Charles Anthony Llewellen Palmer v The Financial Conduct Authority: [2017] UKUT 0313 (TCC) [2017] UKUT 0313 (TCC)

UPPER TRIBUNAL
TAX AND CHANCERY CHAMBER
[2017] UKUT 0313 (TCC)
Charles Anthony Llewellen PalmerAppellantThe Financial Conduct AuthorityRespondent
Judge Timothy Herrington Nicholas Douch Gary BottriellGuy Philipps, QC (instructed by Norton Rose Fulbright, Solicitors) for ApplicantJavan Herberg QC and Simon Pritchard, Counsel (instructed by the Financial Conduct Authority) for AuthorityDate 8 August 2017Category: Financial services
[1]This decision concerns a reference by Mr Charles Palmer (“5 Mr Palmer”) of the decision of the Authority set out in a decision notice dated 25 September 2015 (the “Decision Notice”) to impose a financial penalty of £86,691 on Mr Palmer pursuant to s 66 of the Financial Services and Markets Act 2000 (“FSMA”) and the further decision to make an order prohibiting Mr Palmer from performing any significant 10 influence function in relation to any regulated activity carried on by an authorised person, exempt person, or exempt professional firm, pursuant to s 56 FSMA.[2]The matters which are the subject of this reference relate to the conduct of Mr Palmer in his capacity as a holder of the CF 1 (Director) controlled function at each of Financial Limited (“Financial”) and Investments Limited (“Investments”) (together 15 “the Firms”). The Firms are both subsidiaries of Standard Financial Group Limited (the “Group”). The holding company did not trade but the Firms together formed an adviser network of financial adviser firms each of which was an appointed representative of one of the Firms with the result that the Firms were responsible for the acts and omissions of those firms in relation to compliance with the Authority’s 20 regulatory requirements.[3]The Authority contends that during the period 24 February 2010 to 20 December 2012 (the “Relevant Period”) Mr Palmer, who was the majority shareholder and Chief Executive of the Group and a director of each of the Firms, and, the Authority contends, the de facto Chief Executive and primary controlling influence of each of 25 the Firms, breached Statement of Principle 6 in carrying out his controlled function at the Firms by failing to exercise due skill, care and diligence in managing the business of the Firms for which he was responsible in his controlled function.[4]The essence of the Authority’s case against Mr Palmer, as summarised in the Decision Notice and in the Authority’s submissions on this reference is that Mr 30 Palmer failed to take adequate steps to ensure that:(1) the risks in respect of the customers of the appointed representatives of the Firms (“underlying customers”) which arose from the business model of the Firms which Mr Palmer had developed were being effectively managed by the Firms; 35(2) the Firms put in place an appropriate control framework and an appropriate risk management framework to control or mitigate adequately the material risks to underlying customers arising from the Firms’ business model;(3) he and the Board of the Firms received sufficient, relevant and reliable 40 information and valid assurance that the controls and mitigating measures in place were effectively controlling or mitigating the risks. 3[5]Accordingly, the Authority contends that Mr Palmer failed to respond with due skill, care and diligence to the risk that the Firms’ processes and controls in respect of appointed representatives and their individual advisers were not fit for purpose and would negatively impact the fair treatment of underlying customers.[6]Mr Palmer contends that he was not personally culpable for the 5 failings that have been identified by the Authority in relation to the systems and controls of the Firms. These failings have resulted in the Firms being disciplined by the Authority for failing to establish, implement and maintain effective systems and controls sufficient to ensure that the Firms’ appointed representatives and their advisers met applicable 10 requirements and standards under the regulatory system.[7]Mr Palmer contends that the control failures were the regulatory responsibility of Mr Stephen Bell (“Mr Bell”), who was responsible for compliance systems and controls at the Firms and who was also disciplined by the Authority for his failings in that regard, and responsibility for the management of customer risks and reporting to 15 the Board of the Firms was the responsibility of Ms Paivi Grigg (“Ms Grigg”), the risk management director of the Firms, who has also been disciplined by the Authority for her failings in that role.[8]Mr Palmer also contends that the Board of the Firms as a whole had responsibility for the monitoring of the performance of these executives rather than him personally 20 and Mr Palmer himself could not be responsible if there were failures on the part of Mr Bell and Ms Grigg to keep the Board properly informed as to any failings in the way that the systems and controls were operating.[9]Mr Palmer contends that the burden is on the Authority to demonstrate that he has failed to exercise due skill, care and diligence in relation to the matters for which he 25 was personally responsible in carrying out his duties as a director of the Firms. In his contention, the Authority has simply relied on a number of cherry-picked incidents in an attempt to demonstrate that Mr Palmer set an inappropriate tone and culture at the Firms. These matters fail to satisfy the burden placed upon the Authority. Applicable legal and regulatory provisions 30 General[10]The Authority’s regulatory objectives are set out in s 1B FSMA and include securing an appropriate degree of protection for consumers and protecting and enhancing the integrity of the UK financial system (and, specifically, ensuring that it is not being used for the purposes of financial crime). 35 Provisions relating to Approved Persons[11]Pursuant to s 64 FSMA, the Authority has issued a number of Statements of Principle that are contained within the part of its Handbook entitled Statements of Principle and Code of Practice for Approved Persons (“APER”). APER sets out the fundamental obligations of approved persons and describes conduct, which in the 40 opinion of the Authority, does not comply with the relevant Statement of Principle. 4[12]The only Statement of Principle relevant to this reference is Statement of Principle 6 which provides that an approved person performing a significant influence function must exercise due skill, care and diligence in managing the business of the firm for which he is responsible in his controlled function.[13]At the relevant time APER 3.1.3G provided that, when establishing 5 compliance with, or a breach of, a Statement of Principle, account will be taken of the context in which a course of conduct was undertaken, including the precise circumstances of the individual case, the characteristics of a particular controlled function and the behaviour expected in that function. 10 14. At the relevant time APER 3.3.1E stated that in determining whether or not the conduct of an approved person performing a significant influence function complies with Statements of Principles 5 to 7, the following are factors which, in the opinion of the Authority, are to be taken into account: 15(1) whether he exercised reasonable care when considering the information available to him;(2) whether he reached a reasonable conclusion which he acted on; 20(3) the nature, scale and complexity of the firm’s business;(4) his role and responsibility as an approved person performing a significant influence function; and 25(5) the knowledge he had, or should have had, of regulatory concerns, if any, arising in the business under his control.[15]At the relevant time APER 4.6 set out examples of behaviours which the 30 Authority considers do not comply with Statement of Principle 6, including:(1) failing to take reasonable steps to adequately inform himself about the affairs of the business for which he is responsible (APER 4.6.3E);(2) delegating the authority for dealing with a part of the business to an individual without reasonable grounds for believing that the delegate had the 35 necessary capacity, competence, knowledge or skills to deal with the part of the business (APER 4.6.5E);(3) failing to take reasonable steps to maintain an appropriate level of understanding about a part of a business that he has delegated to an individual (APER 4.6.6E); and 5(4) failing to supervise and monitor adequately the individual to whom responsibility for dealing with a part of the business has been delegated (APER 4.6.8E).[16]At the relevant time APER 4.6.10G provided that in determining whether or not the conduct of an approved person performing a significant 5 influence function complies with Statement of Principle 6 the competence, knowledge or seniority of the delegate and past performance and record of the delegate are to be taken into account.[17]At the relevant time APER 4.6.14G provided that it is the responsibility of the person delegating authority for dealing with a part of the business to ensure that he 10 receives reports on progress and questions those reports where appropriate.[18]The section of the Authority's Handbook entitled FIT sets out the fit and proper test for approved persons. FIT 1.3 provides that the Authority will have regard to a number of factors when assessing the fitness and propriety of a person. The most important considerations will be the person's honesty, integrity and reputation, 15 competence and capability, and financial soundness. Appointed representatives[19]The Firms operated what was commonly known as a “network” of separate independently owned entities each of which had their own customer base and acted as financial advisers to those customers. It is therefore helpful at this point to make 20 reference to the regulatory provisions and relevant guidance which were relevant to firms operating with such a business model, as they were in force during the Relevant Period.[20]Whilst each of the Firms was authorised by the Authority to conduct investment business, they did not conduct business with customers directly but accepted 25 responsibility for business carried on by the adviser firms by virtue of individual agreements entered into by the Firms with the adviser firms which complied with the requirements of s 39 FSMA.[21]Section 39 FSMA so far as relevant provides:
“(1) If a person (other than an authorised person) – 30 (a) is a party to a contract with an authorised person (“his principal”) which- (i) permits or requires him to carry on business of a prescribed description, and (ii) complies with such requirements as may be prescribed, and 35 (b) is someone for whose activities in carrying on the whole or part of that business his principal has accepted responsibility in writing, he is exempt from the general prohibition in relation to any regulated activity comprised in carrying on that business for which his principal has accepted responsibility. 6 (2) in this Act “appointed representative” means – (a) a person who is exempt as a result of subsection (1), or …. (3) The principal of an appointed representative is responsible, to the same extent as if he had expressly permitted it, for anything 5 done or omitted by the representative in carrying on the business for which he has accepted responsibility. (4) in determining whether an authorised person has complied with- (a) a provision contained in or made under this Act, or 10 … anything which a relevant person has done or omitted as respects business for which the authorised person has accepted responsibility is to be treated as having been done or omitted by the authorised person. (5) “Relevant person” means a person who at the material time is or was an 15 appointed representative by virtue of being a party to a contract with the authorised person.”
