Chris Brennan follows on from his panel discussion at the Financial Services Regulation and Disputes Summit to explore the options for reforming investigations and enforcement
The closing panel of the recent Legal Business Financial Services Regulation and Disputes Summit was asked to discuss how they would approach the establishment of a new regulatory enforcement body. This article picks up on some of the themes discussed.
The idea behind the panel session was not (just) to pick holes in the models adopted by the current regulatory enforcement agencies. Rather, the intention was to draw out ideas for alternative models or approaches to enforcement. It is all too easy to accept the current approach as generally right on the basis that it has always been done that way. In reality, the approach to regulatory enforcement is constantly evolving, and new practices emerge, sometimes without a great deal of scrutiny or consultation. Those changes can have a significant impact on the fairness or efficiency of the process. It is therefore worth sitting back and taking a fresh look at why we need regulatory enforcement, what it should be seeking to achieve and how it should function.
The role and remit of enforcement – the why
This has been the topic of much discussion. The debate often centres around the question of whether, or to what extent, an agency is enforcement-led. In 2005, the chair of the Financial Services Authority (FSA) noted: ‘The FSA is not – and will not become – an enforcement-led regulator.’ By 2012, the chair of the Financial Conduct Authority (FCA) noted that this position ‘has changed’. It has never really been clear what it means to be an enforcement-led regulator, but the emphasis tends to change with the political winds of the time. To truly dissect the role of enforcement involves a jurisprudential debate around the various theories of crime and punishment, which is beyond the scope of this short article. At the most basic level it is clear that enforcement is necessary to deter wrongdoing, punish the wrongdoers and obtain redress for those affected. The situation becomes more complicated when enforcement is used to pursue public policy objectives or where it is deployed as a substitute for rulemaking. That is not to say that either purpose cannot be a natural by-product of enforcement, but it should not be the central rationale. The particular problem with trying to set standards through enforcement outcomes is that settled cases tend to make for bad law. While the English common law system of defining standards and duties through case law has proven very successful, it is based on a robust judicial process, something which rarely comes into play in regulatory enforcement outcomes.
The problem with losing sight of the role of enforcement is that it is all too easy for regulatory action to become an objective in itself. The temptation being to measure the success or failure of an enforcement function simply by reference to the amount of financial penalties or conviction rates. It is hard to conceive of any benefits from setting expectations or targets around the number or type of disciplinary outcomes. The pressure to compete with enforcement agencies in the US has led to huge fine inflation, but there is very little evidence of its impact on behaviours. Similarly, placing pressure on enforcement to perform at a certain level, whether through comparisons with prior years or otherwise, risks creating an unnecessarily litigious, win-at-all-costs mentality. Increasing fines and taking an aggressive approach to enforcement can force those under investigation to adopt a correspondingly combative stance and thereby make achieving the right outcomes more difficult.
‘The pressure to compete with enforcement agencies in the US has led to huge fine inflation, but there is little evidence of its impact on behaviours.’
The vast majority of regulated businesses will be quick to accept where mistakes have been made and will want to work with a regulator to agree an appropriate penalty, redress arrangements or other outcome. In these cases, enforcement should be there to respond to events in a neutral, measured manner and with the objective of seeking to achieve the right regulatory outcome through a fair and transparent process. A more aggressive approach may well be necessary in cases of more egregious, deliberate or criminal conduct, but for many cases it is simply not appropriate and can prove counterproductive.
Case selection – the what
In an ideal world, a regulatory enforcement agency would identify and address every instance of serious misconduct. Even with limitless resources, such a goal is obviously unrealistic. Choices therefore need to be made about what to investigate and what to prosecute. It is important not to lose sight of the fact that these are two very distinct decisions.
The question of what to investigate is perhaps the most challenging as it is necessarily and heavily constrained by the available resource. The problem with setting the bar too low is that resources get stretched too thinly and everything is investigated badly. Set the bar too high and wrongdoing will go unpunished. Following the Green Review, the FCA abandoned its reference to the prospects of a successful outcome to an investigation as the main factor in deciding what to investigate. Clearly, the predicted outcome of an investigation cannot be used as the sole determining factor. It would be ridiculous to only investigate cases where it was clear that sufficient evidence of misconduct was likely to be obtained – in most cases it simply is not possible to make such a prediction. However, the prospects for an investigation cannot be entirely disregarded. Blindly investigating everything without regard to whether it is likely to result in evidence of misconduct is futile. One alternative approach would to be adopt a variant on the classic risk model of probability vs impact scoring. This could involve assessing both the accessibility/availability of evidence and the seriousness of the alleged misconduct. For example, a case that scores four (out of five) on availability of evidence and two on the seriousness of misconduct would be treated the same as a case where the availability of evidence was more doubtful (a score of two), but the allegation was more serious (a score of four). This could be further overlaid with a public-interest test – something which feels like a significant omission from the current selection process.
