1. (1)

   A firm must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems.8

2. (2)

   [deleted]

   1313

[Note: article 74 (1) of CRD, article 1621(5) second paragraph of MiFID,12 article 12(1)(a) of the UCITS Directive, and article 18(1) of AIFMD12]10

1. (3)

   Without prejudice to the ability of the FCA or any other relevant competent authority to require access to communications in accordance with MiFID and MiFIR, a common platform firm must have sound security mechanisms in place for the following, while maintaining the confidentiality of the data at all times:21

   1. (a)

      to guarantee the security and authentication of the means of transfer of information;21

   2. (b)

      to minimise the risk of data corruption and unauthorised access; and21

   3. (c)

      to prevent information leakage. 21

[Note: article 16(5) third paragraph of MiFID]21

14A full-scope UK AIFM must comply with the AIFM Remuneration Code.

14A full-scope UK AIFM must, in particular:

1. (1)

   have rules for personal transactions by its employees or for the holding or management of investments it invests on its own account;

2. (2)

   ensure that each transaction involving the AIFs may be reconstructed according to its origin, the parties to it, its nature, and the time and place at which it was effected; and

3. (3)

   ensure that the assets of the AIFs managed by the AIFM are invested in accordance with the instrument constituting the fund and the legal provisions in force.

15A BIPRU firm and a third country BIPRU firm must comply with the BIPRU Remuneration Code.

19A UK UCITS management company must comply with the UCITS Remuneration Code if it:

1. (1)

   manages a UCITS scheme; or

2. (2)

   manages an EEA UCITS scheme.

[Note: article 14a(1) of the UCITS Directive]

19A UK UCITS management company must have appropriate procedures for its employees to report potential or actual breaches of national provisions transposing the UCITS Directive internally through a specific, independent and autonomous channel.

For a common platform firm, the 3 arrangements, processes and mechanisms referred to in SYSC 4.1.1 R must be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and of13 the common platform firm's activities and must take into account the specific technical criteria described in article 21(3) of the MiFID Org Regulation21, SYSC 5.1.7 R, SYSC 7 and whichever of the following as applicable:

1. (1)

   (for a firm to which SYSC 19A applies) SYSC 19A (IFPRU Remuneration Code);

2. (2)

   (for a full-scope UK AIFM) SYSC 19B (AIFM Remuneration Code);

3. (3)

   (for a firm to which SYSC 19C applies) SYSC 19C (BIPRU Remuneration Code);

4. (4)

   (for a firm to which SYSC 19D applies) SYSC 19D (Dual-regulated firms Remuneration Code); or

5. (5)

   (for a firm to which the remuneration part of the PRA Rulebook applies) the remuneration part of the PRA Rulebook.17

[Note: article 74 (2) of CRD13]

Where SYSC 4.1.2 R applies to a BIPRU firm, it must take into account the specific technical criteria described in SYSC 19C.

10For a management company or a full-scope UK AIFM14, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R and SYSC 4.1.1A R14 must also take account of the UCITS schemes and EEA UCITS schemes managed by the management company or the AIFs managed by the full-scope UK AIFM14.

10A management company, a full-scope UK AIFM and an incoming EEA AIFMbranch14 must have, and employ effectively, the resources and procedures that are necessary for the proper performance of its business activities.

14A full-scope UK AIFM must use, at all times, adequate and appropriate human and technical resources that are necessary for the proper management of AIFs.

A firm (with the exception of a common platform firm and a 21sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements))3 must, taking into account the nature, scale and complexity of the business of the firm, and the nature and range of the financial services, claims management services and other23 activities undertaken in the course of that business:

1. (1)

   (if it is 21a management company)10 establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;

   3
2. (2)

   establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm;

   10
3. (3)

   21establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the firm; and10

   3
4. (4)

   10(if it is a management company) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the management company as well as effective information flows with any third party involved.

[Note: 21articles 4(1) final paragraph, 4(1)(a), 4(1)(c) and 4(1)(d) of the UCITS implementing Directive]10

A 21management company10 must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.

[Note: 21 article 4(2) of the UCITS implementing Directive]10

A common platform firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. To this end the common platform firm3 must employ appropriate and proportionate systems, resources and procedures.

