Prudential Regulation Authority Rulebook

SYSC 1.1A

SYSC 1.1A.1

See Notes

SYSC 1.1A.2

See Notes

The provisions in SYSC should be read in conjunction with GEN 2.2.23 R to GEN 2.2.25 G. In particular:

SYSC 1.2

SYSC 1.2.1A

See Notes

The purposes of SYSC are:

SYSC 1.4

SYSC 1.4.1

See Notes

SYSC 1.4.1A

See Notes

SYSC 1.4.1B

See Notes

SYSC 1 Annex 1

SYSC 2.1

SYSC 2.1.1

See Notes

A firm must take reasonable care to maintain a clear and appropriate apportionment of significant responsibilities among its directors and senior managers in such a way that:

SYSC 2.1.1A

See Notes

SYSC 2.1.2

See Notes

SYSC 2.1.3

See Notes

A firm must appropriately allocate to one or more individuals, in accordance with SYSC 2.1.4 R, the functions of:

SYSC 2.1.4

See Notes

SYSC 2.1.5

See Notes

SYSC 2.1.6

See Notes

SYSC 2.2

SYSC 2.2.1

See Notes

SYSC 2.2.2

See Notes

SYSC 2.2.3

See Notes

SYSC 3.1

SYSC 3.1.1

See Notes

SYSC 3.1.2

See Notes

SYSC 3.1.2A

See Notes

SYSC 3.1.3

See Notes

SYSC 3.1.5

See Notes

SYSC 3.1.6

See Notes

SYSC 3.1.7

See Notes

SYSC 3.1.10

See Notes

SYSC 3.2

SYSC 3.2.1

See Notes

SYSC 3.2.2

See Notes

SYSC 3.2.3

See Notes

SYSC 3.2.4

See Notes

SYSC 3.2.5

See Notes

SYSC 3.2.7

See Notes

SYSC 3.2.10

See Notes

SYSC 3.2.11B

See Notes

SYSC 3.2.12

See Notes

SYSC 3.2.13

See Notes

SYSC 3.2.14

See Notes

SYSC 3.2.15

See Notes

SYSC 3.2.16

See Notes

1. (1) Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function. An internal audit function should have clear responsibilities and reporting lines to an audit committee or appropriate senior manager, be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the firm and have appropriate access to a firm's records.
2. (2) The term 'internal audit function' refers to the generally understood concept of internal audit within a firm, that is, the function of assessing adherence to and the effectiveness of internal systems and controls, procedures and policies. The internal audit function is not a controlled function itself, but is part of the systems and controls function (CF28).

SYSC 3.2.17

See Notes

A firm should plan its business appropriately so that it is able to identify, measure, manage and control risks of regulatory concern (see SYSC 3.2.11 G (2)). In some firms, depending on the nature, scale and complexity of their business, it may be appropriate to have business plans or strategy plans documented and updated on a regular basis to take account of changes in the business environment.

SYSC 3.2.18

See Notes

It is possible that firms' remuneration policies will from time to time lead to tensions between the ability of the firm to meet the requirements and standards under the regulatory system and the personal advantage of those who act for it. Where tensions exist, these should be appropriately managed.

SYSC 3.2.19

See Notes

A firm should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness.

SYSC 3.2.20

See Notes

1. (1) A firm must take reasonable care to make and retain adequate records of matters and dealings (including accounting records) which are the subject of requirements and standards under the regulatory system.
2. (2) Subject to (3) and to any other record-keeping rule in the Handbook, the records required by (1) or by such other rule must be capable of being reproduced in the English language on paper.
3. (3) If a firm's records relate to business carried on from an establishment in a country or territory outside the United Kingdom, an official language of that country or territory may be used instead of the English language as required by (2).

SYSC 3.2.21

See Notes

A firm should have appropriate systems and controls in place to fulfil the firm's regulatory and statutory obligations with respect to adequacy, access, periods of retention and security of records. The general principle is that records should be retained for as long as is relevant for the purposes for which they are made.

SYSC 3.2.22

See Notes

Detailed record-keeping requirements for different types of firm are to be found elsewhere in the Handbook. Schedule 1 to the Handbook is a consolidated schedule of these requirements.

SYSC 4.1

SYSC 4.1.1

See Notes

1. (1) A firm must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems.
2. (2) [deleted]

[Note: article 74 (1) of CRD, article 13(5) second paragraph of MiFID, article 12(1)(a) of the UCITS Directive, and article 18(1) of AIFMD]

SYSC 4.1.2

See Notes

For a common platform firm, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R must be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and of the common platform firm's activities and must take into account the specific technical criteria described in SYSC 4.1.7 R, SYSC 5.1.7 R, SYSC 7 and (for a firm to which SYSC 19A applies) SYSC 19A , or (for a full-scope UK AIFM) SYSC 19B.

[Note: article 74 (2) of CRD]

SYSC 4.1.2A

See Notes

Other firms should take account of the comprehensiveness and proportionality rule (SYSC 4.1.2 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.1.4

See Notes

A firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)) must, taking into account the nature, scale and complexity of the business of the firm, and the nature and range of the financial services and activities undertaken in the course of that business:

1. (1) (if it is a common platform firm or a management company) establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;
2. (2) establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm;
3. (3) (if it is a common platform firm) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the firm; and
4. (4) (if it is a management company) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the management company as well as effective information flows with any third party involved.

[Note: articles 5(1) final paragraph, 5(1)(a), 5(1)(c) and 5(1)(e) of the MiFID implementing Directive and articles 4(1) final paragraph, 4(1)(a), 4(1)(c) and 4(1)(d) of the UCITS implementing Directive]

SYSC 4.1.4A

See Notes

A firm that is not a common platform firm or a management company should take into account the decision-making procedures and effective internal reporting rules (SYSC 4.1.4R (1), (3) and (4)) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.1.5

See Notes

A MiFID investment firm and a management company must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.

[Note: article 5(2) of the MiFID implementing Directive and article 4(2) of the UCITS implementing Directive]

SYSC 4.1.6

See Notes

A common platform firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. To this end the common platform firm must employ appropriate and proportionate systems, resources and procedures.

[Note: article 13(4) of MiFID]

SYSC 4.1.7

See Notes

A common platform firm and a management company must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited, the preservation of essential data and functions, and the maintenance of its regulated activities, or, in the case of a management company, its collective portfolio management activities, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of those activities.

[Note: article 5(3) of the MiFID implementing Directive, annex V paragraph 13 of the Banking Consolidation Directive, article 4(3) of the UCITS implementing Directive and article 85(2) of the CRD]

SYSC 4.1.7A

See Notes

Other firms should take account of the business continuity rules (SYSC 4.1.6 R and 4.1.7 R) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.1.8

See Notes

The matters dealt with in a business continuity policy should include:

1. (1) resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
2. (2) the recovery priorities for the firm's operations;
3. (3) communication arrangements for internal and external concerned parties (including the appropriate regulator, clients and the press);
4. (4) escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
5. (5) processes to validate the integrity of information affected by the disruption; and
6. (6) regular testing of the business continuity policy in an appropriate and proportionate manner in accordance with SYSC 4.1.10 R.

SYSC 4.1.9

See Notes

A common platform firm and a management company must establish, implement and maintain accounting policies and procedures that enable it, at the request of the appropriate regulator, to deliver in a timely manner to the appropriate regulator financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.