Whatever threshold is applied in deciding whether to open an investigation, the prospects of success have to be continually assessed to determine whether that investigation should continue. The problem with some existing enforcement agencies is that the decision to close an investigation gets deferred for too long, presumably in the hope that something will turn up if they keep looking long and hard enough.
A low threshold for opening investigations is particularly problematic for individuals. The mere fact of an investigation can cast a long shadow over a person’s career regardless of the outcome. It can also be a hugely traumatic process, which restricts a person’s ability to continue to earn a living until the matter is resolved. These problems are compounded where an agency takes too long to progress investigations to closure. This reinforces the need for care when selecting which cases to investigate and making sure that investigations are closed as soon it is appropriate to do so. The current approach of some regulators, particularly the FCA and Serious Fraud Office (SFO), often fails to deliver on either of these essential elements of the process for individuals.
‘The focus should never be on the outcome alone. An agency that converts 100% of investigations into disciplinary outcomes is not desirable.’
The decision as to which cases to prosecute should be more straightforward. If an investigation reveals evidence of serious misconduct, the regulator has to seek an appropriate outcome (whether that is a fine, redress or both). Criminal cases have to satisfy the tests in the Code for Crown Prosecutors, which is a well-trodden path for most existing agencies. There will of course be cases where the evidence or the relevant law is such that the prospects of achieving a successful outcome may be in doubt. The risk here is that regulators will not tackle difficult cases for fear of the damage to their reputation. The situation would no doubt be helped if regulators were subject to less political interference or if there was less reliance on results in measuring performance. The focus should never be on the outcome (win or lose) alone. An enforcement agency that converts 100% of its investigations into disciplinary outcomes is certainly not desirable.
The approach to investigations and enforcement – the how
If an enforcement agency is to be effective, it must have broad powers to obtain information. The scope of these powers has been defined for many years and appears to work well. The problem with managing an investigation is often not the availability of powers but the availability of people to use them, which can lead to significant delays. The problem with delaying the progress of investigations is that a fair outcome becomes much more difficult to achieve. Some agencies address this problem by outsourcing aspects of their work. The FCA’s predecessors often used professional services firms (both lawyers and accountants) to assist with investigations. The SFO have also called on external support on its cases. The closest the FCA comes to outsourcing its investigation is through a reliance on skilled person reports in support of enforcement cases.
Although it is not without some practical difficulties, there is no reason in principal why an agency should not look to external support for investigations. Clearly, a wholesale outsourcing process is never likely to be appropriate, but there are other models that could be adopted. For example, where a regulator needs to review a large volume of material, it might be expedient to call on one of the many legal process outsourcers. Similarly, there are many flexible legal service providers that a regulator could call upon to deal with the inevitable fluctuations in the volume of work. There is also no reason why the costs of such additional resources could not be recovered from the subject of the investigation in cases where misconduct is proven. Provided that appropriate safeguards are put in place, the positive impact on the pace of investigations is likely to far outweigh any risks.
‘The FCA is conducting more investigations than ever, with no additional headcount. Not surprisingly, this is having an impact on the pace at which investigations are proceeding.’
The process for challenging regulatory decisions and outcomes will vary according to the powers being used. Criminal cases will go into the criminal justice process. Civil cases tend to follow a pattern of internal, administrative decision making, which can then be challenged through a judicial process. It is hard to see how this could be changed in any meaningful way. The FCA decision-making process generally works quite well. Although the internal review process though the Regulatory Decisions Committee (RDC) is fit for purpose, it does not allow for any testing of the evidence or resolution of factual disputes; the only recourse for such challenges is to the Upper Tribunal. The recent changes to the FCA process, which allow for challenging specific aspects of a case without losing the settlement discount and the ability to leapfrog the RDC, are both welcome changes.
Conclusion
It was clear from the panel discussion, as hopefully reflected in the points discussed here, that there is always room for improvement in the way regulators go about the business of enforcement. If that is correct, then regulators should be encouraged to conduct periodic reviews of the effectiveness and efficiency of their enforcement process. The FCA does ask for feedback from those who go through the enforcement process, but sometimes a more substantive review is required. For example, the recent change to the enforcement threshold at the FCA is something that clearly requires some further reflection. The statistics show that the FCA is conducting more investigations than at any point in its history, with no additional headcount. It is becoming clear that, not surprisingly, this is having an impact on the pace at which investigations are proceeding. That requires some form of response, whether that be a change to the threshold, an increase in resources or a more efficient process. Whatever the solution is, something clearly needs to be done to balance the books. It seems likely the FCA will not be the only regulator taking a close look at its enforcement process in 2019.
Chris Brennan (pictured centre), White & Case.