[22]Therefore, s 39 relieves a firm carrying on investment business from the need to obtain its own authorisation from the Authority if it became an “appointed 20 representative” of a firm which had such authorisation.[23]Pursuant to the powers contained in s 39 (1) (a) FSMA, HM Treasury has in the Financial Services and Markets Act 2000 (Appointed Representatives) Regulations 2001 (as amended), prescribed the types of business which an appointed representative may carry on without his own authorisation pursuant to an appointed 25 representative agreement. Insofar as is relevant to this case, the business prescribed includes dealing in investments as agent, arranging deals and investments and giving investment advice. These regulations also contain prescribed requirements applying to the content of the appointed representative agreement, including a requirement that the contract contains a provision enabling the firm to prohibit the appointed 30 representative acting for other principals.[24]The effect of s 39 (1) is that the appointed representative can only lawfully carry on investment business as an exempt person to the extent that the business concerned fell within the scope of the appointed representative agreement entered into with his principal, the authorised person and the restrictions contained in the regulations 35 mentioned at [23] above.[25]As far as the principal is concerned, the effect of s 39 (3) to (5) is that as between the principal and the appointed representative’s customers, and as regards compliance with the Authority’s regulatory requirements, the principal is liable for the acts and omissions of the appointed representative in carrying on investment business with 40 those customers which falls within the scope of the appointed representative agreement, as if the principal had carried out the business himself. 7[26]In addition, the Authority has through its regulatory requirements imposed responsibility on a firm which is a principal of an appointed representative for the acts and omissions of the appointed representative. As is clear from paragraph 12.1.3 of the Authority’s Supervision Manual (SUP), the main purpose of the Authority’s rules and guidance in this area is to place responsibility on the principal 5 firm for seeking to ensure that its appointed representatives are fit and proper to deal with customers in its name and to ensure that customers dealing with its appointed representatives are afforded the same level of protection as if they had dealt with the principal firm itself.[27]In particular, the effect of SUP 12.3.1G and 12.3.2G is that the act or omission of 10 an appointed representative, in respect of the business for which the principal has accepted responsibility, is treated as the act or omission of the principal itself. As the Authority observed in this case, regardless of the supplementary commercial arrangements that may exist between the principal firm and the appointed representative, the principal has full regulatory responsibility (including for any 15 liabilities that might arise) for ensuring that the appointed representative complies with the Authority’s rules: a breach by the appointed representative is regarded as a breach by the principal firm.[28]SUP 12.2.6G contains a definition of a “network”. A firm is a network if it appoints five or more appointed representatives or if it appoints fewer than five 20 appointed representatives which have between them twenty-six or more representatives, that is individual employees who deal with customers on behalf of the appointed representative.[29]A firm which is a network will be required to maintain systems and controls which meet the requirements of that part of the Authority’s Handbook known as 25 SYSC.[30]In particular, SYSC 3.1.1R provides that a firm must take reasonable care to establish and maintain such systems and controls as are appropriate to its business. SYSC 3.1.2(1) provides that the nature and extent of the systems and controls which a firm will need to maintain will depend, inter-alia, upon the nature, scale and 30 complexity of its business and the degree of risk associated with each area of its operation. SYSC 3.1.2(2) provides that in order to comply with this obligation a firm should carry out a regular review of its systems and controls.[31]SYSC 3.2 covers the main issues which a firm is expected to consider in establishing and maintaining its systems and controls. In particular, it is stated that 35 depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have separate compliance, risk assessment and internal audit functions, as well as an audit committee. At the relevant time SYSC 3.2.11G provided that there must be arrangements to furnish a firm’s governing body with information it needed to play its part in identifying, measuring, managing and controlling risks of regulatory 40 concern, including those risks which related to the fair treatment of the firm’s customers. 8[32]SYSC 3.1.4G states that a firm has specific responsibilities regarding its appointed representatives, as set out in SUP 12. In relation to systems and controls, SUP 12.6.7G provides that the activities of appointed representatives are an integral part of the business that they manage and that the responsibility for the control and monitoring of the activities of appointed representatives rests 5 with the senior management of the firm. Consequently, responsibility for the establishment and maintenance of appropriate systems and controls relating to the conduct of the business of the appointed representatives for which the principal firm has accepted responsibility lies with the principal firm. 10 33. This is reinforced by the provisions of SUP 12.4.2G which requires a firm, before it appoints a person as an appointed representative, and on a continuing basis, to establish on reasonable grounds that the appointed representative is suitable to act for the firm in that capacity. This provision also requires the firm to establish on reasonable grounds that it has adequate controls over the appointed representative’s 15 regulated activities for which the firm has responsibility and adequate resources to monitor and enforce compliance by the appointed representative with the relevant regulatory requirements applying to the regulated activities for which the firm is responsible.[34]SUP 12.4.4G provides that in assessing whether an appointed representative is 20 suitable to act for the firm in that capacity, the firm should consider whether the appointed representative is fit and proper, according to guidance set out in SUP 12, and the fitness and propriety (including the character and competence) and financial standing of those who control and manage the appointed representative.[35]SUP 12.6.8G and 12.6.9G remind firms that certain individuals employed by an 25 appointed representative who exercise governing functions or who have customer facing functions require approval under the approved persons regime.[36]There are also obligations in SUP for a firm to notify the Authority of the appointment and termination of the appointment of appointed representatives. SUP 12.6 provides that if at any time a firm has reasonable grounds to believe that an 30 appointed representative is no longer suitable it must take immediate steps to rectify the matter or terminate its contract with the appointed representative.[37]In December 2005, the Authority issued a fact sheet reminding the senior management of firms that the activities of its appointed representatives are an integral part of the business they manage and the responsibility for the control and monitoring 35 of the activities of appointed representatives rests with them, with the consequence that senior management should take reasonable care to establish and maintain effective systems and controls to demonstrate that their appointed representatives are complying with applicable requirements and standards under the regulatory system.[38]This fact sheet identified a number of risks that were particular to networks on 40 which the Authority expressed its views as follows: 9(1) the assurance of “a lighter touch” supervision to generate interest from prospective appointed representatives to join their network which may expose customers to a variety of potential risks; such firms needed to ensure the standards they apply were at least equal to the minimum standards required by the 5 regulatory regime;(2) where principals have developed IT systems to provide remote supervision and training and competence programmes, there may be weaknesses in the systems and it may be therefore appropriate to assess the effectiveness of any remote monitoring programme in conjunction 10 with other controls in place which might include face-to-face supervisory visits to ensure material risks are capable of being identified and addressed;(3) in relation to file reviews, principals who merely check whether core documents have been issued to the customer and ensure all relevant 15 documents are held on the client file should assess whether this approach is sufficient to demonstrate compliance with the Authority’s rules. Principals may wish to consider whether reasonable steps are taken to assess whether the content of core documents complies with the Authority’s rules, have been issued at the correct time, and that the advice 20 provided can be assessed as suitable. Staff carrying out file reviews, whether in a desk-based capacity or field-based role, should receive appropriate ongoing training. This is to maintain competence and to ensure the supervisory approach is applied in a consistent manner;(4) principals should have effective procedures in place for monitoring 25 and approving financial promotions and should bear in mind how they can demonstrate that their documented procedures are being followed in practice. Principals may wish to consider the risk of an appointed representative issuing a financial promotion without submitting it to the principal for prior approval. 30 Treating customers fairly[39]As mentioned above, the essence of the Authority’s case against Mr Palmer is that he failed to take adequate steps to ensure that customer risk was being effectively managed. In particular, the Authority is concerned that the risk of customers not being treated fairly was not being adequately addressed. 35 40. The obligation to treat customers fairly is at the heart of the Authority’s regulatory requirements. Principle 6 of the Authority’s Principles for Businesses provides:
“A firm must pay due regard to the interests of its customers and treat them fairly.”
[41]The Authority has identified six outcomes that firms should strive to achieve to ensure fair treatment of customers which the Authority regards as core to what it 40 expects of firms as follows: 10 Outcome 1: Consumers can be confident they are dealing with firms where the fair treatment of customers is central to the corporate culture. Outcome 2: Products and services marketed and sold in the retail market are designed to meet the needs of identified consumer groups and are targeted accordingly. Outcome 3: Consumers are provided with clear information 5 and are kept appropriately informed before, during and after the point of sale. Outcome 4: Where consumers receive advice, the advice is suitable and takes account of their circumstances. Outcome 5: Consumers are provided with products that perform as firms have led 10 them to expect, and the associated service is of an acceptable standard and as they have been led to expect. Outcome 6: Consumers do not face unreasonable post-sale barriers imposed by firms to change product, switch provider, submit a claim or make a complaint. Prohibition 15 42. Section 56 FSMA confers upon the Authority the power to make a prohibition order against an individual prohibiting that individual from performing a specified function, any function falling within a specified description, or any function, if it appears to the Authority that the individual is not a fit and proper person to perform functions in relation to a regulated activity by an authorised person. 20 Financial penalty[43]Section 66 FSMA provides that the Authority may take action to impose a penalty on an individual of such amount as it considers appropriate where it appears to the Authority that the individual is guilty of misconduct and it is satisfied that it is appropriate in all the circumstances to take action. 25 44. Misconduct includes failure, while an approved person, to comply with a Statement of Principle issued under s 64 FSMA.[45]In exercising its power to impose a financial penalty, the Authority must have regard to relevant provisions in the Authority’s Handbook of rules and guidance. The Authority’s policy in relation to the imposition of financial penalties is set out in 30 chapter 6 of the section of the Handbook entitled DEPP. We refer to these provisions later at [264] below when considering the question of the imposition of a financial penalty in this case. Issues to be determined and the role of the Tribunal[46]Section 133(4) FSMA provides that, on a reference, the Tribunal may consider 35 any evidence relating to the subject matter of the reference whether or not it was available to the decision-maker at the material time. This is not an appeal against the 11 Authority’s decision but a complete rehearing of the issues which give rise to the decision.[47]Section 133(5) to (7) FSMA, following amendments made by the Financial Services Act 2012, now provide as follows:
“(5) In the case of a disciplinary reference or a reference 5 under section 393(11), the Tribunal must determine what (if any) is the appropriate action for the decision-maker to take in relation to the matter, and on determining the reference, must remit the matter to the decision-maker with such directions (if any) as the Tribunal considers appropriate for giving effect to its determination. 10 (6) In any other case, the Tribunal must determine the reference or appeal by either- (a) dismissing it; or (b) remitting the matter to the decision-maker with a direction to reconsider and reach a decision in accordance with findings of the 15 Tribunal. (6A) The findings mentioned in subsection (6) (b) are limited to findings as to- (a) issues of fact or law; (b) the matters to be, or not to be, taken into account in making the decision; and 20 (c) the procedural or other steps to be taken in connection with the making of the decision. (7) The decision-maker must act in accordance with the determination of, and any direction given by, the Tribunal.”