[Note: article 5(4) of the MiFID implementing Directive and article 4(4) of the UCITS implementing Directive]

SYSC 4.1.10

See Notes

A common platform firm and a management company must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.4 R to SYSC 4.1.9 R and take appropriate measures to address any deficiencies.

[Note: article 5(5) of the MiFID implementing Directive and article 4(5) of the UCITS implementing Directive]

SYSC 4.1.10A

See Notes

Other firms should take account of the regular monitoring rule (SYSC 4.1.10 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G, but ignoring the cross-reference to SYSC 4.1.5 R and 4.1.9 R.

SYSC 4.1.11

See Notes

Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to form an audit committee. An audit committee could typically examine management's process for ensuring the appropriateness and effectiveness of systems and controls, examine the arrangements made by management to ensure compliance with requirements and standards under the regulatory system, oversee the functioning of the internal audit function (if applicable) and provide an interface between management and external auditors. It should have an appropriate number of non-executive directors and it should have formal terms of reference.

SYSC 4.1.13

See Notes

Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

SYSC 4.1.14

See Notes

The role undertaken by a non-executive director will vary from one firm to another. Where a non-executive director is an approved person, for example where the firm is a body corporate, his responsibility and therefore liability will be limited by the role that he undertakes.

SYSC 4.1.15

See Notes

1. (1) A firm must have in place appropriate procedures for its employees to report breaches internally through a specific, independent and autonomous channel.
2. (2) The channel in (1) may be provided through arrangements provided for by social partners.

[Note: article 71 (3) of CRD]

SYSC 4.2

SYSC 4.2.1

See Notes

The senior personnel of a common platform firm, a management company a full-scope UK AIFM, or of the UK branch of a non-EEA bank must be of sufficiently good repute and sufficiently experienced as to ensure the sound and prudent management of the firm.

[Note: article 9(1) of MiFID, article 7(1)(b) of the UCITS Directive article 8(1)(c) of AIFMD, article 11(1) second paragraph of the Banking Consolidation Directive and article 13(1) of the CRD]

SYSC 4.2.1A

See Notes

Other firms should take account of the senior personnel rule (SYSC 4.2.1 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.2.2

See Notes

A common platform firm, a management company, a full-scope UK AIFM and the UK branch of a non-EEA bank must ensure that its management is undertaken by at least two persons meeting the requirements laid down in SYSC 4.2.1 R and, for a full-scope UK AIFM, SYSC 4.2.7 R.

[Note: article 9(4) first paragraph of MiFID, article 7(1)(b) of the UCITS Directive, article 8(1)(c) of AIFMD and article 13(1) of CRD]

SYSC 4.2.3

See Notes

In the case of a body corporate, the persons referred to in SYSC 4.2.2 R should either be executive directors or persons granted executive powers by, and reporting immediately to, the governing body. In the case of a partnership, they should be active partners.

SYSC 4.2.4

See Notes

At least two independent minds should be applied to the formulation and implementation of the policies of a common platform firm, a management company, a full-scope UK AIFM and the UK branch of a non-EEA bank. Where a firm nominates just two individuals to direct its business, the appropriate regulator will not regard them as both effectively directing the business where one of them makes some, albeit significant, decisions relating to only a few aspects of the business. Each should play a part in the decision-making process on all significant decisions. Both should demonstrate the qualities and application to influence strategy, day-to-day policy and its implementation. This does not require their day-to-day involvement in the execution and implementation of policy. It does, however, require involvement in strategy and general direction, as well as knowledge of, and influence on, the way in which strategy is being implemented through day-to-day policy.

SYSC 4.2.5

See Notes

Where there are more than two individuals directing the business of a common platform firm, a management company, a full-scope UK AIFM or the UK branch of a non-EEA bank, the appropriate regulator does not regard it as necessary for all of these individuals to be involved in all decisions relating to the determination of strategy and general direction. However, at least two individuals should be involved in all such decisions. Both individuals' judgement should be engaged so that major errors leading to difficulties for the firm are less likely to occur. Similarly, each individual should have sufficient experience and knowledge of the business and the necessary personal qualities and skills to detect and resist any imprudence, dishonesty or other irregularities by the other individual. Where a single individual, whether a chief executive, managing director or otherwise, is particularly dominant in such a firm this will raise doubts about whether SYSC 4.2.2 R is met.

SYSC 4.2.6

See Notes

If a common platform firm, (other than a credit institution or AIFM investment firm) or the UK branch of a non-EEA bank, is:

1. (1) a natural person; or
2. (2) a legal person managed by a single natural person;

it must have alternative arrangements in place which ensure sound and prudent management of the firm.

[Note: article 9(4) second paragraph of MiFID]

SYSC 4.3

SYSC 4.3.1

See Notes

A firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)), when allocating functions internally, must ensure that senior personnel and, where appropriate, the supervisory function, are responsible for ensuring that the firm complies with its obligations under the regulatory system. In particular, senior personnel and, where appropriate, the supervisory function must assess and periodically review the effectiveness of the policies, arrangements and procedures put in place to comply with the firm's obligations under the regulatory system and take appropriate measures to address any deficiencies.

[Note: article 9(1) of the MiFID implementing Directive and articles 9(1) and 9(3) of the UCITS implementing Directive]

SYSC 4.3.2

See Notes

A common platform firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)) and a management company, must ensure that:

1. (1) its senior personnel receive on a frequent basis, and at least annually, written reports on the matters covered by SYSC 6.1.2 R to SYSC 6.1.5 R, SYSC 6.2.1 R and SYSC 7.1.2 R, SYSC 7.1.3 R and SYSC 7.1.5 R to SYSC 7.1.7 R, indicating in particular whether the appropriate remedial measures have been taken in the event of any deficiencies; and
2. (2) the supervisory function, if any, receives on a regular basis written reports on the same matters.

[Note: article 9(2) and article 9(3) of the MiFID implementing Directive and articles 9(4) and 9(6) of the UCITS implementing Directive]

SYSC 4.3.2A

See Notes

Other firms should take account of the written reports rule (SYSC 4.3.2 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.3.3

See Notes

The supervisory function does not include a general meeting of the shareholders of a firm , or equivalent bodies, but could involve, for example, a separate supervisory board within a two-tier board structure or the establishment of a non-executive committee of a single-tier board structure.

SYSC 4.3A

SYSC 4.3A.1

See Notes

A CRR firm must ensure that the management body defines, oversees and is accountable for the implementation of governance arrangements that ensure effective and prudent management of the firm, including the segregation of duties in the organisation and the prevention of conflicts of interest. The firm must ensure that the management body:

1. (1) has overall responsibility for the firm;
2. (2) approves and oversees implementation of the firm's strategic objectives, risk strategy and internal governance;
3. (3) ensures the integrity of the firm's accounting and financial reporting systems, including financial and operational controls and compliance with the regulatory system.
4. (4) oversees the process of disclosure and communications;
5. (5) has responsibility for providing effective oversight of senior management.
6. (6) monitors and periodically assesses the effectiveness of the firm's governance arrangements and takes appropriate steps to address any deficiencies.

[Note: article 88(1) of CRD]

SYSC 4.3A.2

See Notes

A CRR firm must ensure that the chairman of the firm's management body does not exercise simultaneously the chief executive function within the same firm, unless justified by the firm and authorised by the appropriate regulator.

