Using technology to manage regulatory change

In a nutshell, RegTech is really the technology that can provide real-time management information on the governance risk and compliance areas that relate to firms. This data helps them to make sure they're jumping through the regulatory hoops in the right way.

In essence, it's really all about moving from the position of ‘do we think this is true?’ to ‘do we know this is true?’. It's using technology to assess firms’ ongoing performance against the regulations. This is against a background where the FCA is really focused on conduct and competence, behaviour and skill sets, particularly with the Senior Managers and Certification Regime (SMCR) and accountability and so forth. It’s moving the compliance mantra from ‘if it’s not written down it didn’t happen’ to ‘If you haven’t got the data it didn’t happen’.

Historically, the way compliance has been conducted has mainly been paper-driven – now excel spreadsheet-driven – where firms have used disparate resources to assess how they're doing against the regulations. This has resulted in very manual processes on audits, for example.

What Model Office do is we streamline and make the audit programme more effective and efficient. We allow firms to self-assess where they believe they are against all the rules and regulations. Our AI-driven algorithms then kick in and show where they actually are against the rules. We then provide heat map dashboards, action tracking, action planning, compliance calendar alerts, etc., that effectively showcase where the firm is, where they need to be and what actions they need to take. RegTech, certainly in the compliance-governance-risk world, can help firms identify where they need to get to and what they need to do to get there in a much more effective and efficient way.

In terms of resilience, the FCA has been focused on three areas:

1. Financial resilience – the regulator has now sent out six questionnaires on this but they should have most of this data already through RMAR reporting. Model Office are working with the FCA at the moment and so we are planning to talk to them about using their data resources in a far more effective and efficient way.
2. Operational resilience – for the larger (enhanced SMCR) firms, new rules in relation to operational resilience are coming through at the end of March 2022. However, it's good practice for all firms to look at this area. For example, there’s identifying important business services – this could be your practice management service that empowers your CRM or your income reconciliation activities, for instance. You've also got the outsourcing requirements – outsourcing is good business practice but you need to ensure that all the accountabilities are in the right place because that blends into the SMCR. 
3. Cyber resilience – bizarrely, there are no regulations on this as it's just deemed good practice by the FCA. However, there are lots of things that firms can be doing on cyber resilience. One of the biggest questions is has cyber resilience insurance been set up? A lot of firms still haven't quite got there yet.

Other areas advisers should be looking at include the new Consumer Duty, which is the big change that's coming through. There’s also advice suitability in relation to a client’s ESG preferences, the treatment of vulnerable customers (which is tied into the Consumer Duty) and the financial promotions review for high-risk investments. All these new regulations are challenging for advice firms because they obviously have to manage their businesses and their clients too – this is where RegTech can help. 

This has been driven by the pandemic but also the financial crisis of 2008/09. In fact, accountability, responsibility and resilience have driven all the regulations over the last 10 years. This continues to be the case and the SMCR is a good example of this.

Obviously, if a firm’s operations, systems and controls aren’t working, then they will go out of business. Given the FCA is always really focused on consumer detriment and harm, it’s really interested in making sure firms know what their important business services are and what the due diligence process is on these. A good example here is wealth management committees – a great paper (TR 16.1) came out which covers research and due diligence around the wealth management committee and advice suitability. I highly recommend reading through this paper.

Firms really need to consider things like impact tolerances. If you think about operational resilience, it’s all about planning to fail, not planning to succeed. You've got to make sure you're actually working through what happens if you fail and making sure that's not going to happen. Gathering baseline data on that premise and how you do that is really important. So, making sure you've got great data, that it's high quality, up-to-date and in real time. Mapping dependencies and scenario testing, at least on an annual basis, and setting out ongoing governance standards is essential too. The final thing firms should do is to make sure they've got a self-assessment document, which is a living document that really details what I've just laid out above.