[48]“The decision-maker” in relation to this reference is the Authority. 25 49. It can be seen that there is now a distinction between the powers of the Tribunal on what is described as a “disciplinary reference” and other references. Pursuant to s 133(7A) FSMA “disciplinary reference” includes a decision to take action under s 66 FSMA, that is to impose a financial penalty on an approved person. The term does not include a reference to impose a prohibition order under s 56. Thus, this reference is 30 effectively sub-divided. Mr Palmer’s reference of the decision to impose a financial penalty is a “disciplinary reference” and accordingly, as was the case in relation to all references made before 1 April 2013, the Tribunal has power to determine at its discretion what (if any) is the appropriate action for the Authority to take. In relation to Mr Palmer’s reference of the Authority’s decision to impose a prohibition order, 35 which we shall refer to as the “non-disciplinary reference”, the powers of the Tribunal as set out in s 133(6) are more limited. The jurisdiction may now be characterised as a supervisory rather than a full jurisdiction; in that unless the Tribunal believes the reference to have no merit and therefore dismisses it its powers are limited to 12 remitting the matter to the Authority with a direction to reconsider its decision in accordance with the findings of the Tribunal.[50]The Tribunal explained the extent of its powers on a non-disciplinary reference in Carrimjee v FCA [2016] UKUT 0447 (TCC) at [39] and [40] as follows:
“39. If, having reviewed all the evidence and the factors taken 5 into account by the Authority in making its decision, and having made findings of fact in relation to that evidence and such other findings of law that are relevant, the Tribunal concludes that the decision to prohibit is one that is reasonably open to the Authority then the correct course is to dismiss the reference. 10 40. Alternatively, if the Tribunal is not satisfied that in the light of its findings that the decision is one that in all the circumstances is within the range of reasonable decisions open to the Authority, the correct course is to remit the matter with a direction to reconsider the decision in the light of those findings. For example, that course would also be necessary were the Tribunal to make 15 findings of fact that were clearly at variance with the findings made by the Authority and which formed the basis of its decision. That course would also be necessary had there been a change of circumstance regarding the applicant which indicated that the original findings made on which the decision was based, for example as to his competence to undertake particular activities, had been 20 overtaken by further developments, such as new evidence which clearly demonstrated the applicant’s proficiency in relation to the relevant matters. Such a course would not usurp the Authority’s role in making the overall assessment as to fitness and propriety but would ensure that it reconsidered its decision on a fully informed basis. In our view such a course is consistent with the policy 25 referred to at [31] and [32] above as it leaves it to the Authority to make a judgment as to whether a prohibition order is appropriate.”
[51]A relevant example of how the powers may be exercised appears from the Tribunal’s decision in Bayliss & Co (Financial Services) Ltd and Clive John Rosier v FCA [2015] UKUT 0265 (TCC). In that case, one of the issues referred to the 30 Tribunal was whether it was appropriate to prohibit Mr Rosier from performing significant influence functions in the light of a number of significant findings that the Tribunal had made regarding Mr Rosier’s failure to take reasonable steps to ensure, as sole director of his regulated firm, that the firm complied with the relevant regulatory standards. The Tribunal had to consider whether the findings that the Tribunal made 35 in that regard merited the question of the prohibition order being remitted to the Authority for further consideration. The Tribunal considered whether in the course of the hearing Mr Rosier had demonstrated that he had learned any lessons from the matters which were the subject of the reference. The Tribunal said at [286] of its decision: 40 “In our view it would not be appropriate to withdraw Mr Rosier’s approval to act in a significant influence function or to prohibit him from performing such functions if we were satisfied that he had learned lessons from his failures and would not make the same mistakes were he to continue in such a role.” 13 The Tribunal found that lessons had not been learned and therefore decided that the only course to take was to dismiss the reference. As the Tribunal observed in Carrimjee, when referring to this passage at [42] of its decision, it would have gone too far had it determined whether or not it was appropriate to make a prohibition order. However, had the Tribunal made findings which indicated 5 that Mr Rosier had learned lessons from his failures which were relevant to the question as to whether he would repeat the same mistakes then the appropriate course for the Tribunal to have taken would be to have remitted the matter to the Authority to reconsider its decision as to whether it was appropriate to make a prohibition order in the light of the 10 Tribunal’s findings.[52]We shall therefore approach the issues in these references as follows:(1) We shall first determine whether the Authority has made out its case that Mr Palmer breached Statement of Principle 6 in carrying out his controlled function at the Firms by failing to act with due skill, care and 15 diligence in managing the business of the Firms for which he was responsible in his controlled function;(2) If the first issue is determined in favour of the Authority we shall then determine whether a financial penalty is appropriate and, if so, the appropriate amount of the penalty; and 20(3) We shall then determine Mr Palmer’s reference in respect of the question as to whether a prohibition order is appropriate.[53]In determining the first issue set out above, we first need to determine whether the alleged failings on the part of Mr Palmer of which the Authority complains, that is those summarised at [4] above, relate to matters for which he was personally 25 responsible in his capacity as a director of the Firms and when performing the controlled functions of director. In order to determine that question, we need to be satisfied that as a matter of fact Mr Palmer had assumed personal responsibility for performing those functions, either in practice or because they formed part of his job description. Secondly, assuming those matters did fall within the sphere of Mr 30 Palmer’s responsibility, we need to determine whether Mr Palmer failed to exercise due skill, care and diligence in the manner in which he performed those functions.[54]The Authority in its submissions had framed Mr Palmer’s alleged failures in terms of him having “failed to take adequate steps to ensure” that the relevant functions were performed to the requisite standard. We think that formulation is 35 somewhat unhelpful in the context of the standard laid down by Statement of Principle 6. That is a straightforward and well-known standard of acting with reasonable care; that is performing the functions to the standard to be expected of a person in his position, and also taking account of his own particular skills and experience. The way the Authority formulated its case, is more redolent of the 40 requirements of Statement of Principle 5 and Statement of Principle 7, which in the context of obligations relating to the organisation of a firm and its compliance with the relevant requirements and standards of the regulatory system, require the approved person concerned to “take reasonable steps to ensure” that the relevant requirements 14 are met, but without making it explicit that the obligation is to take reasonable steps rather than meet an absolute standard.[55]There was something in Mr Philipps’s criticism that the formulation of the Authority’s case suggested that Mr Palmer was being held to a higher standard and this was debated with Mr Herberg. What emerged from that 5 debate was that the Authority accepted that the Authority had to demonstrate that Mr Palmer had failed to act with due skill, care and diligence in performing the functions he had assumed or which had been conferred on him in his capacity as a director by failing to meet the standards to be expected of a person in his position performing those functions. The 10 particular matters relied on by the Authority should be assessed on the basis that it is contended that Mr Palmer has failed to take reasonable steps to ensure that the functions were performed to the requisite standard and accordingly we have approached the issues on that basis.[56]In short, the Authority needs to demonstrate that the functions concerned fell 15 within Mr Palmer’s sphere of responsibility and that Mr Palmer failed to act with due skill, care and diligence in performing those functions. Mr Herberg accepted that position, and we did not understand Mr Philipps to disagree with it. Mr Herberg confirmed that the Authority was not seeking to make a case that Mr Palmer had failed to supervise Mr Bell and Ms Grigg in their performance of their respective 20 roles. However, Mr Herberg made it clear that the Authority did rely on a number of Mr Palmer’s interactions with Mr Bell and Ms Grigg on matters of compliance and regulatory risk, and the tone and culture he set in relation to those interactions, in the context of its contentions that in performing his role as a director he failed to act with due skill, care and diligence. In other words, the essence of the complaint against Mr 25 Palmer is the manner in which the systems and controls operated in practice and his alleged failure to act with due skill, care and diligence in dealing with the issues that arose, with a consequence that the Firms’ business model and its implementation failed to pay due regard to the objective of achieving fair treatment for underlying customers. 30 57. As is well-established in references of this nature, the burden of proof lies with the Authority and the standard of proof to be applied is the ordinary standard on the balance of probability, namely whether the alleged conduct more probably occurred than not. Evidence 35 58. We had witness statements from three witnesses for the Authority as follows:(1) Paul Howick – Mr Howick is a manager in the Enforcement and Market Oversight division of the Authority and was responsible for managing the Authority’s investigation into Mr Palmer’s conduct from November 2012. Mr Howick’s evidence related to the conduct of the 40 investigation and the facts and matters arising from it and his evidence was unchallenged. 15(2) Stephen McWhirter – Mr McWhirter is a Technical Specialist in the Governance and Professionalism Policy team of the Authority. Mr McWhirter’s evidence related to the requirements and expectations the Authority places on individuals and senior management and the relevant statutory framework and principles in the Authority’s 5 Handbook for principals and their appointed representatives. Mr McWhirter’s evidence was unchallenged, but he answered some questions from the Tribunal. We found Mr McWhirter’s evidence to be of limited assistance, although some of it is reflected in our summary of the regulatory requirements for 10 network firms set out above.(3) Stuart Bernau – Mr Bernau was a non-executive director and the Chairman of the Group between 14 November 2012 and 30 April 2014. Mr Bernau’s evidence related to the Board structure and corporate governance of the Group, Mr Palmer’s role within the Group, conduct and 15 compliance issues arising during Mr Bernau’s time on the Board and the Group’s business model. Mr Bernau’s evidence was also unchallenged but he answered some questions from the Tribunal. We have found Mr Bernau’s evidence to be of some assistance and have accepted it.[59]Mr Palmer provided a witness statement on which he was cross-examined. This 20 was the only live evidence we heard on his behalf. We have found Mr Palmer to be a truthful and at times candid witness. Where we have not accepted his evidence, it is not because of any concerns as to Mr Palmer’s truthfulness and his belief as to the relevant events, but because we have found his explanations to be contradicted by other evidence on which we have relied. We think that Mr Bernau made an accurate 25 assessment of Mr Palmer in a meeting he had with the Authority in January 2013 when he is recorded as saying that he had come to appreciate Mr Palmer had not acted with any malice in the way that he ran the Group and that he had been very entrepreneurial in the way that he had driven the Group forward.[60]In addition to the witness evidence we had a large number of bundles of 30 documents provided by the parties, much of it derived from the Authority’s investigation. As indicated in this decision, we have relied on a significant amount of this documentation in our findings, even where not specifically drawn to our attention by the parties during the hearing. Findings of fact 35 61. From the evidence that we heard, and the documents we saw, we make the following findings of fact. The Firms’ business model[62]We start by summarising the business model of the Firms and the way it operated in practice, both before and after the Relevant Period. 40 63. The Firms operated as a network of appointed representatives each of which had its own customer base and acted as financial advisers to those customers. We shall 16 refer to those entities as the “ARs”. Whilst each of the Firms was authorised by the Authority to conduct investment business, they did not conduct business with customers directly but accepted responsibility for business carried on by the ARs pursuant to appointed representative agreements entered into in compliance with s 39 5 FSMA.