[Note: article 88(1)(e) of CRD]

SYSC 4.3A.3

See Notes

A CRR firm must ensure that the members of the management body of the firm:

1. (1) are of sufficiently good repute;
2. (2) possess sufficient knowledge, skills and experience to perform their duties;
3. (3) possess adequate collective knowledge, skills and experience to understand the firm's activities, including the main risks;
4. (4) reflect an adequately broad range of experiences;
5. (5) commit sufficient time to perform their functions in the firm; and
6. (6) act with honesty, integrity and independence of mind to effectively assess and challenge the decisions of senior management where necessary and to effectively oversee and monitor management decision-making.

[Note: article 91(1)-(2) and (7)-(8) of the CRD]

SYSC 4.3A.4

See Notes

A CRR firm must devote adequate human and financial resources to the induction and training of members of the management body.

[Note: article 91(3) of the CRD]

SYSC 4.3A.5

See Notes

A CRR firm must ensure that the members of the management body of the firm do not hold more directorships than is appropriate taking into account individual circumstances and the nature, scale and complexity of the firm's activities.

[Note: article 91(3) of the CRD]

SYSC 4.3A.6

See Notes

1. (1) A CRR firm that is significant must ensure that the members of the management body of the firm do not hold more than one of the following combinations of directorship in any organisation at the same time:
1. (a) one executive directorship with two non-executive directorships; and
2. (b) four non-executive directorships.
2. (2) Paragraph (1) does not apply to members of the management body that represent the United Kingdom.

[Note: article 91(3) of the CRD]

SYSC 4.3A.6A

See Notes

In SYSC 4.3A.6 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.

SYSC 4.3A.6B

See Notes

The limits on directorships set out in SYSC 4.3A.6 R also apply to members of the management body of the UK consolidation group or non-EEA sub group in accordance with SYSC 12.1.13 R. Individuals in any of the entities belonging to the UK consolidation group or non-EEA sub group are capable of forming part of this management body. For example, members of the management body of a non-CRR firm that is a parent financial holding company in a Member State and is a member of a UK consolidation group could be caught by the limits in SYSC 4.3A.6 R (SYSC 12.1.14 R). In particular, a person who requires approval under SUP 10B.6.2 R or SUP 10B.6.4 R because of the influence they exercise over the CRR firm is a member of the management body of the UK consolidation group or non-EEA sub group and therefore subject to the limit on directorships in SYSC 4.3A.6 R.

[Note: article 91(3) and article 109(2) of the CRD]

SYSC 4.3A.7

See Notes

For the purposes of SYSC 4.3A.5 R and SYSC 4.3A.6 R:

1. (1) directorships in organisations which do not pursue predominantly commercial objectives shall not count; and
2. (2) the following shall count as a single directorship:
1. (a) executive or non-executive directorships held within the same group; or
2. (b) executive or non-executive directorships held within:
1. (i) firms that are members of the same institutional protection scheme provided that the conditions set out in Article 113(7) of the CRR are fulfilled; or
2. (ii) undertakings (including non-financial entities) in which the firm holds a qualifying holding.

[Note: article 91(4) and (5) of the CRD]

SYSC 4.3A.8

See Notes

A CRR firm that is significant must:

1. (1) establish a nomination committee composed of members of the management body who do not perform any executive function in the firm;
2. (2) ensure that the nomination committee is able to use any forms of resources the nomination committee deems appropriate, including external advice; and
3. (3) ensure that the nomination committee receives appropriate funding.

[Note: article 88(2) of the CRD]

SYSC 4.3A.8A

See Notes

In SYSC 4.3A.8 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.

SYSC 4.3A.9

See Notes

A CRR firm that has a nomination committee must ensure that the nomination committee:

1. (1) engage a broad set of qualities and competences when recruiting members to the management body and for that purpose puts in place a policy promoting diversity on the management body;
2. (2) identifies and recommends for approval, by the management body or by general meeting, candidates to fill management body vacancies, having evaluated the balance of knowledge, skills, diversity and experience of the management body;
3. (3) prepares a description of the roles and capabilities for a particular appointment, and assesses the time commitment required;
4. (4) decides on a target for the representation of the underrepresented gender in the management body and prepares a policy on how to increase the number of the underrepresented gender in the management body in order to meet that target;
5. (5) periodically, and at least annually, assesses the structure, size, composition and performance of the management body and makes recommendations to the management body with regard to any changes;
6. (6) periodically, and at least annually, assesses the knowledge, skills and experience of individual members of the management body and of the management body collectively, and reports this to the management body;
7. (7) periodically reviews the policy of the management body for selection and appointment of senior management and makes recommendations to the management body; and
8. (8) in performing its duties, and to the extent possible, on an ongoing basis, takes account of the need to ensure that the management body's decision making is not dominated by any one individual or small group of individuals in a manner that is detrimental to the interest of the firm as a whole;

[Note: article 88(2) and article 91(10) of the CRD]

SYSC 4.3A.10

See Notes

A CRR firm that does not have a nomination committee must engage a broad set of qualities and competences when recruiting members to the management body. For that purpose a CRR firm that does not have a nomination committee must put in place a policy promoting diversity on the management body.

[Note: article 91(10) of the CRD]

SYSC 4.3A.11

See Notes

A CRR firm that maintains a website must explain on the website how it complies with the requirements of SYSC 4.3A.1 R to SYSC 4.3A.3 R and SYSC 4.3A.4 R to SYSC 4.3A.11 R.

[Note: article 96 of the CRD]

SYSC 4.4

SYSC 4.4.1

See Notes

This section applies to:

1. (1) an authorised professional firm in respect of its non-mainstream regulated activities unless the firm is also conducting other regulated activities and has appointed approved persons to perform the governing functions with equivalent responsibilities for the firm's non-mainstream regulated activities and other regulated activities;
2. (2) activities carried on by a firm whose principal purpose is to carry on activities other than regulated activities and which is:
1. (a) an oil market participant; or
2. (b) a service company; or
3. (c) an energy market participant; or
4. (d) a wholly-owned subsidiary of:
1. (i) a local authority; or
2. (ii) a registered social landlord; or
5. (e) a firm with permission to carry on insurance mediation activity in relation to non-investment insurance contracts but no other regulated activity;
3. (3) [deleted]
4. (4) [deleted]
5. (5) [deleted]
1. (a) [deleted]
2. (b) [deleted]
6. (6) [deleted]
7. (7) an incoming Treaty firm, an incoming EEA firm or a UCITS qualifier (but only SYSC 4.4.5R (2) applies for these firms); and
8. (8) a sole trader, but only if he employs any person who is required to be approved under section 59 of the Act (Approval for particular arrangements).

SYSC 4.4.2

See Notes

This section does not apply to a common platform firm.

SYSC 4.4.3

See Notes

A firm must take reasonable care to maintain a clear and appropriate apportionment of significant responsibilities among its directors and senior managers in such a way that:

1. (1) it is clear who has which of those responsibilities; and
2. (2) the business and affairs of the firm can be adequately monitored and controlled by the directors, relevant senior managers and governing body of the firm.

SYSC 4.4.5

See Notes

A firm must appropriately allocate to one or more individuals, in accordance with the following table, the functions of:

1. (1) dealing with the apportionment of responsibilities under SYSC 4.4.3 R; and
2. (2) overseeing the establishment and maintenance of systems and controls under SYSC 4.1.1 R.