[Note: article 1621(4) of MiFID]

A CRR firm21 and a management company10 must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited, the preservation of essential data and functions, and the maintenance of its regulated activities, or, in the case of a management company, its collective portfolio management activities,10 or, where that is not possible, the timely recovery of such data and functions and the timely resumption of those activities.10

[Note: 21 article 4(3) of the UCITS implementing Directive and article 85(2) of 21CRD11]10

16An operator of an electronic system in relation to lending must take reasonable steps to ensure that arrangements are in place to ensure that P2P agreements facilitated by it will continue to be managed and administered, in accordance with the contract terms, if at any time it ceases to carry on the activity of operating an electronic system in relation to lending.

16Any arrangements made under SYSC 4.1.8A R must be notified to lenders under P2P agreements:

1. (1)

   when such arrangements are made; or

2. (2)

   if later, when the lender first becomes a lender under a P2P agreement with that operator; or

3. (3)

   if the arrangements are changed, when that change is made; and

4. (4)

   if the arrangement involves another firm taking over the management and administration of P2P agreements if the operator ceases to operate the electronic system in relation to lending, the notification to lenders must inform lenders of the identity of the firm with which the arrangements have been made and how that firm will hold the lenders' money.

1. (1)

   An operator of an electronic system in relation to lending must not accept, take, or receive the transfer of full ownership of money relating to P2P agreements.18

2. (2)

   If an operator of an electronic system in relation to lending has made a client money election under CASS 7.10.7AR, when it is operating an electronic system in relation to non-P2P agreements it must also not accept, take, or receive the transfer of full ownership of money relating to non-P2P agreements.18

A 21management company10 must establish, implement and maintain accounting policies and procedures that enable it, at the request of the FCA20, to deliver in a timely manner to the FCA20 financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.

[Note: 21article 4(4) of the UCITS implementing Directive]10

A 21management company10 must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.4 R to SYSC 4.1.9 R and take appropriate measures to address any deficiencies.

[Note: 21article 4(5) of the UCITS implementing Directive]10

The senior personnel of a common platform firm, a management company3, a full-scope UK AIFM,5 or of the UK branch of a non-EEA bank1must be of sufficiently good repute and sufficiently experienced as to ensure the sound and prudent management of the firm.

[Note: article 9(1)(4) 9of MiFID, article 7(1)(b) of the UCITS Directive,9 article 8(1)(c) of AIFMD9 and article 91(1) 9of CRD4]

7For a full-scope UK AIFM, the senior personnel must, in complying with SYSC 4.2.1 R, be sufficiently experienced in relation to the investment strategies pursued by the AIFs it manages.

A common platform firm, a management company, a full-scope UK AIFM53 and the UK branch of a non-EEA bank1must ensure that its management is undertaken by at least two persons meeting the requirements laid down in SYSC 4.2.1 R and : 9

1. (a)

   for a full-scope UK AIFM, SYSC 4.2.7R; or9

2. (b)

   for a common platform firm, SYSC 4.3A.3R.9

[Note: article 9(6) 9first paragraph of MiFID, article 7(1)(b) of the UCITS Directive3, article 8(1)(c) of AIFMD5and article 13(1) of CRD]

If a common platform firm, (other than a credit institution or AIFM investment firm5) or the UK branch of a third country firm9, is:

1. (1)

   a natural person; or

2. (2)

   a legal person managed by a single natural person;

then:9

1. (3)

   it must have alternative arrangements in place which ensure: 9

   1. (a)

      sound and prudent management of the firm; and9

   2. (b)

      adequate consideration of the interests of clients and the integrity of the market; and9

2. (4)

   the natural persons concerned must be of sufficiently good repute, possess sufficient knowledge, skills and experience and commit sufficient time to perform their duties.9

it must have alternative arrangements in place which ensure sound and prudent management of the firm.

[Note: article 9(6) 9second paragraph of MiFID]

A full-scope UK AIFM must notify the FCA of the names of the senior personnel of the firm and of every person succeeding them in office.

Afirm (with the exception of a common platform firm and 5a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)),2 when allocating functions internally, must ensure that senior personnel and, where appropriate, the supervisory function, are responsible for ensuring that the firm complies with its obligations under the regulatory system1. In particular, senior personnel and, where appropriate, the supervisory function must assess and periodically review the effectiveness of the policies, arrangements and procedures put in place to comply with the firm's obligations under the regulatory system1 and take appropriate measures to address any deficiencies.