[64]The appointed representative regime has been a feature of financial services legislation since the passing of the Financial Services Act 1986, the predecessor to FSMA, and the legislative framework has not changed since. It was originally designed with what were then the large sales forces of the life offices in mind. 10 Historically, those sales forces had been self-employed individuals or small firms, remunerated by commission, who were typically tied to selling only the products of a single life office. The appointed representative regime made sense in enabling individual representatives to avoid the need to be authorised themselves whilst at the same time recognising that as a matter of law, the representative was acting as the 15 agent of his principal, the life office, in marketing and advising on that life office’s products. Accepting responsibility for a single range of products was relatively straightforward for the life office, which could impose standard compliance requirements across the salesforce.[65]However, right from the outset of the implementation of the 1986 Act, the concept 20 of a network comprised of separate independent financial adviser (IFA) firms has also existed. Under a typical structure, the principal is authorised by the Authority to carry on investment business as a financial adviser, but does not do so directly. It will appoint one or more appointed representatives to carry on the business for which it is authorised, and each of those appointed representatives will employ one or more 25 individual advisers, for whom the principal is responsible for applying to the Authority under s 59 FSMA for such advisers to become approved persons.[66]This network model recognised that the skill of the typical financial adviser was focused on technical knowledge of the products being sold, empathy with the customer and communication and persuasion skills. In-depth knowledge and expertise 30 in relation to compliance arrangements was not necessarily a strength. Therefore, it was recognised that grouping a number of small firms under a principal with appropriate systems and controls and the relevant expertise to supervise their ongoing compliance with the relevant regulatory requirements and providing a single point of reference for the regulator could work well for all concerned, that is the regulated, the 35 regulator and the underlying customers.[67]Thus, the principal firm effectively marketed itself as a service provider to potential member firms of the network as a provider of compliance services. The attraction to a member firm of joining a network was that it was absolved from the need to address and implement its own systems and controls to ensure compliance 40 with the regulatory system. However, because of the responsibility that the principal took for the conduct of the member firms, principals typically exercised tight control over the manner in which the member firms carried on their business which would mean a more hands-on approach by the principal over the member firm than the Authority would follow if it were to authorise the member firm directly. 17[68]In the typical model, the principal would limit the range of products that the member firms could offer, usually maintaining a common list of products which could be marketed, coupled with a licensing system that restricted the ability of the member firm to sell particular products on the list until they had been shown to be competent to do so. There would also be standard documentation common to 5 all member firms, such as terms of business, fact finds, suitability letters and financial promotions. Typically, there would also be a common training and competence regime for individual representatives of ARs (“registered individuals” or “RIs”) and centralised investment research and general systems and control measures. Typically, the 10 principal firm would be remunerated by commission payable by the product provider whose products were sold by the network. The principal firm would pass on this commission to the relevant AR after retaining a share of it. The amount retained represented the principal firm’s remuneration for its services to the network. A further typical feature was that all business advised on by the member firms would be 15 processed centrally, and because the commissions payable by product providers were received directly by the principal firm it controlled the payment of remuneration to the member firms. That feature gave the principal firm another measure of control over the member firms.[69]Not all networks were successful. Poor supervision of member firms could result 20 in considerable liabilities accruing to the principal as a result of unsuitable advice given to underlying customers with the result that the network needed to close. This in turn could lead to other networks tightening the level of supervision over member firms, imposing higher fees and higher barriers to entry and terminating the appointment of those member firms that did not measure up to the required regulatory 25 standard.[70]It was against this background, that in 2001 Mr Palmer, who previously had a successful career as a tied sales representative of a leading financial institution before becoming an independent financial adviser by joining a network, founded what became the Group. Financial was authorised by the Authority on 1 December 2001. 30 From the outset, Mr Palmer was the Chief Executive of the Group and between them, Mr Palmer and his wife owned the whole of its issued share capital, Mr Palmer himself owning 90%.[71]Within a short period following the obtaining of its authorisation, Financial provided a network for advisers to deliver a broad range of financial services. A 35 second firm, Investments, was established and authorised in 2004 to act as a discretionary fund manager, enabling a small number of registered individuals to provide discretionary investment management services. The Firms’ permissions included advising and arranging deals in relation to pension transfers and opt outs, investments (including unregulated collective investment schemes (“UCIS”)) and 40 mortgage contracts.[72]It was Mr Palmer who was solely responsible for devising the Firms’ business model and his entrepreneurial skills that enabled it to be successfully marketed to potential ARs. At its peak in March 2011, there were 397 ARs and 516 RIs operating across the Group. Mr Palmer was clearly aware of the rewards that could be made in 18 harnessing the sales efforts of others by in essence lending the Firms’ authorisations to other firms for a fee.[73]The business model that Mr Palmer devised for the Firms was unique in the network sector. The Firms’ business proposition was positioned as involving a lighter touch, in the sense of the control exercised over the manner in which 5 the ARs carried on their business. In his evidence, Mr Palmer said that essentially the Firms’ model was to provide a strong compliance regime with limited product provider influence, which was fee rather than commission-based. As Mr Palmer described, ARs enjoyed flexibility in that they were permitted to advise on a wide range of products and use 10 their own fact find documents and promotional and research materials. Thus, unlike other networks, there was no prescription as to the type of product that could be sold or any requirement to use standardised documentation. ARs paid a monthly fee to join the network in return for which they received supervision, training, competence checking, compliance management, technical support, weekly updates, access to a 15 document library and professional indemnity insurance from the Group. It was described by Mr Palmer as a “hybrid” model.[74]A marketing brochure produced for the Group in 2012 contains the following quote from Mr Palmer: “You retain your own agencies and control your own cash flow because it is paid 20 direct from the provider to you. You keep your own customers, idiosyncrasies and ways of doing business because you are the best person to run your business. We look after your compliance, keeping you within FSA driven boundaries and we will give you first-class backup when you need it. We aim to control your compliance but not your business.” 25 75. The brochure went on to emphasise that the Firms did not operate product panels and that the AR could use any regulated provider with all fees and commissions paid direct to the AR, leaving the AR in control of its finances with no additional charges levelled against its fees or commissions. It also stated that the AR was free to run with any system of choice in relation to back-office systems. Emphasis was put on the 30 value for money given by such a structure. Mr Palmer agreed in cross examination that this document was a fair overall summary of the concept of the Firms’ business model.[76]It was put to Mr Palmer that the distinctiveness of what was being offered was that there would be less interference in the AR’s business than any other network that 35 they might join, in the sense that the Firms were not going to interfere with the way the AR worked.[77]Mr Palmer accepted that the Firms’ model could accommodate how the ARs had previously worked, either when members of other networks or working on their own account but did emphasise, and we accept his evidence on this point, that this ability 40 for an AR to do things the way it wanted was limited to the extent that the way it did things had to be compliant with the relevant regulatory requirements. Mr Palmer emphasised that ARs were subject to strict controls and restrictions on the basis that the core principle was to control compliance but not the business, subject to 19 supervision by the Firms, particularly as regards the obligation to treat customers fairly.[78]We find as a fact that the flexibility as regards working methods, freedom as regards recommendation of products and the competitive fees payable, not being based on the volumes of sales made, were very attractive features 5 of the model to potential ARs.[79]We can also see that the business model would strike a chord with the natural inclinations of IFAs, particularly those operating alone or in small firms, to consider themselves independent, such businesses often having been built upon the strong 10 bonds formed with clients and the trust shown by those clients which would tend to reinforce the IFA’s self-belief in independence.[80]In our view, the Firms’ business model would encourage that spirit of independence. However, the corollary is that the model posed extra challenges for the Firms in terms of ensuring that all their ARs complied with their obligations to treat 15 customers fairly. Without standardised procedures and documentation and without control over remuneration flows, the risk that these obligations would not be met is clearly enhanced beyond what would be the case in a typical network. In short, the models would require very robust systems and controls with constant monitoring as to how they were operating in practice, with the need to make adjustments in the light of 20 operating experience. This is in the context of ARs which may well have been attracted to the network on the basis that there would be less control over what they did than would be the case in a typical network. The resources that the Firms put into compliance checking, particularly reviews of the business being undertaken by the ARs through file reviews, would therefore need to be fit for purpose and constantly 25 reviewed. The work of those who carried out those checks on the ground would also have to be subject to detailed scrutiny and senior management informed of any actual or potential difficulties arising.[81]We find that Mr Palmer was aware of the fact that the hybrid model increased the risk to underlying customers; he said in his oral representations to the Authority’s 30 Regulatory Decisions Committee (“RDC”) that the model “entails a different risk of detriment to customers by comparison with a less flexible network model, and so requires the imposition of bespoke controls around advisers different to those that might be necessary under a model with less flexible processes being available to advisers.” He gave similar evidence in his witness statement. 3582. In particular, Mr Palmer accepted that three particular risks arose from the Firms’ business model, namely risks arising from non-prescribed product ranges (“product risk”), risks arising from non-prescribed sales documentation (“adviser risk”), and risks arising from inaccurate reporting by AR’s of new business and turnover figures (“business submission risk”). 4083. In relation to product risk, Mr Palmer accepted that although the ability to select from a wide range of investment products reduced concentration risk and removed incentives to recommend particular products that may not be in the customer’s best 20 interests, it did give rise to the risk that the adviser did not have sufficiently detailed knowledge of each and every product he recommended to establish whether it is suitable for the customer as he would be relying solely on his own research.[84]In relation to adviser risk, Mr Palmer accepted that although he viewed flexibility as a key benefit because a centralised and standardised business 5 model can encourage a “box-ticking” approach to compliance, he accepted that this flexibility meant that ARs could in practice be using a wide range of documentation during the advisory process, which if not properly controlled, could create a risk that customers received unsuitable advice. 10 85. In relation to business submission risk, the Firms had a system known as PHOSSIL on to which an AR was required to enter information every time it received money from a product provider or lender and record details of each product sold to each customer. Mr Palmer accepted that PHOSSIL relied upon advisers ensuring that they had inputted new business and turnover figures accurately and on a regular basis 15 and that this was important because advisers were monitored based (in part) on the information they recorded and because the vast majority of the Firms’ management information was extracted from PHOSSIL.[86]Business submission risk was specifically identified in papers which went to the Group Board in July 2010 which noted that the Firms’ controls relied on the fact that 20 all information must be input to PHOSSIL on a regular and complete basis and whilst recognising that there was a need to check whether ARs were doing so accurately, observed that it was labour-intensive to do so for all ARs so would have to be done on a spot check basis. In September 2012, a board paper observed that the management information contained on PHOSSIL was an area of weakness and that the Firms relied 25 on the ARs to input information “which is different to the marketplace”. Mr Palmer accepted that there was a degree of reluctance on his part to introduce a form of standardised submission that would remove flexibility for ARs and that there was no reconciliation between ARs’ bank statements and the new business register held on PHOSSIL. 