SYSC 4.4.6

See Notes

Frequently asked questions about allocation of functions in SYSC 4.4.5 R

SYSC 5.1

SYSC 5.1.1

See Notes

A firm must employ personnel with the skills, knowledge and expertise necessary for the discharge of the responsibilities allocated to them.

[Note: article 5(1)(d) of the MiFID implementing Directive, articles 12(1)(a) and 14(1)(c) of the UCITS Directive and article 5(1) of the UCITS implementing Directive]

SYSC 5.1.2

See Notes

SYSC 5.1.3

See Notes

SYSC 5.1.4A

See Notes

SYSC 5.1.5

See Notes

SYSC 5.1.5A

See Notes

SYSC 5.1.6

See Notes

A common platform firm and a management company must ensure that the performance of multiple functions by its relevant persons does not and is not likely to prevent those persons from discharging any particular functions soundly, honestly and professionally.

[Note: article 5(1)(g) of the MiFID implementing Directive and article 5(3) of the UCITS implementing Directive]

SYSC 5.1.7

See Notes

The senior personnel of a common platform firm must define arrangements concerning the segregation of duties within the firm and the prevention of conflicts of interest.

[Note: article 88 of the CRD and annex V paragraph 1 of the Banking Consolidation Directive]

SYSC 5.1.7A

See Notes

SYSC 5.1.8

See Notes

SYSC 5.1.9

See Notes

A firm should normally ensure that no single individual has unrestricted authority to do all of the following:

1. (1) initiate a transaction;
2. (2) bind the firm;
3. (3) make payments; and
4. (4) account for it.

SYSC 5.1.10

See Notes

SYSC 5.1.11

See Notes

Where a common platform firm outsources its internal audit function, it should take reasonable steps to ensure that every individual involved in the performance of this service is independent from the individuals who perform its external audit. This should not prevent services from being undertaken by a firm's external auditors provided that:

1. (1) the work is carried out under the supervision and management of the firm's own internal staff; and
2. (2) potential conflicts of interest between the provision of external audit services and the provision of internal audit are properly managed.

SYSC 5.1.12

See Notes

A common platform firm and a management company must ensure that its relevant persons are aware of the procedures which must be followed for the proper discharge of their responsibilities.

[Note: article 5(1)(b) of the MiFID implementing Directive and article 4(1)(b) of the UCITS implementing Directive]

SYSC 5.1.12A

See Notes

SYSC 5.1.13

See Notes

The systems, internal control mechanisms and arrangements established by a firm in accordance with this chapter must take into account the nature, scale and complexity of its business and the nature and range of financial services and activities undertaken in the course of that business.

[Note: article 5(1) final paragraph of the MiFID implementing Directive and articles 4(1) final paragraph and 5(4) of the UCITS implementing Directive]

SYSC 5.1.14

See Notes

A common platform firm and a management company must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with this chapter, and take appropriate measures to address any deficiencies.

[Note: article 5(5) of the MiFID implementing Directive and articles 4(5) of the UCITS implementing Directive]

SYSC 5.1.15

See Notes

SYSC 6.1

SYSC 6.1.1

See Notes

A firm must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and appointed representatives(or where applicable, tied agents) with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime.

[Note: article 13(2) of MiFID and article 12(1)(a) of the UCITS Directive]

SYSC 6.1.2

See Notes

A common platform firm and a management company must, taking intoaccount the nature, scale and complexity of its business, and the nature and range of financial services and activities undertaken in the course of that business, establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the regulatory system, as well as associated risks, and put in place adequate measures and procedures designed to minimise such risks and to enable the appropriate regulator to exercise its powers effectively under the regulatory system and to enable any other competent authority to exercise its powers effectively under MiFID or the UCITS Directive.

[Note: article 6(1) of the MiFID implementing Directive and article 10(1) of the UCITS implementing Directive]

SYSC 6.1.2A

See Notes

SYSC 6.1.3

See Notes

A common platform firm and a management company must maintain a permanent and effective compliance function which operates independently and which has the following responsibilities:

1. (1) to monitor and, on a regular basis, to assess the adequacy and effectiveness of the measures and procedures put in place in accordance with SYSC 6.1.2 R, and the actions taken to address any deficiencies in the firm's compliance with its obligations; and
2. (2) to advise and assist the relevant persons responsible for carrying out regulated activities to comply with the firm's obligations under the regulatory system.

[Note: article 6(2) of the MiFID implementing Directive and article 10(2) of the UCITS implementing Directive]

SYSC 6.1.3A

See Notes

1. (1) Other firms should take account of the compliance function rule (SYSC 6.1.3 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
2. (2) Notwithstanding SYSC 6.1.3 R, as it applies under (1), depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have a separate compliance function. Where a firm has a separate compliance function the firm should also take into account SYSC 6.1.3 R and SYSC 6.1.4 R as guidance.

SYSC 6.1.4

See Notes

In order to enable the compliance function to discharge its responsibilities properly and independently, a common platform firm and a management company must ensure that the following conditions are satisfied:

1. (1) the compliance function must have the necessary authority, resources, expertise and access to all relevant information;
2. (2) a compliance officer must be appointed and must be responsible for the compliance function and for any reporting as to compliance required by SYSC 4.3.2 R;
3. (3) the relevant persons involved in the compliance functions must not be involved in the performance of services or activities they monitor;
4. (4) the method of determining the remuneration of the relevant persons involved in the compliance function must not compromise their objectivity and must not be likely to do so.

[Note: article 6(3) first paragraph of the MiFID implementing Directive and article 10(3) of the UCITS implementing Directive]

SYSC 6.1.4-A

See Notes

In setting the method of determining the remuneration of relevant persons involved in the compliance function:

1. (1) firms that SYSC 19A applies to will also need to comply with the Remuneration Code; and
2. (2) BIPRU firms will also need to comply with the BIPRU Remuneration Code.

SYSC 6.1.5

See Notes

A common platform firm and a management company need not comply with SYSC 6.1.4 R (3) or SYSC 6.1.4 R (4) if it is able to demonstrate that in view of the nature, scale and complexity of its business, and the nature and range of financial services and activities, the requirements under those rules are not proportionate and that its compliance function continues to be effective.

[Note: article 6(3) second paragraph of the MiFID implementing Directive and article 10(3) second paragraph of the UCITS implementing Directive]

SYSC 6.1.6

See Notes

SYSC 6.1.7

See Notes

1. (1) This rule applies to a common platform firm conducting investment services and activities from a branch in another EEA State.
2. (2) References to the regulatory system in SYSC 6.1.1R, SYSC 6.1.2 R and SYSC 6.1.3 R apply in respect of a firm's branch as if regulatory system includes a Host State's requirements under MiFID and the MiFID implementing Directive which are applicable to the investment services and activities conducted from the firm's branch.

[Note: article 13(2) of MiFID]

SYSC 6.2

SYSC 6.2.1

See Notes

A common platform firm and a management company must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of its financial services and activities, undertaken in the course of that business, establish and maintain an internal audit function which is separate and independent from the other functions and activities of the firm and which has the following responsibilities:

1. (1) to establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the firm's systems, internal control mechanisms and arrangements;
2. (2) to issue recommendations based on the result of work carried out in accordance with (1);
3. (3) to verify compliance with those recommendations;
4. (4) to report in relation to internal audit matters in accordance with SYSC 4.3.2 R.