[Note: 5articles 9(1) and 9(3) of the UCITS implementing Directive]4

A 5management company,4 must ensure that:2

1. (1)

   its senior personnel receive on a frequent basis, and at least annually, written reports on the matters covered by SYSC 6.1.2 R to SYSC 6.1.5 R, SYSC 6.2.1 R, SYSC 7.1.2 R, SYSC 7.1.3 R and SYSC 7.1.5 R to SYSC 7.1.7 R, indicating in particular whether the appropriate remedial measures have been taken in the event of any deficiencies; and

   2
2. (2)

   the supervisory function, if any, receives 2on a regular basis written reports on the same matters.

   [Note: 5articles 9(4) and 9(6) of the UCITS implementing Directive]4

   2

2In SYSC 4.3A.6 R and SYSC 4.3A.8 R a common platform firm that is significant4 means a significant IFPRU firm.

1A common platform firm4 must ensure that the management body defines, oversees and is accountable for the implementation of governance arrangements that ensure effective and prudent management of the firm, including the segregation of duties in the organisation and the prevention of conflicts of interest, and in a manner that promotes the integrity of the market and the interests of clients4. The firm must ensure that the management body:

1. (1)

   has overall responsibility for the firm;

2. (2)

   approves and oversees implementation of the firm's strategic objectives, risk strategy and internal governance;

3. (3)

   ensures the integrity of the firm's accounting and financial reporting systems, including financial and operational controls and compliance with the regulatory system.

4. (4)

   oversees the process of disclosure and communications;

5. (5)

   has responsibility for providing effective oversight of senior management;4

6. (6)

   monitors and periodically assesses:4

   1. (a)

      the adequacy and the implementation of the firm’s strategic objectives in the provision of investment services and/or activities and ancillary services;4

   2. (b)

      the effectiveness of the firm's governance arrangements; and4

   3. (c)

      the adequacy of the policies relating to the provision of services to clients, and4

   takes appropriate steps to address any deficiencies; and 4

7. (7)

   has adequate access to information and documents which are needed to oversee and monitor management decision-making.4

[Note: article 88(1) of CRD and articles 9(1) and 9(3) of MiFID4]

4Without prejudice to SYSC 4.3A.1R, a common platform firm must ensure that the management body defines, approves and oversees:

1. (1)

   the organisation of the firm for the provision of investment services and/or activities and ancillary services, including the skills, knowledge and expertise required by personnel, the resources, the procedures and the arrangements for the provision of services and activities, taking into account the nature, scale and complexity of its business and all the requirements the firm has to comply with;

2. (2)

   a policy as to services, activities, products and operations offered or provided, in accordance with the risk tolerance of the firm and the characteristics and needs of the firm’s clients to whom they will be offered or provided, including carrying out appropriate stress testing, where appropriate; and

3. (3)

   a remuneration policy of persons involved in the provision of services to clients aiming to encourage responsible business conduct, fair treatment of clients as well as avoiding conflict of interest in the relationships with clients.

[Note: article 9(3) of MiFID]

A common platform firm4 must ensure that the chairman of the firm's management body does not exercise simultaneously the PRA’s Chief Executive function (controlled function SMF14) or 3chief executive function within the same firm4.

[Note: article 88(1)(e) of CRD and article 9(1) of MiFID4]

A common platform firm4 must ensure that the members of the management body of the firm:

1. (1)

   are of sufficiently good repute;

2. (2)

   possess sufficient knowledge, skills and experience to perform their duties;

3. (3)

   possess adequate collective knowledge, skills and experience to understand the firm's activities, including the main risks;

4. (4)

   reflect an adequately broad range of experiences;

5. (5)

   commit sufficient time to perform their functions in the firm; and

6. (6)

   act with honesty, integrity and independence of mind to effectively assess and challenge the decisions of senior management where necessary and to effectively oversee and monitor management decision-making.

[Note: article 91(1)-(2) and (7)-(8) of CRD and article 9(1) and 9(4) of MiFID4]

A common platform firm4 must devote adequate human and financial resources to the induction and training of members of the management body.

[Note: article 91(9) of CRD and article 9(1) of MiFID4]

A common platform firm4 must ensure that the members of the management body of the firm do not hold more directorships than is appropriate taking into account individual circumstances and the nature, scale and complexity of the firm's activities.

1. (1)

   A common platform firm4 that is significant must ensure that the members of the management body of the firm do not hold more than one of the following combinations of directorship in any organisation at the same time:

   1. (a)

      one executive directorship with two non-executive directorships; and

   2. (b)

      four non-executive directorships.