30 Role of Mr Palmer[87]As we have found, Mr Palmer founded the Group, devised its business model and together with his wife controlled the whole of its share capital.[88]Although Mr Palmer was only ever registered with the Authority as performing the CF 1 function (Director) we find that in practice he was Chief Executive of both 35 the Group and the Firms. He should not have exercised the latter functions without having been approved by the Authority to do so in the CF 3 function (Chief Executive).[89]Mr Palmer did apply for approval to perform the CF 3 function but not until October 2012. He explained in cross examination that his failure to apply for approval 40 was partly related to the regulatory action that commenced in May 2008 and concluded in February 2010 (to which we refer later), although the application form 21 said that the failure to apply before was an “oversight”. Mr Palmer accepted that he should have applied during the period which related to the regulatory action taken against him but said that he could not do so while he was in negotiations with the Authority over his investigation and that when that matter concluded he simply forgot to apply. He then became aware of the issue again in 2012 in 5 the weeks leading up to the 2012 Arrow visit of the Authority to which we refer later, but felt it was best to wait until after that visit. The Authority’s report after the visit picked up the fact that an application should have been made; an application followed shortly thereafter. Mr Palmer was asked whether it was right to hold off applying to register on the basis that 10 he was under investigation and he replied that he did not know the answer to that.[90]In his witness statement, Mr Palmer described his role as CEO as working with the Board to set the Group’s strategy and vision, building the Firms’ culture in line with this and working on implementing the business model. He denied that he was the primary controlling influence of the Firms and that he was solely responsible for 15 developing and maintaining the Firm’s business model and culture. He said that was the collective responsibility of the Board and that while he had a role in setting the Group’s tone and agenda, that role was in the context of collective decision-making on strategy and management.[91]In our view this description is not consistent with the reality of the position. Mr 20 Palmer regarded Group as his own and the hybrid model as his concept. Each of the business plans that we saw were his responsibility and were authored by him. He accepted that as the major shareholder, he had a different view on expansion to the other Executive Directors; in 2012 he was considering that the Group should grow by acquisition when organic growth was diminishing. 25 92. As far as the Board was concerned, following the conclusion of the disciplinary action against Mr Palmer in 2010, which we mention below, and the criticisms in the Final Notice issued to him as to the informal nature of the Group’s governance structure that existed prior to that time, the Board was restructured at the instigation of Mr Palmer. In addition to Mr Palmer, the Board comprised the various Executive 30 Directors, all of whom reported to Mr Palmer in his capacity as CEO as well as two non-executive directors, one of whom was appointed as non-executive Chairman. The Chairman did not have extensive experience in the financial services industry, but the other non-executive director did have such experience.[93]Following criticisms made of the effectiveness of the Board by the Authority in its 35 risk assessment of the Group made in October 2012, and in particular the lack of industry experience of the Chairman, the Board was restructured again with the appointment of three new non-executive directors to replace the existing nonexecutives, including a new non-executive Chairman, Mr Bernau.[94]Mr Bernau’s evidence, which was not challenged, was on the basis of his own 40 attendance at a Board meeting in September 2012 and having read previous Board minutes, that Mr Palmer had not been subject to sufficient challenge by other members of the Board and, in particular, that the non-executive directors who were outnumbered could not provide proper challenge to the business. Mr Bernau’s 22 evidence, based on his attendance at the September 2012 Board meeting, was that Mr Palmer dominated Board meetings and that the Chairman and other non-executive director had asked very few questions and provided little by way of challenge. Mr Bernau said that Mr Palmer was reluctant to relinquish his dominant position and that it was difficult to challenge Mr Palmer who, Mr Bernau said, 5 viewed the Group as “his business” as a consequence of being the controlling shareholder.[95]Mr Bernau’s assessment is in fact consistent with what Mr Palmer said in his cross examination and we accept it. Mr Palmer accepted that he had a strong influence over the whole of the senior management of the Firms and that he had a dominant position 10 on the Board. The development of the Board structure in 2010, and then the further change to the Board structure in 2012 which involved the previous non-executive directors resigning and Mr Bernau and others being appointed all occurred because of Mr Palmer’s strong influence. Indeed, in his oral evidence, having stated that he accepted Mr Bernau’s advice to resign as Chief Executive, Mr Palmer referred to the 15 fact that he had employed Mr Bernau: “on what I considered to be an extremely large salary for two or so days’ work per month. If I’m going to pay somebody a lot of money to act as my adviser, on my Board, to run my company, my Board to run the operation, I’d be as well to take his advice and follows experience, which got him the job in the first place.” 20 96. This exchange clearly shows Mr Palmer’s belief in the Group being “his company” and we therefore accept Mr Bernau’s evidence that Mr Palmer dominated the Board and was the primary controlling influence within the Group.[97]That being the case, we also accept the Authority’s contention that in practice Mr Palmer set the tone and culture of the Group, notwithstanding the role of the Board in 25 approving the Group’s strategy and business plans. Mr Palmer accepted during the course of cross examination that he personally was largely responsible for setting the tone and culture at the Firms.[98]Nevertheless, we place little weight on the issue of culture in this decision. We accept Mr Palmer’s evidence that on the basis of the Firms’ motto “Humility, 30 Integrity, Discipline”, the Firm’s culture was one of regulatory compliance, consistent with the business model and that generally the Firms sought to recruit duly experienced and qualified advisers and to monitor and assess their conduct with the objective of acting in the underlying customers’ best interests.[99]Therefore, we need to examine Mr Palmer’s role in relation to those objectives 35 and whether he carried it out with due skill, care and diligence.[100]As we shall see, the Authority’s criticism of Mr Palmer’s conduct does not relate to the appropriateness of the hybrid business model itself nor does it argue that Mr Palmer was responsible for establishing the systems and controls of the Firms around the management of customer risk which, as we shall see, the Authority has 40 found to have been inadequate. 23[101]The essence of the Authority’s criticisms, as summarised at [4] and [5] above, is that in his role as Director of the Firms he failed to respond with due skill, care and diligence in managing the risks to underlying customers as a consequence of the risk which arose from the nature of the Firms’ business model that the Firms’ processes and controls were 5 not fit for purpose.[102]We have no doubt that on the facts of this case, one of the responsibilities that Mr Palmer had assumed, in his capacity as the dominant Executive Director on the Boards of the Firms, acting as he did as de facto Chief Executive, was to monitor the way the Firms’ systems and controls were operating in practice. Indeed, as early as 10 June 2009 the Board of the Group approved the job profiles of the various executive directors, including Mr Palmer as Chief Executive. One of the duties assigned to Mr Palmer was to maintain effective systems and controls throughout the Group and work with the Board to achieve effective corporate governance. Therefore, although the Board would have overall responsibility for the Firms’ systems and controls, Mr 15 Palmer personally had a role in relation to the effectiveness of those systems. Insofar as any difficulties or deficiencies became apparent it would fall to him to take the lead in ensuring that they were addressed.[103]This finding is reinforced by the fact that, as Mr Palmer accepted in his evidence, he had a role in relation to almost every aspect of the Firms’ business, 20 having performed many of the roles which were subsequently assigned to other executives which flowed from him regarding the Group as “his company”.[104]The level of personal responsibility assumed by Mr Palmer was reflected in the disciplinary action that was taken against him by the Authority in February 2010. The Final Notice given to Mr Palmer on 24 February 2010 records that following a 25 settlement with Mr Palmer the Authority imposed a financial penalty of £49,000 on Mr Palmer in respect of breaches of Statements of Principle 5 and 7 of APER between 6 April 2006 and 19 August 2008. It was noted that the action against Mr Palmer personally was proposed by the Authority as an alternative to imposing a financial penalty on Financial. 30 105. Mr Palmer was found, in performing his functions as Director and the executive responsible for apportionment of responsibilities, to have failed(i) to establish and maintain a clear and appropriate reporting structure,(ii) to have taken reasonable steps to ensure that the business of Financial was organised so that, during a period of rapid expansion of Financial’s network under the business model that Mr Palmer 35 established it could be controlled effectively as it expanded and(iii) to have taken reasonable steps to ensure that Financial complied with the relevant requirements and standards in respect of advising on pension switching as a result of the insufficiently robust compliance monitoring arrangements implemented by Mr Palmer.[106]In relation to the latter failing, the Authority placed reliance on Financial’s 40 description of its approach as having a “laid-back approach to compliance”, which the Authority said gave rise to a risk that members of the network would be adversely influenced or wrongly interpret Financial’s communications as evidence of a culture in which insufficient regard was paid to complying with requirements aimed at 24 treating customers fairly. The Authority found that for much of the Relevant Period there were deficiencies in management information as regards file checking and no system in place to review the quality of the file checking.[107]Mr Palmer accepted in his evidence that the concerns expressed to him by the Authority in a supervisory report in 2008 which were reflected in 5 the Final Notice put him on notice of the need for him personally to exercise sufficient oversight so he could be satisfied of the adequacy of controls in relation to the advice given to customers.[108]The Final Notice does, however, record that the failings identified were 10 mitigated to a considerable extent by:(1) Mr Palmer’s decision to commission two past business reviews;(2) Mr Palmer’s agreement to the appointment of a skilled person to validate the past business review and to take appropriate steps to ensure that customers are treated fairly; and 15(3) Mr Palmer’s decision to make wide-ranging changes to the organisational, governance and compliance arrangements at Financial to achieve high standards and ensure that customers are treated fairly. The Firms’ Systems and Controls and Governance arrangements[109]As recorded in the February 2010 Final Notice, in response to the Authority’s 20 concerns following a supervisory visit in May 2008, a skilled person’s report was commissioned from Moore Stephens who reported at the end of 2008.[110]This report noted that the Board had been reorganised with four committees of the Board having delegated responsibility for establishing, overseeing and maintaining systems and controls. The report went on to make a number of 25 recommendations as to corporate governance including:(1) the role of Chairman and Chief Executive should be performed by two separate individuals and there should be at least one Non-Executive Director;(2) each senior manager should have a detailed job description so that 30 his/her responsibilities and reporting lines are clear;(3) the audits by the internal audit function should include the effectiveness within which the regulatory responsibilities under the controlled functions regime are being performed and it would be helpful for the internal auditor to prepare an annual internal audit plan that should 35 be approved by the Audit Committee and then perform audits and followup reviews based on the plan; and(4) consideration to be given to the formation of a Risk Control Committee to report to the Board which could act as a fresh pair of eyes to assess the risks faced by the Firms. 25[111]As mentioned at [93] above, the first of these recommendations was implemented, as was the second.[112]The report also made some specific recommendations regarding systems and controls. The report recognised that the Group’s compliance function had changed significantly since the Authority’s visit in May 2008 with changes 5 in the amount and quality of management information presented to the Board. It noted that the compliance director had more time to concentrate on wider issues facing the Group and that the compliance team was much more focused. In relation to file checking, it noted that procedures were in place for the training and monitoring of the file 10 checkers to ensure that consistency was achieved which should result in the ARs receiving a standard, high quality level of feedback on files.