[Note: article 8 of the MiFID implementing Directive and article 11 of the UCITS implementing Directive]

SYSC 6.2.1A

See Notes

SYSC 6.2.2

See Notes

SYSC 7.1

SYSC 7.1.1

See Notes

SYSC 7.1.2

See Notes

A common platform firm must establish, implement and maintain adequate risk management policies and procedures, including effective procedures for risk assessment, which identify the risks relating to the firm's activities, processes and systems, and where appropriate, set the level of risk tolerated by the firm.

[Note: article 7(1)(a) of the MiFID implementing Directive, article 13(5) second paragraph of MiFID]

SYSC 7.1.2A

See Notes

SYSC 7.1.3

See Notes

A common platform firm must adopt effective arrangements, processes and mechanisms to manage the risk relating to the firm's activities, processes and systems, in light of that level of risk tolerance.

[Note: article 7(1)(b) of the MiFID implementing Directive]

SYSC 7.1.4

See Notes

The management body of a common platform firm must approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the firm is or might be exposed to, including those posed by the macroeconomic environment in which it operates in relation to the status of the business cycle.

[Note: article 76(1) of CRD]

SYSC 7.1.4A

See Notes

SYSC 7.1.4B

See Notes

SYSC 7.1.5

See Notes

A common platform firm must monitor the following:

1. (1) the adequacy and effectiveness of the firm's risk management policies and procedures;
2. (2) the level of compliance by the firm and its relevant persons with the arrangements, processes and mechanisms adopted in accordance with SYSC 7.1.3 R;
3. (3) the adequacy and effectiveness of measures taken to address any deficiencies in those policies, procedures, arrangements, processes and mechanisms, including failures by the relevant persons to comply with such arrangements or processes and mechanisms or follow such policies and procedures.

[Note: article 7(1)(c) of the MiFID implementing Directive]

SYSC 7.1.6

See Notes

A common platform firm must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of the investment services and activities undertaken in the course of that business, establish and maintain a risk management function that operates independently and carries out the following tasks:

1. (1) implementation of the policies and procedures referred to in SYSC 7.1.2 R to SYSC 7.1.5 R; and
2. (2) provision of reports and advice to senior personnel in accordance with SYSC 4.3.2 R.

[Note: MiFID implementing Directive Article 7(2) first paragraph]

SYSC 7.1.7

See Notes

Where a common platform firm is not required under SYSC 7.1.6 R to maintain a risk management function that functions independently, it must nevertheless be able to demonstrate that the policies and procedures which it has adopted in accordance with SYSC 7.1.2 R to SYSC 7.1.5 R satisfy the requirements of those rules and are consistently effective.

[Note: article 7(2) second paragraph of the MiFID implementing Directive]

SYSC 7.1.7A

See Notes

SYSC 7.1.7B

See Notes

SYSC 7.1.7C

See Notes

SYSC 7.1.8

See Notes

1. (1) [deleted]
2. (2) The term 'risk management function' in SYSC 7.1.6 R and SYSC 7.1.7 R refers to the generally understood concept of risk assessment within a firm , that is, the function of setting and controlling risk exposure. The risk management function is not a controlled function itself, but is part of the systems and controls function (CF28).

SYSC 7.1.17

See Notes

[Note: article 76(2) of CRD]

SYSC 7.1.18

See Notes

1. (1) A CRR firm that is significant must establish a risk committee composed of members of the management body who do not perform any executive function in the firm. Members of the risk committee must have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the firm.
2. (2) The risk committee must advise the management body on the institution's overall current and future risk appetite and assist the management body in overseeing the implementation of that strategy by senior management.
3. (3) The risk committee must review whether prices of liabilities and assets offered to clients take fully into account the firm's business model and risk strategy. Where prices do not properly reflect risks in accordance with the business model and risk strategy, the risk committee must present a remedy plan to the management body.

[Note: article 76(3) of CRD]

SYSC 7.1.18A

See Notes

SYSC 7.1.19

See Notes

1. (1) A CRR firm must ensure that the management body in its supervisory function and, where a risk committee has been established, the risk committee have adequate access to information on the risk profile of the firm and, if necessary and appropriate, to the risk management function and to external expert advice.
2. (2) The management body in its supervisory function and, where one has been established, the risk committee must determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive.

[Note: article 76(4) of CRD]

SYSC 7.1.20

See Notes

In order to assist in the establishment of sound remuneration policies and practices, the risk committee must, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings.

[Note: article 76(4) of CRD]

SYSC 7.1.21

See Notes

1. (1) A CRR firm's risk management function (SYSC 7.1.6 R) must be independent from the operational functions and have sufficient authority, stature, resources and access to the management body.
2. (2) The risk management function must ensure that all material risks are identified, measured and properly reported. It must be actively involved in elaborating the firm's risk strategy and in all material risk management decisions and it must be able to deliver a complete view of the whole range of risks of the firm.
3. (3) A CRR firm must ensure that the risk management function is able to report directly to the management body in its supervisory function, independent from senior management and that it can raise concerns and warn the management body, where appropriate, where specific risk developments affect or may affect the firm, without prejudice to the responsibilities of the management body in its supervisory and/or managerial functions pursuant to the CRD and the CRR.

[Note: article 76(5) of CRD]

SYSC 7.1.22

See Notes

The head of the risk management function must be an independent senior manager with distinct responsibility for the risk management function. Where the nature, scale and complexity of the activities of the CRR firm do not justify a specially appointed person, another senior person within the firm may fulfil that function, provided there is no conflict of interest. The head of the risk management function must not be removed without prior approval of the management body and must be able to have direct access to the management body where necessary.

[Note: article 76(5) of CRD]

SYSC 8.1

SYSC 8.1.1

See Notes

A common platform firm must:

1. (1) when relying on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services (in this chapter "relevant services and activities") on a continuous and satisfactory basis, ensure that it takes reasonable steps to avoid undue additional operational risk;
2. (2) not undertake the outsourcing of important operational functions in such a way as to impair materially:
1. (a) the quality of its internal control; and
2. (b) the ability of the appropriate regulator to monitor the firm's compliance with all obligations under the regulatory system and, if different, of a competent authority to monitor the firm's compliance with all obligations under MiFID.

[Note: article 13(5) first paragraph of MiFID]

SYSC 8.1.1A

See Notes

SYSC 8.1.2

See Notes

SYSC 8.1.3

See Notes

SYSC 8.1.4

See Notes

For the purposes of this chapter an operational function is regarded as critical or important if a defect or failure in its performance would materially impair the continuing compliance of a common platform firm with the conditions and obligations of its authorisation or its other obligations under the regulatory system, or its financial performance, or the soundness or the continuity of its relevant services and activities.

[Note: article 13(1) of the MiFID implementing Directive]

SYSC 8.1.5

See Notes

Without prejudice to the status of any other function, the following functions will not be considered as critical or important for the purposes of this chapter:

1. (1) the provision to the firm of advisory services, and other services which do not form part of the relevant services and activities of the firm, including the provision of legal advice to the firm, the training of personnel of the firm, billing services and the security of the firm's premises and personnel;
2. (2) the purchase of standardised services, including market information services and the provision of price feeds;

[Note: article 13(2) of the MiFID implementing Directive]

1. (3) the recording and retention of relevant telephone conversations or electronic communications subject to COBS 11.8.

