A firm's systems and controls should enable it to satisfy itself of the suitability of anyone who acts for it. This includes assessing an individual's honesty and competence. This assessment should normally be made at the point of recruitment. An individual's honesty need not normally be revisited unless something happens to make a fresh look appropriate.

Any assessment of an individual's suitability should take into account the level of responsibility that the individual will assume within the firm. The nature of this assessment will generally differ depending upon whether it takes place at the start of the individual's recruitment, at the end of the probationary period (if there is one) or subsequently.

The Training and Competence sourcebook (TC) contains additional rules and guidance relating to specified retail activities undertaken by a firm.2

2 Firms which are carrying on activities that are not subject to TC may nevertheless wish to take TC into account in complying with the competence requirements in SYSC.

The requirements on firms with respect to approved persons are in Part V of the Act (Performance of regulated activities) and SUP 10A, SUP 10C and in the corresponding parts of the PRA’s Rulebook9.

2If a firm requires employees who are not subject to a qualification7 requirement in TC to pass a relevant examination from the list of recommended examinations maintained by the Financial Skills Partnership7, the appropriate regulator will take that into account when assessing whether the firm has ensured that the employee satisfies the knowledge component of the competent employees rule.

3Other firms should take account of the segregation of functions rules (SYSC 5.1.6 R and SYSC 5.1.7 R) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G4.

The effective segregation of duties is an important element in the internal controls of a firm in the prudential context. In particular, it helps to ensure that no one individual is completely free to commit a firm's assets or incur liabilities on its behalf. Segregation can also help to ensure that a firm'sgoverning body receives objective and accurate information on financial performance, the risks faced by the firm and the adequacy of its systems.

A firm should normally ensure that no single individual has unrestricted authority to do all of the following:

1. (1)

   initiate a transaction;

2. (2)

   bind the firm;

3. (3)

   make payments; and

4. (4)

   account for it.

Where a firm is unable to ensure the complete segregation of duties (for example, because it has a limited number of staff), it should ensure that there are adequate compensating controls in place (for example, frequent review of an area by relevant senior managers).

Where a common platform firm outsources its internal audit function, it should take reasonable steps to ensure that every individual involved in the performance of this service is independent from the individuals who perform its external audit. This should not prevent services from being undertaken by a firm's external auditors provided that:

1. (1)

   the work is carried out under the supervision and management of the firm's own internal staff; and

2. (2)

   potential conflicts of interest between the provision of external audit services and the provision of internal audit are properly managed.

3Other firms should take account of the rule concerning awareness of procedures (SYSC 5.1.12 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G4.

3Other firms should take account of the rule requiring monitoring and evaluation of the adequacy and effectiveness of systems (SYSC 5.1.14 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G4.

This section is also relevant to employees of relevant authorised persons performing functions specified as FCA-specified significant-harm functions.

1. (1)

   This section is about the FCA's certification regime.

2. (2)

   Under this regime, a firm should ensure that its employees only perform an FCA-specified significant-harm function if they have a certificate issued by that firm to perform that function.

3. (3)

   The purpose of this section is to specify ‘FCA-specified significant-harm functions’ and to give guidance on the FCA's certification regime.

Under section 63E(1) of the Act, a firm must take reasonable care to ensure that no employee of the firm performs an FCA-specified significant-harm function under an arrangement entered into by the firm in relation to the carrying on by that firm of a regulated activity, unless the employee has a valid certificate issued by that firm to perform the function to which certificate relates.

1. (1)

   The requirement in SYSC 5.2.4G comes into force on 7 March 2017.

2. (2)

   SYSC TP 5 explains how the certification regime applies before then.

Under section 63F of the Act, a firm may issue a certificate to a person only if the firm is satisfied that the person is a fit and proper person to perform the FCA-specified significant-harm function to which the certificate relates.

Under section 63F of the Act, in assessing if a person is fit and proper to perform an FCA-specified significant-harm function, a firm must have regard, in particular, to whether that person:

1. (1)

   has obtained a qualification;

2. (2)

   has undergone, or is undergoing, training;

3. (3)

   possesses a level of competence; or

4. (4)

   has the personal characteristics,

5. required by general rules made by the FCA.

FIT 1.3 provides guidance to firms about the criteria that the FCA would expect the firm to consider in assessing if a person is fit and proper to perform an FCA-specified significant-harm function.

[Not used]6

1. (1)

   A person seconded from a contractor may fall into the certification regime. The material in SYSC 5.2.21G is relevant to when this is the case.