That’s a lot to think about but most of this is really good practice no matter if you're an enhanced SMCR firm or not. If you can apply this to your business, you’ll be ticking a lot of the boxes and you'll be in a really good space.

RegTech can help in many different areas, such as fraud and cyber resilience, anti-money laundering, know your customer, risk compliance management and stress testing.

The area Model Office is very involved in at the moment is regulatory levies and there’s a lot of pressure at the moment to make sure you have your finger on the pulse here. From that perspective, we have a very hard professional indemnity (PI) insurance market at the moment because only a few underwriters are left. So, we're working with three professional indemnity insurance underwriters and we’ve said to them ‘we've got all these firms on our system and the majority display really good risk management. We’ve told them we already ask a lot of the questions they would put to firms at renewals. From that perspective, we now have agreements in principle with underwriters that firms who are performing well on our system can potentially get more preferential renewal rates going forward. Because there’s the data – the evidence – that these firms are walking their talk on the regulatory risks.

RegTech, whatever a firm is using it for is, is essentially a third line of defence for the business from a systems and controls perspective. It helps to ensure you’re doing what you should be doing and if there are any weaknesses – which there will be – you can demonstrate you're taking proactive action because it's all evidenced on the system.

The new MiFID II legislation on assessing suitability, which is probably coming through around August or September this year, is all about clients’ sustainability preferences. The City Minister has said that he wants this legislation to be brought through into the UK. So, this means that firms will need to expand their advice suitability preference processes.

What we do at Model Office is we take a look at what a firm’s current activity is and the processes, systems and controls around assessing client suitability and sustainability preferences. The technology we use simply takes a look at where you currently are. The algorithm will then point out where you are doing well but also highlights the areas you might want to think about. This helps firms move towards the outcomes the FCA is seeking.

I think the big theme is outcomes-focused regulation. The vast majority of advisers are doing great work here anyway – it’s just making sure you can evidence this. That’s the key and bringing it all together through the Governance-Risk-Compliance umbrella – those are the three things that the FCA is very interested in.

The Consumer Duty is the big new piece of regulation. What we’re emphasising here is that firms really need to start to benchmark and consistently consider their customers’ needs at every stage of the product/service lifecycle. It's really all about how your value proposition works and the client’s journey through that programme/process – what systems and controls, policies and procedures have you got in place? Essentially, it's all about the client and those firms who have already got client-centric propositions are really well placed, but they will need to make tweaks or, at the very least, apply some form of RegTech or data analysis research tools so that they've got the data to prove that they're compliant. The other thing to mention is audit programmes. What RegTech can do is empower firms to self-assess, self-audit and self-benchmark. This allows firms to put pressure on their support services in order get more value out of the audit programme.

Obviously, firms are going to have to invest in the business and the technology in order to produce results down the line. There will be an upfront investment but we can show that there's demonstrable benefits. Indeed, over 18 months, firms begin to show they're beginning to reduce their compliance costs. We're not talking about replacing people here – it’s about enabling compliance officers and individuals to work more effectively and efficiently. There’s also the time and money spent on audits – we try to get firms into a far more favourable space from this side of things. So, there are lots of benefits that we can bring through, but it will take a bit of investment and time.

In terms of priorities, I think these should be:

1. Resilience – as discussed above, looking at the financial metrics within the business, cyber resilience, and operational resilience. 
2. The Consumer Duty – this is because pretty much everything will spin off the Consumer Duty. So, for example, vulnerable customers, ESG and suitability, the high-risk investment review and financial promotions, and so on.
3. Appointed Representatives (ARs) – as laid out in the FCA paper that came out earlier this year, Appointment Representatives are now under the scope as are their principal firms. This means firms need to be more accountable and take responsibility for what's going on within their business.

That's the theme really – accountability and responsibility and the process you have for evidence-based practice within your business. It’s all about ‘do we know this is true?’, not ‘do we think this is true?’. Where’s the evidence? That’s the key.