SYSC 8.1.5A

See Notes

SYSC 8.1.6

See Notes

If a firm outsources critical or important operational functions or any relevant services and activities, it remains fully responsible for discharging all of its obligations under the regulatory system and must comply, in particular, with the following conditions:

1. (1) the outsourcing must not result in the delegation by senior personnel of their responsibility;
2. (2) the relationship and obligations of the firm towards its clients under the regulatory system must not be altered;
3. (3) the conditions with which the firm must comply in order to be authorised, and to remain so, must not be undermined;
4. (4) none of the other conditions subject to which the firm's authorisation was granted must be removed or modified.

[Note: article 14(1) of the MiFID implementing Directive]

SYSC 8.1.7

See Notes

A common platform firm must exercise due skill and care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any relevant services and activities.

[Note: article 14(2) first paragraph of the MiFID implementing Directive]

SYSC 8.1.8

See Notes

A common platform firm must in particular take the necessary steps to ensure that the following conditions are satisfied:

1. (1) the service provider must have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally;
2. (2) the service provider must carry out the outsourced services effectively, and to this end the firm must establish methods for assessing the standard of performance of the service provider;
3. (3) the service provider must properly supervise the carrying out of the outsourced functions, and adequately manage the risks associated with the outsourcing;
4. (4) appropriate action must be taken if it appears that the service provider may not be carrying out the functions effectively and in compliance with applicable laws and regulatory requirements;
5. (5) the firm must retain the necessary expertise to supervise the outsourced functions effectively and to manage the risks associated with the outsourcing,and must supervise those functions and manage those risks;
6. (6) the service provider must disclose to the firm any development that may have a material impact on its ability to carry out the outsourced functions effectively and in compliance with applicable laws and regulatory requirements;
7. (7) the firm must be able to terminate the arrangement for the outsourcing where necessary without detriment to the continuity and quality of its provision of services to clients;
8. (8) the service provider must co-operate with the appropriate regulator and any other relevant competent authority in connection with the outsourced activities;
9. (9) the firm, its auditors, the appropriate regulator and any other relevant competent authority must have effective access to data related to the outsourced activities, as well as to the business premises of the service provider; and the appropriate regulator and any other relevant competent authority must be able to exercise those rights of access;
10. (10) the service provider must protect any confidential information relating to the firm and its clients;
11. (11) the firm and the service provider must establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities where that is necessary having regard to the function, service or activity that has been outsourced.

[Note: article 14(2) second paragraph of the MiFID implementing Directive]

SYSC 8.1.9

See Notes

A common platform firm must ensure that the respective rights and obligations of the firm and of the service provider are clearly allocated and set out in a written agreement.

[Note: article 14(3) of the MiFID implementing Directive]

SYSC 8.1.10

See Notes

If a common platform firm and the service provider are members of the same group, the firm may, for the purpose of complying with SYSC 8.1.7 R to SYSC 8.1.11 R and SYSC 8.2 and SYSC 8.3, take into account the extent to which the common platform firm controls the service provider or has the ability to influence its actions.

[Note: article 14(4) of the MiFID implementing Directive]

SYSC 8.1.11

See Notes

A common platform firm must make available on request to the appropriate regulator and any other relevant competent authority all information necessary to enable the appropriate regulator and any other relevant competent authority to supervise the compliance of the performance of the outsourced activities with the requirements of the regulatory system.

[Note: article 14(5) of the MiFID implementing Directive]

SYSC 8.1.11A

See Notes

SYSC 8.1.12

See Notes

As SUP 15.3.8 G explains, a firm should notify the appropriate regulator when it intends to rely on a third party for the performance of operational functions which are critical or important for the performance of relevant services and activities on a continuous and satisfactory basis.

[Note: recital 20 of the MiFID implementing Directive]

SYSC 9.1

SYSC 9.1.1

See Notes

A firm must arrange for orderly records to be kept of its business and internal organisation, including all services and transactions undertaken by it, which must be sufficient to enable the appropriate regulator or any other relevant competent authority under MiFID or the UCITS Directive to monitor the firm's compliance with the requirements under the regulatory system, and in particular to ascertain that the firm has complied with all obligations with respect to clients.

[Note: article 13(6) of MiFID, article 5(1)(f) of the MiFID implementing Directive, article 12(1)(a) of the UCITS Directive and article 4(1)(e) of the UCITS implementing Directive]

SYSC 9.1.2

See Notes

A common platform firm must retain all records kept by it under this chapter in relation to its MiFID business for a period of at least five years.

[Note: article 51 (1) of the MiFID implementing Directive]

SYSC 9.1.3

See Notes

In relation to its MiFID business, a common platform firm must retain records in a medium that allows the storage of information in a way accessible for future reference by the appropriate regulator or any other relevant competent authority under MiFID, and so that the following conditions are met:

1. (1) the appropriate regulator or any other relevant competent authority under MiFID must be able to access them readily and to reconstitute each key stage of the processing of each transaction;
2. (2) it must be possible for any corrections or other amendments, and the contents of the records prior to such corrections and amendments, to be easily ascertained;
3. (3) it must not be possible for the records otherwise to be manipulated or altered.

[Note: article 51(2) of the MiFID implementing Directive]

SYSC 9.1.4

See Notes

SYSC 9.1.5

See Notes

SYSC 9.1.6

See Notes

Schedule 1 to each module of the Handbook sets out a list summarising the record-keeping requirements of that module.

[Note: article 51(3) of MiFID implementing Directive]

SYSC 9.1.7

See Notes

SYSC 10.1

SYSC 10.1.1

See Notes

1. (1) This section applies to a firm which provides services to its clients in the course of carrying on regulated activities or ancillary activities or providing ancillary services (but only where the ancillary services constitute MiFID business).
2. (2) This section also applies to a management company.

SYSC 10.1.2

See Notes

The requirements in this section only apply where a service is provided by a firm . The status of the client to whom the service is provided (as a retail client, professional client or eligible counterparty) is irrelevant for this purpose.

[Note: recital 25 of MiFID implementing Directive]

SYSC 10.1.3

See Notes

A firm must take all reasonable steps to identify conflicts of interest between:

1. (1) the firm, including its managers, employees and appointed representatives (or where applicable, tied agents ), or any person directly or indirectly linked to them by control, and a client of the firm; or
2. (2) one client of the firm and another client;

that arise or may arise in the course of the firm providing any service referred to in SYSC 10.1.1 R.

[Note: article 18(1) of MiFID]

SYSC 10.1.4

See Notes

For the purposes of identifying the types of conflict of interest that arise, or may arise, in the course of providing a service and whose existence may entail a material risk of damage to the interests of a client, a common platform firm and a management company must take into account, as a minimum, whether the firm or a relevant person, or a person directly or indirectly linked by control to the firm:

1. (1) is likely to make a financial gain, or avoid a financial loss, at the expense of the client;
2. (2) has an interest in the outcome of a service provided to the client or of a transaction carried out on behalf of the client, which is distinct from the client's interest in that outcome;
3. (2A) in the case of a management company providing collective portfolio management services for a UCITS scheme, (2) also applies where the service is provided to, or the transaction is carried out on behalf of, a client other than the UCITS scheme;
4. (3) has a financial or other incentive to favour the interest of another client or group of clients over the interests of the client;
5. (4) carries on the same business as the client; or in the case of a management company, carries on the same activities for the UCITS scheme and for another client or clients which are not UCITS schemes; or
6. (5) receives or will receive from a person other than the client an inducement in relation to a service provided to the client, in the form of monies, goods or services, other than the standard commission or fee for that service.