[113]The report acknowledged that Group may not prefer to go down this route, but observed that if standard documents were used, such as fact finds and suitability report, then the review process would be much easier. 15 114. The four Board Committees that were in place by the time of the Moore Stephens report were the Audit Committee, the Nomination and Remuneration Committee, the Corporate Governance Committee and a committee composed of the Executive Management Team (EMT). EMT met fortnightly, reported to the Board and was responsible for the day-to-day management of the Group. There were three 20 further committees which reported to EMT rather than the Board, namely a Compliance and Regulatory Committee, a Fund Management Committee and a Risk Committee. This structure continued until October 2012 when a restructuring took place under the leadership of Mr Bernau, as described below. It was therefore the case that the recommendation by Moore Stephens that a Risk Control Committee reporting 25 to the Board be established was not followed.[115]As far as the Audit Committee is concerned, Mr Palmer was mistaken in his evidence in his witness statement that the Audit Committee was the primary committee for monitoring and reporting internal controls and that it met monthly and reviewed the effectiveness of the Group systems of financial reporting and internal 30 control policies. Although the Audit Committee’s terms of reference included keeping under review “internal control policies and procedures for the identification, assessment and reporting of risks” it is clear from the evidence that we had in the form of minutes of its meeting of 27 June 2012 that the Audit Committee merely considered the Group’s statutory audit and only met on an annual basis to deal with 35 that issue. Mr Palmer accepted in cross examination that the Audit Committee had no responsibility for wider matters until it was renamed the Audit and Compliance Committee following Mr Bernau’s restructuring in October 2012 and that the other matters within the Audit Committee’s terms of reference prior to that time would have been dealt with by the Compliance and Regulatory Committee. Mr Palmer said that at 40 some point responsibility must have been given to that committee, but we saw no evidence that it did in practice perform any role of reviewing the effectiveness of internal control policies and procedures. If in fact that did happen then, as Mr Herberg submitted, there would in practice be no separate oversight of internal control policies and procedures. 26[116]As far as the Risk Committee was concerned, Mr Palmer was the chair of this committee until October 2011, when he was replaced by Ms Grigg, who had been appointed Risk Director in February 2011. This committee was responsible to the Group Board for monitoring and reporting risk, providing auditing to detect anomalies that could create a risk and making recommendations to control 5 them. Mr Palmer’s evidence in his witness statement was that the committee met monthly to consider the Risk Register (which listed the risks that had already been identified and other potential risks relevant to customer risk), any specific incidents that could increase or reduce certain risks, and any actions that could be or were being taken to address risk 10 areas. However, in his cross examination he accepted that this description was only accurate from October 2012 following the restructuring carried out by Mr Bernau.[117]Mr Palmer accepted that until October 2012 the Risk Committee did not in fact meet regularly and that the matters for which it was notionally responsible were in practice dealt with by EMT at its regular meetings. 15 118. Mr Bernau’s appointment as the non-executive Chairman of the Group was proposed and approved by the Board at its meeting on 31 October 2012. Mr Bernau had considerable experience in senior positions in the financial services industry, having been on the Board of Nationwide Building Society and Chairman and Chief Executive of the Chelsea Building Society, as well as a non-executive director of 20 Metro Bank plc, chair of its Audit Committee and a member of its Risk Oversight Committee.[119]Mr Bernau’s appointment took place following a request by the Authority in its supervision risk assessment set out in its letter of 5 October 2012 that the Group appoint a non-executive director with industry and business sector experience. 25 120. Mr Bernau considered it to be a top priority that changes needed to be made to the governance of the Group to make it fit for purpose. Mr Bernau’s assessment was that Mr Palmer had not been subject to sufficient challenge by other members of the Board and that the Board was not structured so as to provide independent challenge. Consistent with the findings we have made above, Mr Bernau’s understanding was 30 that the existing Board Committees only met and reported on an ad hoc and infrequent basis and because the Risk Committee and the Compliance and Regulatory Committee were committees of and reported to EMT, rather than being committees of the Board, there was no direct non-executive oversight of these committees in the areas for which they were responsible. 35 121. Mr Bernau instigated the following changes to the composition and structure of the Board and its Committees:(1) two new non-executive directors were appointed with extensive experience in the financial services sector;(2) voting rights at Board level were altered so as to ensure that the non40 executive directors held the majority of votes and consequently could provide effective challenge; 27(3) with a view to ensuring that they could provide a robust check on the executive directors, the Board committees were restructured as follows: (a) the Corporate Governance Committee was replaced with a Risk Committee which had two subcommittees, namely a Fund Management Committee and a Compliance 5 and Regulatory Operational Committee; (b) the Audit Committee was renamed as the Audit & Compliance Committee; (c) the Audit Committee and the Risk Committee were to be 10 chaired by the non-executive directors; and (d) the Terms of Reference for the Risk Committee were revised and it was agreed that the committee should consist only of non-executive directors and a similar decision was taken in relation to the Audit and Compliance Committee, both 15 committees meeting once a month on the same day as the Board meeting.[122]At the same time, Mr Palmer agreed to step down as Chief Executive and take a brief sabbatical in order for senior management to be given space to start addressing the various issues facing the business at this time. 20 123. As regards the Firms’ systems and controls, both Mr Bell and Ms Grigg were key figures both before and after the Relevant Period. Mr Bell[124]Mr Bell joined the Firms in 2006. He held the following significant influence functions at the Group: 25(1) CF 1 (Director) at Financial from 3 January 2008 to 16 January 2013;(2) CF 10 (Compliance oversight) at Financial from 12 December 2007 to 16 January 2013; and(3) CF 10 (Compliance oversight) at Investments from 12 December 2007 to 22 March 2010. 30[125]Mr Bell was the Firms’ Compliance Director, although Ms Grigg held the CF 10 role for Investments from 26 March 2010, as discussed below. The job profile for Compliance Director included, amongst other things, identifying and advising the organisation on compliance risks and how best to manage them. 35 126. From February 2010 until July 2011 Mr Bell had additional responsibilities as Managing Director of Networks. The job profile for this role included, amongst other things, overseeing the business development operation attracting new members to the network and facilitating relationships with third party providers to provide competitive terms to the network members. 28[127]As we have previously mentioned, Mr Bell was disciplined by the Authority. Mr Bell agreed to a settlement with the Authority in a Final Notice dated 13 March 2015 which found that Mr Bell was knowingly concerned in the Firms’ breaches of Principle 3 of the Authority’s Principles for Businesses. Principle 3 provides that a firm must take reasonable care to organise and control its affairs 5 responsibly and effectively, with adequate risk management systems. The Authority found that as Compliance Director, Mr Bell had knowledge of and responsibility for the compliance systems and controls at the Firms and designed and implemented those systems and controls. As we mention later, in Final Notices issued against the Firms in July 2014 10 the Authority found that between 20 August 2008 and 30 April 2013 there were systemic weaknesses in the design and execution of the Firms’ systems and controls and risk management framework.[128]The basis of the findings against Mr Bell and the sanctions imposed were set out at paragraphs 6 to 11 of the Final Notice as follows: 15 “6. Mr Bell was responsible for compliance oversight generally and, specifically, was responsible for and implemented the following: a) the application process for prospective ARs and RIs seeking to join the Firms; b) the Firms’ procedures to determine the competence of RIs to advise customers; 20 c) the Firms’ training and competency scheme encompassing the design and delivery of the initial training for the ARs and RIs; d) the supervisory processes and procedures for ARs and RIs, setting up a structure of Supervisory Staff to provide field supervision of the ARs that operated in the Firms’ network; and 25 e) the file checking processes and procedures that were operated by the Firms.[7]The Authority acknowledges that Mr Bell took significant steps during the Relevant Period to introduce and improve the Firms’ compliance systems and controls. However, these were ultimately insufficient to ensure that the Firms complied with the relevant regulatory requirements. 30 8. Mr Bell was knowingly concerned in the Firms’ breaches of Principle 3 insofar as they related to compliance systems and controls because he failed to ensure that the Firms: a) took sufficient steps, as part of the recruitment process, to assess appropriately prospective ARs’ business models and business practices to determine whether 35 they were suitable to act for the Firms; b) carried out a suitable assessment, upon an RI joining the Firms, of an RI’s knowledge and skills, in order to determine their competence before they began advising customers; c) appropriately and effectively supervised their ARs and RIs at all times; and 29 d) established and maintained adequate compliance and file checking procedures, appropriate to the size and types of business conducted by the Firms.[9]The Authority acknowledges that throughout the Relevant Period Mr Bell was working within the context of the Firms’ business model (which afforded ARs and RIs a high degree of flexibility) and cultural focus (5 which viewed the ARs and RIs, rather than the customers of the ARs and RI, as the end customer who received the advice). Nevertheless, the Authority views Mr Bell’s failings as serious because: a) Mr Bell was Compliance Director at the Firms prior to and during the 10 Authority’s previous investigation into the Firms’ misconduct and the subsequent Final Notice issued to Mr Palmer. He had therefore been put on notice of the need for significant improvements in the Firms’ systems and controls and compliance framework to ensure they complied with the relevant regulatory requirements; and 15 b) the failings exposed customers to the risk that the Firms’ ARs and RIs would make personal recommendations which were not suitable, therefore creating a risk of consumer detriment.[10]As a result of these failings, the Authority considers that Mr Bell has demonstrated a lack of competence and capability and is therefore not fit and 20 proper to perform the CF10 (Compliance oversight) function in relation to any regulated activities carried on by any authorised persons, exempt persons or exempt professional firm, and that he should be prohibited from doing so.[11]The Authority therefore makes an order prohibiting Mr Bell from performing the CF10 (Compliance oversight) function (with effect from the date of the Final 25 Notice) pursuant to section 56 of the Act, and imposes a financial penalty on Mr Bell in the amount of £33,800 pursuant to section 66 of the Act.”[129]Mr Palmer appeared to have complete confidence in Mr Bell at the beginning of the Relevant Period but it is clear that Mr Palmer had lost faith in Mr Bell by the end of April 2012 and their relationship continued to deteriorate, particularly after the 30 Authority’s supervisory risk assessment carried out in May 2012, the findings of which were communicated to the Group on 5 October 2012.[130]In particular, in his report to the Board in July 2010, Mr Palmer referred to the fact that compliance was “running like a Rolls Royce engine – due to the clear reporting lines, transparent structures and an excellent middle management team. 35 Well done Steve!”.[131]On 14 February 2012, Mr Palmer said in an email to Mr Bell:
“I am really pleased with your performance and the delivery of compliance which is your role. Now that you have a first-class team alongside you I hope that you can concentrate on developing the process for the IFAs. We know that 40 you are a first-class manager of people, now I would like to see you also develop your creative side to work on the mechanics of what we do. Currently we are in the compliance business, but strategically we should be developing as an advice 30 business. I would like to see you continue to develop our business in advice terms, rather than compliance terms. All those “can I have a silver bullet?” questions respond to the old days of as acting as pure compliance – we need to move the business on from there. The process needs endless and continual improvement 5 and nothing should detract us from the goal of being the best network in the UK. You are clearly the single most important member of the team. Unlike all the rest of as you have almost unlimited resources to improve process. If you need something done all of us directors will give way to your pre-eminence. A compliant advice process 10 is key to it all.”