2. (2)

   In deciding if a person seconded from a contractor is fit and proper, the firm may take into account information and references from the contractor.

3. (3)

   In deciding how much reliance to put on the contractor, the firm should take into account:

   1. (a)

      the familiarity of the contractor with the obligations of firms under SYSC 5.2, the corresponding PRA requirements and the requirements of the Act described in this section;

   2. (b)

      whether any reference directly addresses the criteria in FIT; and

   3. (c)

      the degree to which the firm believes it can rely on the contractor’s judgement about the secondee’s fitness and properness and the grounds for that belief.

Under section 63F of the Act, a certificate issued by a firm to a person must:

1. (1)

   state that the firm is satisfied that the person is fit and proper to perform the function to which the certificate relates; and

2. (2)

   set out the aspects of the affairs of the firm in which the person will be involved in performing the function.

1. (1)

   The Act says that a certificate is valid for a period of 12 months, beginning with the day on which it is issued. 3

2. (2)

   The FCA believes that the Act allows a firm to draft a certificate to expire after fewer than 12 months. The FCA interprets the Act in this way because to require a firm to make a certificate last longer than the firm thinks best is likely to make it harder for the firm to ensure the fitness of its certification employees. That would undermine the purpose of the certification regime in the Act.3

3. (3)

   A certificate cannot be drafted to last more than 12 months.3

Under section 63F of the Act, if, after having considered if a person is fit and proper to perform an FCA-specified significant-harm function, a firm decides not to issue a certificate to that person, the firm must give the person a notice in writing stating:

1. (1)

   what steps (if any) the firm proposes to take in relation to the person as a result of the decision; and

2. (2)

   the reasons for proposing to take those steps.

If, after having considered whether a person is fit and proper to perform an FCA-specified significant-harm function, a firm decides not to issue a certificate to that person, it should consider if the circumstances warrant making a notification to the FCA for a breach of the rules in COCON pursuant to SUP 15.3.11R (Breaches of rules and other requirements in or under the Act or the CCA)4.

Under section 63F of the Act, a firm must maintain a record of every employee who has a valid certificate issued by it.

1. (1)

   The FCA's approach to specifying FCA-specified significant-harm functions has the effect that several elements of a person's job may involve an FCA-specified significant-harm function or that a person may perform several FCA-specified significant-harm functions as part of the same job.

2. (2)

   However, this does not mean that the FCA expects a firm to issue multiple certificates to each certification employee. Rather, in a certificate, a firm may describe the employee's functions that involve an FCA-specified significant-harm function in broad terms, and without listing all the activities that the function may involve.

3. (3)

   A firm should assess whether the employee is fit and proper to perform all aspects of the employee's functions that involve an FCA-specified significant-harm function as described by a certificate.

1. (1)

   In cases where a certification employee's role changes to involve a new function involving an FCA-specified significant-harm function part way through the twelve-month period for which their certificate is valid, and that new function may have different requirements relating to:

   1. (a)

      personal characteristics;

   2. (b)

      the level of competence, knowledge and experience;

   3. (c)

      qualifications; or

   4. (d)

      training;

2. the FCA would expect the firm to assess whether the employee is fit and proper to perform that new function before they start it.

3. (2)

   A firm should not wait until the point of annual reassessment to determine whether the employee is fit and proper for the new function.

4. (3)

   Paragraphs (1) and (2) also apply if a certification employee's role changes to involve a new FCA-specified significant-harm function part way through the twelve-month period. A firm may not need to issue a new certificate if:

   1. (a)

      the conditions in paragraph (1) are met; and

   2. (b)

      the certificate is drafted broadly enough to cover the new FCA-specified significant-harm function.

1. (1)

   3This paragraph gives further guidance on the flexibility a firm has in drafting its certificates.

2. (2)

   A certificate may cover functions that a certification employee is not currently performing, as long as the firm has assessed the employee’s fitness for these additional functions. This is subject to (3).

3. (3)

   When a firm is deciding what a certificate can cover beyond the functions that the certification employee is currently performing, it should take the factors in SYSC 5.2.17G(1) into account. A certificate should not normally cover an additional function if SYSC 5.2.17G(1) would require the firm to consider the employee’s fitness before allowing them to perform it.

4. (4)

   A firm may, if it wishes, restrict a certificate to the functions that the certification employee is currently performing rather than drafting the certificate more widely as described in (2) and (3).

5. (5)

   SYSC 5.2.12G deals with the flexibility a firm has in choosing the period for which a certificate lasts.

The FCA interprets the phrase ‘dealing with’ in SYSC 5.2.19R as including having contact with clients and extending beyond ‘dealing’ as used in the phrase ‘dealing in investments’. ‘Dealing in’ is used in Schedule 2 to the Act to describe in general terms the regulated activities which are specified in Part II of the Regulated Activities Order.

3The FCA interprets the phrase ‘a client of the firm in the United Kingdom’ in SYSC 5.2.19R as referring to:

1. (1)

   for a client which is a body corporate, its office or branch in the United Kingdom; or

2. (2)

   for a client who is an individual, a client who is in the United Kingdom at the time of the dealing.

1. (1)

   The certification regime only applies to an employee.

2. (2)

   This definition includes a person who:

   1. (a)

      personally provides, or is under an obligation personally to provide, services to the firm in question under an arrangement made between the firm and the person providing the services or another person; and

   2. (b)

      is subject to (or to the right of) supervision, direction or control by the firm as to the manner in which those services are provided.

1. (1)

   A person who works for an appointed representative of a firm may fall into the certification regime. In practice, however, they may not meet the conditions for the certification regime to apply.

2. (2)

   One condition for the certification regime to apply to a person is that the person performs a specified significant-harm function under an arrangement entered into by the firm (see SYSC 5.2.4G). However, unlike the equivalent parts of the Act for the approved persons regime, the Act does not say that the certification regime applies if the function is performed under an arrangement entered into by the employee with a contractor of the firm instead of the firm.

3. (3)

   The certification regime only applies if the person concerned is an employee. This is defined in SYSC 5.2.21G. In many cases, a person working for an appointed representative will not fall into this definition as they may not:

   1. (a)

      provide services to the firm; or

   2. (b)

      be subject to (or to the right of) supervision, direction or control by the firm.

4. (4)

   If none of these limitations on the scope of the certification regime apply, a person working for an appointed representative will be subject to the certification regime, as long as the other conditions in this section are met.

A specified significant-harm function does not cease to be an FCA-specified significant-harm function if the PRA also specifies that function as a specified significant-harm function.

Under section 63E(7) of the Act, SYSC 5.2 does not apply to an arrangement which allows an employee to perform a function if the question of whether the employee is fit and proper to perform the function is reserved under any of the Single Market Directives or the auction regulation to an authority in a country or territory outside the United Kingdom.

SYSC 5.2.27R does not apply to FCA-specified significant-harm function (5) (functions requiring qualifications). Where there is an unforeseen absence of an employee performing a function for which there is a qualification requirement:

1. (1)

   the firm should take reasonable care to ensure that no employee of that firm performs that function without a valid certificate; and

2. (2)

   the certificate should be issued before the person starts to perform the function.

3 SYSC 5 Annex 1G gives examples of how SYSC 5.2.28AR works.

1. (1)

   3The FCA would expect an individual from overseas using the temporary UK role rule in SYSC 5.2.28AR to be accompanied on a visit to a customer in the United Kingdom.

2. (2)

   An individual benefiting from the temporary UK role rule in SYSC 5.2.28AR may still be subject to the requirements of TC (Training and competence). However, TC 2.1.9R gives an exemption from certain qualification requirements in TC to an individual benefiting from the temporary UK role rule.

1. (1)

   If a function falls into more than one of the FCA-specified significant-harm functions in the table in SYSC 5.2.30R, all of those FCA-specified significant-harm functions apply to it.

2. (2)

   For example, if a person's job involves both FCA-specified significant-harm function (5) (functions requiring qualifications) and (7) (material risk takers), the emergency appointments rule (SYSC 5.2.27R) does not apply to that job.

3. (3)

   Another example is the rule about the territorial scope of this section (SYSC 5.2.19R)) for a UK relevant authorised person. For example, if a person’s job involves both FCA-specified significant-harm function (5) (functions requiring qualifications) and (7) (material risk takers), the territorial restriction in that rule does not apply to that job. Instead, this section applies without any territorial limitation.3

4. (4)

   The reason for (3) is that SYSC 5.2.19R(3)) says that there is no territorial limitation on FCA-specified significant-harm function (7) for a UK relevant authorised person. As explained in (1), it does not matter that the job also involves FCA-specified significant-harm function (5), to which the territorial limitation does apply.3

2 SYSC 5.2.32R(1) only applies to a firm to the extent that CASS applies to that firm.

A senior manager carrying on the significant management FCA-specified significant-harm function under SYSC 5.2.35R could, for example, be:

1. (1)

   the head of a unit carrying on the activities of:

   1. (a)

      retail banking;

   2. (b)

      personal lending;

   3. (c)

      corporate lending;

   4. (d)

      salvage or loan recovery; or

   5. (e)

      proprietary trading; or

2. (2)

   a member of a committee (that is, a person who, together with others, has authority to commit the firm) making decisions in these functions.

For the purposes of the definition of the significant management FCA-specified significant-harm function, the following additional factors about the firm should be considered:

1. (1)

   the size and significance of the firm's business in the United Kingdom – for example, a firm carrying on designated investment business may have a large number of certification employees (for example, in excess of 100 individuals);

2. (2)

   the number of regulated activities carried on, or proposed to be carried on, by the firm and (if relevant) other members of the group;

3. (3)

   its group structure (if it is a member of a group);

4. (4)

   its management structure (for example, matrix management); and

5. (5)

   the size and significance of its international operations, if any.

When considering whether a business unit is significant for the purposes of SYSC 5.2.35R, the firm should take into account all relevant factors in the light of the firm's current circumstances and its plans for the future, including:

1. (1)

   the risk profile of the unit;

2. (2)

   its use or commitment of the firm's capital;

3. (3)

   its contribution to the profit and loss account;

4. (4)

   the number of employees, certification employees or SMF managers in the unit;

5. (5)

   the number of customers of the unit; and

6. (6)

   any other factor which makes the unit significant to the conduct of the firm's affairs so far as relating to the regulated activity.

1. (1)

   SYSC 5.2.39R (Functions requiring qualifications) does not apply to a UK relevant authorised person where TC does not apply.2

2. (2)

   SYSC 5.2.39R (Functions requiring qualifications) applies to a non-UK relevant authorised person irrespective of whether the function in TC App 1.1.1R (Activities and Products/Sectors to which TC applies) applies to incoming EEA firms or overseas firms for the purposes of TC.2

Subject to SYSC 5.2.42R(2),2SYSC 5.2.42R (Material risk takers) does not apply to a firm to which the dual-regulated firms Remuneration Code does not apply.

3 SYSC 5.2.20G (the FCA interprets the phrase ‘dealing with’ as including having contact with and extending beyond ‘dealing’ as used in ‘dealing in investments’) applies to SYSC 5.2.44R.

3The client-dealing FCA-specified significant-harm function generally involves dealing with any person with or for whom the activities in the table in SYSC 5.2.45R are carried out (or their property). That person need not be a client of the firm.

3The restrictions in SYSC 5.2.18R (FCA-specified significant-harm function should require the person performing it to be involved in one or more aspects of the firm’s affairs so far as they relate to regulated activities) also applies to the client-dealing FCA-specified significant-harm function.

3Algorithmic trading is not limited to high-frequency algorithmic trading.

3Deploying a trading algorithm includes deploying one on a trading venue on which the firm has not traded before where the firm is already using that trading algorithm on another trading venue.

3 SYSC 5.2.49R(1)(b) (monitoring or deciding whether or not a trading algorithm is compliant) includes testing, such as validation and stress testing.

1. (1)

   3Sometimes an approval or a decision involves sign-off from different people about different aspects of the decision or approval.

2. (2)

   If this is the case, all will have given the approval or decision for the purposes of SYSC 5.2.49R.

1. (1)

   3Sometimes an approval or decision involves sign-off by a number of people of different levels of seniority about the same aspects of the decision.

2. (2)

   If this is the case, only the most senior decision-taker gives the approval or decision for the purposes of SYSC 5.2.49R.

3. (3)

   Where the firm’s procedures do not require the more senior person to carry out a detailed review of the decision of the more junior, both the junior and the senior person will give the approval or decision.

3A firm may have deployed an algorithm even though:

1. (1)

   it has not yet actually been used in the generation or acceptance of orders; or

2. (2)

   it is not actually being used in the generation or acceptance of orders at the moment; or

3. (3)

   it is not currently being used in the generation or acceptance of orders because the circumstances have not arisen for it to start doing so.

3In the examples in SYSC 5.2.56G the algorithm is capable of being used in the generation or acceptance of orders but is not actually generating or accepting them at the moment. However, a firm does not deploy an algorithm if the algorithm is not yet capable of generating or accepting orders because, for example, it is still in development.