The conflict of interest may result from the firm or person providing a service referred to in SYSC 10.1.1 R or engaging in any other activity or, in the case of a management company, whether as a result of providing collective portfolio management services or otherwise.

[Note: article 21 of MiFID implementing Directiveand article 17(1) of the UCITS implementing Directive]

SYSC 10.1.4B

See Notes

SYSC 10.1.5

See Notes

The circumstances which should be treated as giving rise to a conflict of interest cover cases where there is a conflict between the interests of the firm or certain persons connected to the firm or the firm's group and the duty the firm owes to a client; or between the differing interests of two or more of its clients, to whom the firm owes in each case a duty. It is not enough that the firm may gain a benefit if there is not also a possible disadvantage to a client, or that one client to whom the firm owes a duty may make a gain or avoid a loss without there being a concomitant possible loss to another such client.

[Note: recital 24 of MiFID implementing Directive]

SYSC 10.1.6

See Notes

A common platform firm and a management company must keep and regularly update a record of the kinds of service or activity carried out by or on behalf of that firm in which a conflict of interest entailing a material risk of damage to the interests of one or more clients has arisen or, in the case of an ongoing service or activity, may arise.

[Note: article 23 of MiFID implementing Directive and article 20(1) of the UCITS implementing Directive]

SYSC 10.1.6B

See Notes

SYSC 10.1.7

See Notes

A firm must maintain and operate effective organisational and administrative arrangements with a view to taking all reasonable steps to prevent conflicts of interest as defined in SYSC 10.1.3 R from constituting or giving rise to a material risk of damage to the interests of its clients.

[Note: article 13(3) of MiFID]

SYSC 10.1.8

See Notes

1. (1) If arrangements made by a firm under SYSC 10.1.7 R to manage conflicts of interest are not sufficient to ensure, with reasonable confidence, that risks of damage to the interests of a client will be prevented, the firm must clearly disclose the general nature and/or sources of conflicts of interest to the client before undertaking business for the client.
2. (2) The disclosure must:
1. (a) be made in a durable medium; and
2. (b) include sufficient detail, taking into account the nature of the client, to enable that client to take an informed decision with respect to the service in the context of which the conflict of interest arises.
3. (3) This rule does not apply to the extent that SYSC 10.1.21 R applies.

[Note: article 18(2) of MiFID and Article 22(4) of MiFID implementing Directive]

SYSC 10.1.8A

See Notes

SYSC 10.1.9

See Notes

Firms should aim to identify and manage the conflicts of interest arising in relation to their various business lines and their group's activities under a comprehensive conflicts of interest policy. In particular, the disclosure of conflicts of interest by a firm should not exempt it from the obligation to maintain and operate the effective organisational and administrative arrangements under SYSC 10.1.7 R. While disclosure of specific conflicts of interest is required by SYSC 10.1.8 R, an over-reliance on disclosure without adequate consideration as to how conflicts may appropriately be managed is not permitted.

[Note: recital 27 of MiFID implementing Directive]

SYSC 10.1.10

See Notes

SYSC 10.1.11

See Notes

SYSC 10.1.11B

See Notes

SYSC 10.1.12

See Notes

In drawing up a conflicts of interest policy which identifies circumstances which constitute or may give rise to a conflict of interest, a firm should pay special attention to the activities of investment research and advice, proprietary trading, portfolio management and corporate finance business, including underwriting or selling in an offering of securities and advising on mergers and acquisitions. In particular, such special attention is appropriate where the firm or a person directly or indirectly linked by control to the firm performs a combination of two or more of those activities.

[Note: recital 26 of MiFID implementing Directive]

SYSC 10.2

SYSC 10.2.1

See Notes

SYSC 10.2.2

See Notes

1. (1) When a firm establishes and maintains a Chinese wall (that is, an arrangement that requires information held by a person in the course of carrying on one part of the business to be withheld from, or not to be used for, persons with or for whom it acts in the course of carrying on another part of its business) it may:
1. (a) withhold or not use the information held; and
2. (b) for that purpose, permit persons employed in the first part of its business to withhold the information held from those employed in that other part of the business;
2. but only to the extent that the business of one of those parts involves the carrying on of regulated activities, ancillary activities or, in the case of MiFID business, the provision of ancillary services.
3. (2) Information may also be withheld or not used by a firm when this is required by an established arrangement maintained between different parts of the business (of any kind) in the same group. This provision does not affect any requirement to transmit or use information that may arise apart from the rules in COBS.
4. (3) For the purpose of this rule, "maintains" includes taking reasonable steps to ensure that the arrangements remain effective and are adequately monitored, and must be interpreted accordingly.
5. (4) For the purposes of section 118A(5)(a) of the Act, behaviour conforming with paragraph (1) does not amount to market abuse.

SYSC 10.2.3

See Notes

SYSC 10.2.2 R is made under section 137P of the Act (Control of information rules). It has the following effect:

1. (1) acting in conformity with SYSC 10.2.2 R (1) provides a defence against proceedings brought under sections 89(2) and 90(1) of the Financial Services Act 2012 (Misleading statements and Misleading impressions) - see sections 89(3)(b) and 90(9)(c).
2. (2) behaviour in conformity with SYSC 10.2.2 R (1) does not amount to market abuse (see SYSC 10.2.2 R (4)); and
3. (3) acting in conformity with SYSC 10.2.2 R (1) provides a defence for a firm against FCA enforcement action, or an action for damages under section 138D of the Act, based on a breach of a relevant requirement to disclose or use this information.

SYSC 10.2.4

See Notes

SYSC 10.2.5

See Notes

SYSC 11.1

SYSC 11.1.1

See Notes

SYSC 11 applies to an insurer, unless it is:

1. (1) a non-directive friendly society; or
2. (2) a Swiss general insurer; or
3. (3) an EEA-deposit insurer; or
4. (4) an incoming EEA firm; or
5. (5) an incoming Treaty firm.

SYSC 11.1.6

See Notes

If a firm carries on:

1. (1) long-term insurance business; and
2. (2) general insurance business;

SYSC 11 applies separately to each type of business.

SYSC 11.1.7

See Notes

The purpose of SYSC 11 is to amplify GENPRU and SYSC in their specific application to liquidity risk and, in so doing, to indicate minimum standards for systems and controls in respect of that risk.

SYSC 11.1.8

See Notes

Appropriate systems and controls for the management of liquidity risk will vary with the scale, nature and complexity of the firm's activities. Most of the material in SYSC 11 is, therefore, guidance. SYSC 11 lays out some of the main issues that the PRA expects a firm to consider in relation to liquidity risk. A firm should assess the appropriateness of any particular item of guidance in the light of the scale, nature and complexity of its activities as well as its obligations to organise and control its affairs responsibly and effectively.

SYSC 11.1.9

See Notes

SYSC 11 addresses the need to have appropriate systems and controls to deal both with liquidity management issues under normal market conditions, and with stressed or extreme situations resulting from either general market turbulence or firm-specific difficulties.

SYSC 11.1.13

See Notes

An insurer is also required to comply with the requirements in relation to liquidity risk set out in INSPRU 4.1.

SYSC 11.1.17

See Notes

High level requirements in relation to carrying out stress testing and scenario analysis are set out in GENPRU 1.2. In particular, GENPRU 1.2.42R requires a firm to carry out appropriate stress testing and scenario analysis. SYSC 11 gives guidance in relation to these tests in the case of liquidity risk.