[132]In his report to the Board for the meeting held on 7 March 2012 Mr Palmer reported that the internal running of the organisation was smooth and he felt that he had an excellent team.[133]However, shortly after the Group had been informed by the Authority in a letter 15 dated 10 April 2012 that the firm continued to pose a risk of providing unsuitable advice to retail customers based on a sample of Financial’s pension switching advice files and shortly before the Authority’s proposed supervisory risk assessment visit (the “Arrow visit”) which took place in May 2012, Mr Palmer sent an email to himself (which was a draft of an email intended to be sent to a compliance consultant 20 present at the meeting referred to in the draft) expressing the view that he had :
“… suddenly [seen] steve bell as a weakness… Steve is probably out of his depth: he is reacting to punches and is not on the front foot with his agenda. That is something I will have to deal with over 2012 and one way or another bring it to a conclusion. In the short term I need to get him on the front foot before the 25 arrow and get him on top of his agenda and getting the FSA to back off…. I have admired him and worked with him for 5 years and then in one very long meeting (basically 8 hours…) he let his guard slip, probably as he became tired…”
[134]Mr Palmer then set out in the draft email a list of Mr Bell’s strengths and weaknesses, none of which specifically related to compliance issues. 30135. On 16 July 2012 in an email to Mr Bell Mr Palmer said that he was unhappy with Mr Bell’s work, had lost confidence in his ability and without improvements he would have to leave the organisation. In particular, Mr Palmer told Mr Bell that he worked “for the IFAs not the FSA” and that he should “Get the IFAs in to line, get them on your side, get behind them…”. 35136. Despite these expressed concerns, in his Chief Executive’s report for the meeting to be held on 27 June 2012 Mr Palmer said: “I must single out Steve Bell in compliance who has brought this organisation from the brink of disaster to being well within our peer group in many ways. Steve’s journey has been as long as mine and this has meant great change in his 40 job role and he has met the challenge to change every time.” 31[137]On 30 July 2012, Mr Palmer referred to his interaction with the Authority at the Arrow visit and said “When I am interviewed by FSA they say that I lack understanding of compliance issues – and that is in part your fault. I feel like I have been machine-gunned by kpis, stats and facts.” In the same email, Mr Palmer told Mr Bell not come to him with problems 5 without solutions.[138]On 13 August 2012 Mr Palmer emailed Ms Grigg stating that he was keen to recruit a compliance and risk director which would have an impact on both her and Mr Bell’s current role. In December 2012, the Group appointed Mr Richard Warrington as Risk and Compliance Director to replace Mr Bell. 10 Ms Grigg[139]Ms Grigg joined the Group in March 2009. Between 29 June 2009 and 14 February 2014, she held (at various times) a number of significant influence functions at the Firms including CF 1 (Director) at the Firms. Throughout her employment, Ms Grigg reported to the Group’s Board and Mr Palmer as CEO. In addition to her role as 15 CF 1 at the Firms, Ms Grigg had held the CF 10 function (Compliance oversight) and the CF 28 function (Systems and controls) at Investments from 26 March 2010 until 16 January 2013. Ms Grigg performed a variety of roles within the Group. In March 2009, she was appointed Head of Operations for the Group, from June 2009 she became Commercial Director, from February 2010, she was Managing Director of 20 Asset Management at Investments.1 In February 2011 Ms Grigg was appointed by Mr Palmer as the Group’s Risk Management Director, following the reorganisation that took place following the 2010 Final Notice to Mr Palmer.[140]The paper put to the Group’s Nomination and Remuneration Committee supporting the proposal for a Risk Management Director observed that whilst the 25 whole Board is responsible for managing risk, it was increasingly common to appoint a Board level director to ensure that risk management is embedded into all business areas. A detailed Job Profile was created for the Risk Management Director. The main duties set out in this profile were described as follows:(1) Planning, designing and implementing an overall risk management 30 structure for the organisation;(2) Ensuring the business identifies and documents all quantitative and qualitative risks affecting the business, as well as risk appetite;(3) Through chairing the Risk Committee2, ensuring that all risks were considered and controls were identified to mitigate the risks, where 35 appropriate; 1 However, in an email of 30 November 2010 to Mr Bell, copied to Ms Grigg, Mr Palmer asked Mr Bell to deal with a particular compliance matter concerning Investments, remarking that although Ms Grigg was "down as compliance officer of [Investments] … I think you need to do the work, or be in charge of it." 2 Whilst the Job Profile refers to the Risk Director as chairing the Risk Committee, the Terms of Reference of the Risk Committee refer to it being chaired by a non-executive director. 32(4) Ensuring that management consider and document all inherent risks in business proposals;(5) Ensuring the Board receives sufficient management information from all business area to understand and manage significant risks;(6) Managing insurances taken out 5 to mitigate risks;(7) Acting as a focal point for all communications with the Authority and reporting to the Board on any significant regulatory developments;(8) Managing internal audit activities and ensuring the audit program was designed to focus on areas of greatest risk; and 10(9) Ensuring that the Group achieves the TCF consumer outcome 1:
“Customers can be confident that they are dealing with a firm where the fair treatment of customers is central to the corporate culture.”
[141]Despite this widely-drawn job description which, as Mr Herberg submitted, was entirely appropriate and familiar for a risk director, as Mr Palmer accepted in his cross 15 examination the actual role she was expected and encouraged by Mr Palmer to perform was, in fact, much more limited. In particular, Mr Palmer saw it as a very narrow job, just involving PI insurance, building a risk register and forming a committee dealing with the Authority. He said that he did not regard it as a particularly challenging job. Despite the reference in the job description to ensuring 20 that the Firms met TCF (treating customers fairly) consumer outcome 1, Mr Palmer’s evidence was that Ms Grigg was never intended to have responsibility for dealing with customer risk which he said was within the remit of Mr Bell as Compliance Director. In effect, the position was that although on paper there was a separate Risk Director and Compliance Director in practice Mr Palmer saw most of the matters for 25 which Ms Grigg was given notional responsibility as falling within the scope of Mr Bell’s remit. Mr Palmer accepted that he had put an emphasis on form over substance, in order to demonstrate to the Authority that the Group had implemented the kind of systems and controls that the Authority would consider appropriate.[142]This is further illustrated by an exchange of emails between Ms Grigg and Mr 30 Palmer following Ms Grigg’s appointment as Risk Management Director in February 2011. Ms Grigg raised concerns about her continuing to perform operational roles which she would be responsible for assessing as Risk Management Director. Mr Palmer’s response was that the Group was too small to separate the roles and that he was “already thinking up other useful operational work you could do for me while 35 also doing these other roles. SO you will be getting more operational work, not less.”[143]Although Ms Grigg maintained a risk register as provided for in her job profile, because she and Mr Palmer understood her role not to include customer risks it did not deal in any detail with customer risks, although Mr Palmer said in his evidence that the risk register “restricted itself to all risks that the business faces, one of which 40 was mis-selling to customers”.[144]As we have previously mentioned, Ms Grigg was disciplined by the Authority. Ms Grigg agreed to a settlement with the Authority in a Final Notice dated 11 33 December 2015 which found that Ms Grigg failed to comply with Statement of Principle 6 while performing the significant influence function of CF 1 (Director) at both Financial and Investments during the period from 1 February 2011 to 27 November 2012.[145]The Authority found that Ms Grigg did not properly 5 understand her responsibilities as Risk Management Director and failed adequately to identify, manage or control the material risks arising out of the Firms’ business model. The Authority found that Ms Grigg failed to implement an adequate risk management framework to identify, measure, manage and control the risks to which the Firms’ 10 business was, or might be, exposed. In particular, the Authority criticised the fact that the risk register did not adequately identify all material risks to the Firms’ business, particularly risks in respect to underlying customers. The Authority found that Ms Grigg took the view that the risks to underlying customers, and the effective management of those risks, were entirely the responsibility of the Compliance 15 Director and failed to recognise that they fell within her own responsibility and failed to appreciate the need to ensure that the risk management framework operated by the Firms dealt adequately with the increased risks to underlying customers which resulted from the freedom and flexibility afforded by the Firms’ business model. The Authority therefore did not accept the distinction which Ms Grigg sought to maintain 20 between commercial and customer risks in terms of her own responsibility. The Authority found that Ms Grigg’s’ report for each Group Board meeting focused on what she regarded as commercial risks to the Firms’ business and therefore did not give adequate emphasis to risks to underlying customers.[146]As regards the risk register, the Authority found that it was not appropriate to 25 omit risks to underlying customers on the basis that these would be dealt with elsewhere, but it did find that the risk register did deal with some customer risks and in some cases recorded Ms Grigg as the risk owner alongside the Compliance Director. The Authority found that this was inconsistent with Ms Grigg’s representation that the risk register was not primarily a tool for identifying risks to 30 underlying customers, or that she was not responsible for testing the information recorded in the risk register in relation to them.[147]In our view, there was nothing in Mr Palmer’s evidence to contradict the findings made by the Authority in Ms Grigg’s Final Notice regarding the risk register.[148]The Final Notice made some findings regarding Ms Grigg’s responsibility in 35 relation to internal audit. We return to the question of the internal audit function later, but the Authority found that as mentioned in a job description, Ms Grigg had specific responsibility for internal audit at the Firms and therefore would have expected her to ensure that the internal audit activities tested independently the adequacy and effectiveness of the Firms’ systems and controls. 40 149. The Final Notice recorded that in July 2011 the Group Board decided that the Firm should not appoint an individual to hold the CF 15 (internal audit) controlled function (which in any event by that time did not exist as a controlled function) but that did not mitigate Ms Grigg’s responsibility, as Risk Management Director, for 34 assessing the effectiveness of the Firms’ systems and controls for identifying and managing risk. The Authority found that Ms Grigg failed to take any steps to put in place processes to assess the effectiveness of the Firms’ systems and controls for identifying and managing risks and no internal audits of any of the Firms’ systems and controls 5 were undertaken.