-scope UK AIFM) SYSC 19B (AIFM Remuneration Code);

3. (3)

   (for a firm to which SYSC 19C applies) SYSC 19C (BIPRU Remuneration Code);

4. (4)

   (for a firm to which SYSC 19D applies) SYSC 19D (Dual-regulated firms Remuneration Code); or

5. (5)

   (for a firm to which the remuneration part of the PRA Rulebook applies) the remuneration part of the PRA Rulebook.17

[Note: article 74 (2) of CRD13]

Where SYSC 4.1.2 R applies to a BIPRU firm, it must take into account the specific technical criteria described in SYSC 19C.

10For a management company or a full-scope UK AIFM14, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R and SYSC 4.1.1A R14 must also take account of the UCITS schemes and EEA UCITS schemes managed by the management company or the AIFs managed by the full-scope UK AIFM14.

10A management company, a full-scope UK AIFM and an incoming EEA AIFMbranch14 must have, and employ effectively, the resources and procedures that are necessary for the proper performance of its business activities.

14A full-scope UK AIFM must use, at all times, adequate and appropriate human and technical resources that are necessary for the proper management of AIFs.

A firm (with the exception of a common platform firm and a 21sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements))3 must, taking into account the nature, scale and complexity of the business of the firm, and the nature and range of the financial services, claims management services and other23 activities undertaken in the course of that business:

1. (1)

   (if it is 21a management company)10 establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;

   3
2. (2)

   establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm;

   10
3. (3)

   21establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the firm; and10

   3
4. (4)

   10(if it is a management company) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the management company as well as effective information flows with any third party involved.

[Note: 21articles 4(1) final paragraph, 4(1)(a), 4(1)(c) and 4(1)(d) of the UCITS implementing Directive]10

A 21management company10 must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.

[Note: 21 article 4(2) of the UCITS implementing Directive]10

A common platform firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. To this end the common platform firm3 must employ appropriate and proportionate systems, resources and procedures.

[Note: article 1621(4) of MiFID]

A CRR firm21 and a management company10 must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited, the preservation of essential data and functions, and the maintenance of its regulated activities, or, in the case of a management company, its collective portfolio management activities,10 or, where that is not possible, the timely recovery of such data and functions and the timely resumption of those activities.10

[Note: 21 article 4(3) of the UCITS implementing Directive and article 85(2) of 21CRD11]10

16An operator of an electronic system in relation to lending must take reasonable steps to ensure that arrangements are in place to ensure that P2P agreements facilitated by it will continue to be managed and administered, in accordance with the contract terms, if at any time it ceases to carry on the activity of operating an electronic system in relation to lending.

16Any arrangements made under SYSC 4.1.8A R must be notified to lenders under P2P agreements:

1. (1)

   when such arrangements are made; or

2. (2)

   if later, when the lender first becomes a lender under a P2P agreement with that operator; or

3. (3)

   if the arrangements are changed, when that change is made; and

4. (4)

   if the arrangement involves another firm taking over the management and administration of P2P agreements if the operator ceases to operate the electronic system in relation to lending, the notification to lenders must inform lenders of the identity of the firm with which the arrangements have been made and how that firm will hold the lenders' money.

1. (1)

   An operator of an electronic system in relation to lending must not accept, take, or receive the transfer of full ownership of money relating to P2P agreements.18

2. (2)

   If an operator of an electronic system in relation to lending has made a client money election under CASS 7.10.7AR, when it is operating an electronic system in relation to non-P2P agreements it must also not accept, take, or receive the transfer of full ownership of money relating to non-P2P agreements.18

A 21management company10 must establish, implement and maintain accounting policies and procedures that enable it, at the request of the FCA20, to deliver in a timely manner to the FCA20 financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.

[Note: 21article 4(4) of the UCITS implementing Directive]10

A 21management company10 must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.4 R to SYSC 4.1.9 R and take appropriate measures to address any deficiencies.

[Note: 21article 4(5) of the UCITS implementing Directive]10