SYSC 11.1.18

See Notes

The effect of GENPRU 1.2.30R, GENPRU 1.2.34R, GENPRU 1.2.37R(1) and GENPRU 1.2.42R is that, for the purposes of determining the adequacy of its overall financial resources, a firm must carry out appropriate stress testing and scenario analysis, including taking reasonable steps to identify an appropriate range of realistic adverse circumstances and events in which liquidity risk might occur or crystallise.

SYSC 11.1.19

See Notes

GENPRU 1.2.40G and GENPRU 1.2.62G to GENPRU 1.2.78G give guidance on stress testing and scenario analysis, including on how to choose appropriate scenarios, but the precise scenarios that a firm chooses to use will depend on the nature of its activities. For the purposes of testing liquidity risk, however, a firm should normally consider scenarios based on varying degrees of stress and both firm-specific and market-wide difficulties. In developing any scenario of extreme market-wide stress that may pose systemic risk, it may be appropriate for a firm to make assumptions about the likelihood and nature of central bank intervention.

SYSC 11.1.20

See Notes

A firm should review frequently the assumptions used in stress testing scenarios to gain assurance that they continue to be appropriate.

SYSC 11.1.21

See Notes

1. (1) A scenario analysis in relation to liquidity risk required under GENPRU 1.2.42R should include a cash-flow projection for each scenario tested, based on reasonable estimates of the impact (both on and off balance sheet) of that scenario on the firm's funding needs and sources.
2. (2) Contravention of (1) may be relied on as tending to establish contravention of GENPRU 1.2.42R.

SYSC 11.1.22

See Notes

In identifying the possible on and off balance sheet impact referred to in SYSC 11.1.21E (1), a firm may take into account:

1. (1) possible changes in the market's perception of the firm and the effects that this might have on the firm's access to the markets, including:
1. (a) (where the firm funds its holdings of assets in one currency with liabilities in another) access to foreign exchange markets, particularly in less frequently traded currencies;
2. (b) access to secured funding, including by way of repo transactions; and
3. (c) the extent to which the firm may rely on committed facilities made available to it;
2. (2) (if applicable) the possible effect of each scenario analysed on currencies whose exchange rates are currently pegged or fixed; and
3. (3) that:
1. (a) general market turbulence may trigger a substantial increase in the extent to which persons exercise rights against the firm under off balance sheet instruments to which the firm is party;
2. (b) access to OTC derivative and foreign exchange markets are sensitive to credit-ratings;
3. (c) the scenario may involve the triggering of early amortisation in asset securitisation transactions with which the firm has a connection; and
4. (d) its ability to securitise assets may be reduced.

SYSC 11.1.23

See Notes

GENPRU 1.2.26R states that a firm must at all times maintain overall financial resources adequate to ensure that there is no significant risk that its liabilities cannot be met as they fall due. GENPRU 1.2.42R(1)(b) provides that for the purposes of determining the adequacy of its overall financial resources, a firm must estimate the financial resources it would need in each of the circumstances and events considered in carrying out its stress testing and scenario analysis in order to, inter alia, meet its liabilities as they fall due.

SYSC 11.1.24

See Notes

1. (1) A firm should have an adequately documented contingency funding plan for taking action to ensure, so far as it can, that, in each of the scenarios analysed under GENPRU 1.2.42R(1)(b), it would still have sufficient liquid financial resources to meet liabilities as they fall due.
2. (2) The contingency funding plan should cover what events or circumstances will lead the firm to put into action any part of the plan.
3. (3) [deleted]
4. (4) A firm's contingency funding plan should, where relevant, take account of the impact of stressed market conditions on:
1. (a) the behaviour of any credit-sensitive liabilities it has; and
2. (b) its ability to securitise assets.
5. (5) A firm's contingency funding plan should contain administrative policies and procedures that will enable the firm to manage the plan's implementation effectively, including:
1. (a) the responsibilities of senior management;
2. (b) names and contact details of members of the team responsible for implementing the contingency funding plan;
3. (c) where, geographically, team members will be assigned;
4. (d) who within the team is responsible for contact with head office (if appropriate), analysts, investors, external auditors, press, significant client's, regulators, lawyers and others; and
5. (e) mechanisms that enable senior management and the governing body to receive management information that is both relevant and timely.
6. (6) Contravention of any of (1) to (5) may be relied upon as tending to establish contravention of GENPRU 1.2.30R(2)(c).

SYSC 11.1.25

See Notes

GENPRU 1.2.60R requires a firm to document its assessment of the adequacy of its liquidity financial resources, how it intends to deal with those risks, and details of the stress tests and scenario analyses carried out and the resulting financial resources estimated to be required. Accordingly, a firm should document both its stress testing and scenario analysis (see SYSC 11.1.18 G) and its contingency funding plan (see SYSC 11.1.23 G).

SYSC 12.1

SYSC 12.1.1

See Notes

Subject to SYSC 12.1.2 R to SYSC 12.1.4 R, this section applies to each of the following which is a member of a group:

SYSC 12.1.2

See Notes

Except as set out in SYSC 12.1.4 R, this section applies with respect to different types of group as follows:

SYSC 12.1.3

See Notes

This section does not apply to:

1. (1) an incoming EEA firm; or
2. (2) an incoming Treaty firm; or
3. (3) a UCITS qualifier; or
4. (4) an ICVC; or
5. (5) an incoming ECA provider acting as such.

SYSC 12.1.4

See Notes

SYSC 12.1.5

See Notes

For the purpose of this section, a group is defined in the Glossary, and includes the whole of a firm's group, including financial and non-financial undertakings. It also covers undertakings with other links to group members if their omission from the scope of group risk systems and controls would be misleading. The scope of the group systems and controls requirements may therefore differ from the scope of the quantitative requirements for groups.

SYSC 12.1.6

See Notes

The purpose of this chapter is to set out how the systems and control requirements imposed by SYSC (Senior Management Arrangements, Systems and Controls) apply where a firm is part of a group. If a firm is a member of a group, it should be able to assess the potential impact of risks arising from other parts of its group as well as from its own activities.

SYSC 12.1.7

See Notes

This section implements Articles 73(3) (Supervision on a consolidated basis of credit institutions) and 138 (Intra-group transactions with mixed activity holding companies) of the Banking Consolidation Directive, Article 9 of the Financial Groups Directive (Internal control mechanisms and risk management processes) and Article 8 of the Insurance Groups Directive (Intra-group transactions).

SYSC 12.1.8

See Notes

A firm must:

1. (1) have adequate, sound and appropriate risk management processes and internal control mechanisms for the purpose of assessing and managing its own exposure to group risk, including sound administrative and accounting procedures; and
2. (2) ensure that its group has adequate, sound and appropriate risk management processes and internal control mechanisms at the level of the group, including sound administrative and accounting procedures.

SYSC 12.1.9

See Notes

For the purposes of SYSC 12.1.8 R, the question of whether the risk management processes and internal control mechanisms are adequate, sound and appropriate should be judged in the light of the nature, scale and complexity of the group's business and of the risks that the group bears. Risk management processes must include the stress testing and scenario analysis required by GENPRU 1.2.42 R and GENPRU 1.2.49R (1)(b).

SYSC 12.1.10

See Notes

The internal control mechanisms referred to in SYSC 12.1.8 R must include: