On September 25, 2023, the UK’s Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) released a joint consultation paper CP23/20 on a new regulatory framework on diversity and inclusion. The FCA and PRA’s starting points on the consultation are that: (1) non-financial misconduct (NFM) is misconduct for regulatory purposes; and (2) greater diversity and inclusion can lead to better customer outcomes.
CP 23/20 sets out a number of proposals intended to develop diversity and inclusion strategies backed up by data and targets and subject to regulatory reporting requirements. These are framed within proportional and flexible principles that will mean that obligations will largely attach to larger firms depending on their number of employees, status under the Senior Managers and Certification Regime (SMCR) and whether they are regulated by both the FCA and PRA. The large-firm threshold is being set at 250 employees based on an average number over a rolling three-year period as at a specified annual reference date, and calculated on a solo entity basis capturing activities carried out from an establishment in the UK.
Proposals
Better integration of non-financial misconduct (into staff fitness and propriety assessments, conduct of business rules and suitability criteria for firms
The proposals would apply to all regulated firms with a ‘Part 4A permission,’ i.e., authorized firms, with the exception of credit rating agencies, payment services and e-money firms, and will include NFM within conduct rules, fit and proper assessments for employees and senior personnel, and suitability guidance on threshold conditions. The requirements are all framed within the guiding principle that NFM is misconduct and not a principle in and of itself, and will make it clear that misconduct within the workplace, and similarly serious behavior in a person’s private life, can also be relevant. Proposed expansions to the scope of conduct rules will make it clear that serious instances of NFM may amount to breaches of those rules. Also proposed is consideration of material NFM and its impact on a firm’s ability to satisfy the threshold conditions for doing business when applying for authorization.
Data reporting
All firms will need to report their average number of employees annually, with the exception of Limited Scope SMCR firms (as financial services are typically ancillary to their main business). Firms with 251 or more employees have additional reporting obligations, again excluding all Limited Scope SMCR firms.
D&I strategies and targets
These will be required of all dual-regulated firms (FCA and PRA) and all firms with 251 or more employees excluding all Limited Scope SMCR firms. Larger firms will be expected to develop and embed a flexible, evidence-based D&I strategy with a plan for measuring and meeting objectives and goals, anticipating obstacles and ensuring the adequate dissemination of awareness among staff. Maintenance and oversight of the D&I strategy will be a board responsibility, and firms will need to be satisfied that the strategy is and remains fit for purpose and taken it into account when setting targets. Those targets are expected to address underrepresentation at board and senior leadership level and across the employee population as a whole, but the FCA is not proposing to mandate the demographic characteristics targets should cover.
Data disclosure and risk and governance
These measures will be required of all firms with 251 or more employees excluding all Limited Scope SMCR firms. Firms will be required to annually collect and report on data across a range of demographic characteristics, inclusion metrics and targets through a regulatory return, with a reporting window of three months from the reference date. The FCA is also proposing to produce its own regular aggregated report and to identify areas that need further supervisory input.
On risk and governance, the FCA is proposing new guidance for large firms on treating D&I as a non-financial risk.
Next Steps
Responses to the consultation are due by December 18, 2023, and rules will come into force 12 months from the publication of a Policy Statement in 2024.
Taking the Temperature: The financial regulator of a key global financial market focusing on social factors like diversity and inclusion highlights its growing importance as a regulatory area, though to date overshadowed by the regulatory attention paid the “E” in “ESG.”
This was particularly the case following a decision of the Upper Tribunal in which it overturned the FCA’s decision to withdraw an individual’s regulatory approval following his conviction for sexual offenses, on the basis that he was not a fit and proper person. On appeal, the Upper Tribunal determined that the FCA had failed to establish the requisite degree of relevance of his conduct, as it concerned his fitness and propriety; this was because the regulator failed to establish a link between the two. From the FCA’s perspective the court’s decision highlighted a gap in guidance.
As the FCA’s chief executive commented, the regulator has “taken a lead among regulators in taking a clear stance that non-financial misconduct, such as sexual harassment, is misconduct for regulatory purposes.” The new rules could significantly reduce any gray areas in some respects, such as those faced by the FCA in recent years. However, how the rules will balance criminal law principles, such as a person’s right to be regarded innocent until proven guilty, may present an entirely new challenge.