2. (2)

   Paragraph (1) does not apply to members of the management body that represent the United Kingdom.

[Note: article 91(3) of CRD and article 9(1) of MiFID4]

For the purposes of SYSC 4.3A.5 R and SYSC 4.3A.6 R:

1. (1)

   directorships in organisations which do not pursue predominantly commercial objectives shall not count; and

2. (2)

   the following shall count as a single directorship:

   1. (a)

      executive or non-executive directorships held within the same group; or

   2. (b)

      executive or non-executive directorships held within:

      1. (i)

         firms that are members of the same institutional protection scheme provided that the conditions set out in article 113(7) of the EU 5CRR are fulfilled; or

      2. (ii)

         undertakings (including non-financial entities) in which the firm holds a qualifying holding.

[Note: article 91(4) and (5) of CRD and article 9(1) of MiFID4]

A common platform firm4 that is significant must:

1. (1)

   establish a nomination committee composed of members of the management body who do not perform any executive function in the firm;

2. (2)

   ensure that the nomination committee is able to use any forms of resources the nomination committee deems appropriate, including external advice; and

3. (3)

   ensure that the nomination committee receives appropriate funding.

[Note: article 88(2) of CRD and article 9(1) of MiFID4]

A common platform firm4 that has a nomination committee must ensure that the nomination committee:

1. (1)

   engages 4a broad set of qualities and competences when recruiting members to the management body and for that purpose puts in place a policy promoting diversity on the management body;

2. (2)

   identifies and recommends for approval, by the management body or by general meeting, candidates to fill management body vacancies, having evaluated the balance of knowledge, skills, diversity and experience of the management body;

3. (3)

   prepares a description of the roles and capabilities for a particular appointment, and assesses the time commitment required;

4. (4)

   decides on a target for the representation of the underrepresented gender in the management body and prepares a policy on how to increase the number of the underrepresented gender in the management body in order to meet that target;

5. (5)

   periodically, and at least annually, assesses the structure, size, composition and performance of the management body and makes recommendations to the management body with regard to any changes;

6. (6)

   periodically, and at least annually, assesses the knowledge, skills and experience of individual members of the management body and of the management body collectively, and reports this to the management body;

7. (7)

   periodically reviews the policy of the management body for selection and appointment of senior management and makes recommendations to the management body; and

8. (8)

   in performing its duties, and to the extent possible, on an ongoing basis, takes account of the need to ensure that the management body's decision making is not dominated by any one individual or small group of individuals in a manner that is detrimental to the interest of the firm as a whole.4

[Note: article 88(2) and article 91(10) of CRD and article 9(1) of MiFID4]

A common platform firm4 that does not have a nomination committee must engage a broad set of qualities and competences when recruiting members to the management body. For that purpose a common platform firm4 that does not have a nomination committee must put in place a policy promoting diversity on the management body.

[Note: article 91(10) of CRD and article 9(1) of MiFID4]

A CRR firm that maintains a website must explain on the website how it complies with the requirements of SYSC 4.3A.1 R to SYSC 4.3A.3 R and SYSC 4.3A.4 R to SYSC 4.3A.11 R.

[Note: article 96 of CRD]

1. (2)

   activities carried on by a firm whose principal purpose is to carry on activities other than regulated activities and which is:

   1. (a)

      an oil market participant; or

   2. (b)

      a service company; or

   3. (c)

      an energy market participant; or

   4. (d)

      a wholly-owned subsidiary of:

      1. (i)

         a local authority; or

      2. (ii)

         a registered social landlord; or

   5. (e)

      a firm with permission to carry on insurance distribution activity11 in relation to non-investment insurance contracts but no other regulated activity (except advising on P2P agreements); 10

2. (3)
3. (4)

   an incoming Treaty firm, an incoming EEA firm or a UCITS qualifier (but only SYSC 4.4.5R (2) applies for these firms); and

4. (5)

   a sole trader, but only if he employs any person who is required to be approved under section 59 of the Act (Approval for particular arrangements).

12For the purposes of this section, a regulated claims management activity is treated as an unregulated activity.

A firm must take reasonable care to maintain a clear and appropriate apportionment of significant responsibilities among its directors and senior managers in such a way that:

1. (1)

   it is clear who has which of those responsibilities; and

2. (2)

   the business and affairs of the firm can be adequately monitored and controlled by the directors, relevant senior managers and governing body of the firm.