[150]The Authority found that Ms Grigg was aware that she was required to manage internal audit activities and that in October 2011 she indicated in an email to the Group Finance Director that she was unsure how to carry out internal audit activities due to time constraints. The Final Notice also recorded that the Firms’ assessment of 10 its capital adequacy in 2011 stated that the Firms operating procedures were regularly reviewed by “internal audit” and Ms Grigg failed to follow up her observation that it was incorrect to refer to the “internal audit function” as the Firms did “not really have one”. Ms Grigg was also criticised for failing to have assessed the effectiveness of internal review procedures which were relied upon to ensure the integrity of 15 operational functions in the absence of an internal audit function. The Firms’ Systems and Controls in practice[151]During the Relevant Period, the essential elements of the Firms’ systems and controls over the ARs involved the following:(1) A process to determine whether prospective ARs and their 20 representatives were suitable to act for the Firms. The policy was only to take on advisers that the Firms regarded as high quality advisers with sufficient experience. Responsibility for making decisions on recruitment ultimately rested with Mr Bell; Mr Palmer’s evidence was that he never overruled Mr Bell’s decisions on this issue, a point which we return to 25 later. The evidence shows that a large number of applicants to the network were rejected.(2) Adviser induction training courses as well as additional training for advisers, the latter being voluntary except where attendance was required because of poor performance. 30(3) Monitoring processes, involving file checking, annual compliance visits by Regional Compliance Managers (“RCMs”) which included competency assessments and periodic desk-based reviews by RCMs of management information received on adviser performance and risk assessments. 35(4) A licensing system, consisting of a general licence or “a minimum standard achieved” licence which covered generic product groups, such as investments, pensions, mortgages and insurance products and a specialist licence, granted for high-risk products, such as pension transfers and income drawdown. 40(5) Requirements for ARs to enter on to PHOSSIL information regarding their turnover (that is monies received from product providers and lenders) and details of each product sold to each customer. PHOSSIL 35 relied upon advisers ensuring that they had inputted and updated their new business and turnover figures accurately and on a regular basis. Advisers were monitored based in part on the information they recorded and the vast majority of the Firms’ Management Information was extracted from PHOSSIL. The minutes of the Compliance and Regulatory 5 Committee meeting in June 2010 record that there was a need to check whether ARs were putting sufficient information on PHOSSIL but that it was labourintensive to do so for all ARs so would be done on a spot check basis, with each AR getting at least an annual check on one month’s commission 10 statements compared to entries on that month’s bank statement, for example. The same minute referred to the possibility that the Group could make PHOSSIL input accuracy something which the RCMs could check on their annual visits which could involve input accuracy for both new business and turnover, for example. 15(6) Checks to ensure that entries on PHOSSIL were up-to-date and accurate, including checks on bank statements which were sent direct from advisers, their banks and providers to the Firms’ Head Office every month and checks on provider commission statements which were provided directly by product providers on an annual basis. 20(7) Management Information provided to the Board through numerous reports and papers many of which formed part of Board packs, including Compliance Director Reports, TCF & Compliance Management Reports and Systems and Controls reports. The Board also reviewed the Risk Register on a monthly basis. 25(8) The monitoring of complaints data through PHOSSIL by the Compliance Director and through various reports, such as the TCF & Compliance Management Report.[152]As far as file checking was concerned, all products were risk categorised as high, medium or low and this categorisation was used to assist with the file check 30 selection. Advisers’ files were automatically selected for checking by the PHOSSIL system from the entries on the AR’s new business register. Mr Palmer’s evidence was that file checkers were expected to complete 4 or 5 file checks each day and around a 100 a month and that he was proactive in ensuring that the Firms maintain this level of review and that the team had sufficient resource. We return to that issue later. 35 153. In terms of monitoring the effectiveness of the processes described at [151] and [152] above, in many firms this responsibility would fall to an internal audit function which typically would make reports to the firm’s Audit Committee as to the effectiveness of the firm’s internal controls. Indeed, as described at [112] above, Moore Stephens’ 2008 skilled person’s report included such a recommendation. As 40 we have seen, the Group did have an Audit Committee during the Relevant Period but it did not in practice keep under review the Firms’ internal control policies and procedures despite that function falling within the Audit Committee’s terms of reference. 36[154]There was a dispute as to whether in fact the firm had an internal audit function at all throughout the Relevant Period. The Group did have a dedicated internal audit function until January 2011, latterly under the leadership of a Mr Dunn. Mr Palmer’s evidence was that Mr Dunn did carry out the task of auditing various departments but that Mr Palmer felt that it added no further value because 5 the Group only had 60 employees so that the department was “struggling to find a job for itself.” Mr Palmer’s view was that despite Moore Stephens’ recommendation it was highly unusual for a firm of the Group’s size to have an internal audit function and that it was very difficult to find enough for them to do. Mr Palmer’s view was that Mr 10 Dunn’s reports were of limited value and most of the problems he was picking up were known about anyway. Accordingly, the Board made the decision to disband the department in 2011 following Mr Dunn’s departure led, Mr Palmer says, by the nonexecutive Directors but opposed by him personally.[155]We do not accept that Mr Palmer made his views known to the Board that he 15 personally was against disbanding the function, bearing in mind his view that the size of the business did not justify a separate department and that it ran out of things to do. Indeed, it seems questionable that the Board made a formal decision to do without the function, bearing in mind the Authority’s finding in its letter of 5 October 2012 following the Arrow visit that the then Chairman of the Group was unaware that the 20 Group no longer had an internal audit function.[156]What appears to be the position is that in theory there continued to be an internal audit function if only because it was referred to in Ms Grigg’s job profile and, as we have seen, this profile included amongst her responsibilities the management of internal audit activities. Furthermore, as referred to in Ms Griggs’s Final Notice, in a 25 paper assessing the Group’s capital adequacy in 2011 which was contained in the November 2011 Board papers, reference was made to the Group having in place standard operating procedures for the majority of functions across divisions which are regularly reviewed by internal audit and that evidence is sought by the internal audit department that the correct steps are being taken. Mr Palmer accepted that he was 30 involved in the preparation of this document and also that this description of the position was not correct. Mr Philipps submitted that the internal audit function was the responsibility of Ms Grigg after her appointment as Risk Management Director and this was recognised by her in her email of October 2011 referred to at [150] above. He also referred to answers Ms Grigg gave when interviewed by the Authority 35 to the effect that the reports to the Board would have included any internal audit findings.[157]However, Mr Palmer recognised himself in his annual performance assessment of Ms Grigg prepared in August 2011, the difficulties caused by Ms Grigg holding the internal audit function. He said in this document: 40 “The internal audit function is a CF with the [Authority] and cannot held by director with a governing function as well. This makes it difficult for [Ms Grigg] to hold this role. The alternative suggested by [Ms Grigg] is to undertake some informal quality checking which will help.” 37[158]The statement clearly recognises that internal audit was in theory one of Ms Grigg’s responsibilities but that in practice she could not perform it as such, although the statement does also illustrate Mr Palmer’s lack of appreciation of the fact that by this time internal audit was no longer a controlled function. The statement does, however, illustrate that Mr Palmer expected that as part of her 5 role Ms Grigg would undertake “informal quality checking” instead. The minutes of the Board Meeting held on 28 September 2011 also referred to the fact that the function could not be held by a person also holding a governing function and recorded that “it was not considered necessary to fill this function currently, due to the size of the Group.” 10 159. Therefore, although we find that in theory there was an internal audit function we can find no evidence of it actually operating in practice during the period of Ms Grigg’s responsibility for it and, it would appear, bearing in mind Mr Palmer’s views that an internal audit function was unnecessary and that in practice no reports were made to the Audit Committee as regards internal controls Mr Palmer did not at any 15 time ask Ms Grigg what she was doing in relation to the internal audit function. This is consistent with the findings in Ms Grigg’s Final Notice that she failed to take any steps to put in place processes to assess the effectiveness of the Firms’ systems and controls and no internal audits of any of the Firms’ systems and controls were undertaken. 20 Events during the Relevant Period[160]As mentioned at [108] above, following the disciplinary action taken against Mr Palmer in 2010, Mr Palmer commissioned two past business reviews concerning the Firms’ advice on pension switching and agreed to the appointment of a skilled person to validate these reviews. 25 161. The skilled person, Smith & Williamson, produced a draft report in June 2010 detailing the work it had performed in reviewing a sample of customer files reviewed by Financial as part of its past business review. Of the 11 customer files sampled, all of which had not been assessed by Financial as a “fail” 6 customer files included initial ratings of “unsuitable” whilst 10 customer files included initial ratings of 30 “unclear” (more than one file included more than one type of rating for different areas reviewed per file). The report said that these initial ratings were being investigated further with Financial in order to assess their final ratings.[162]The Minutes of the Board Meeting held on 9 September 2010 record that Mr Bell noted that the Group now had advisers leaving the network citing the tight 35 compliance regime as one of the reasons, which Mr Bell took as a good indication that the systems and controls were working and that those who found them onerous were leaving, invariably to go directly authorised where the monitoring was less frequent. Mr Bell observed that network compliance should not be seen as a “business prevention” unit but as a helpful regime for advisers to write compliant business. 40 163. However, when asked by the Chairman what was concerning him most at the moment, Mr Bell responded that the span of control for file checkers and RCMs is something he is constantly monitoring. He said that the spans have got quite high until 38 recent recruitment, and had resulted in backlogs in file checking which should be cleared in the near future. However, the minutes of the Board Meeting in October 2010 record that there was a backlog of files to be checked and that the Authority had asked for details, “which indicates the information may have been leaked.”[164]The minutes of the September Board Meeting also record that 5 Mr Bell drew the Board’s attention to the statistics regarding rejections of applicants which showed that 25% are rejected before they get to the application stage. This, in Mr Bell’s view, demonstrated that the quality of advisers taken in was high.[165]It was clear from Mr Palmer’s Chief Executive’s Report to the Board in 10 November 2010 that he recognised that the Authority had continuing concerns regarding the Firms. He records as a key risk that pressure from the Authority “intensifies further” and that the “outcome of the past business review on pension switching has significant uncertainty”.[166]The Group’s business plan for 2011, prepared by Mr Palmer, under the heading 15 “Our strategic priorities for 2011” stated “Focus on what the IFA wants and needs. This means not doing what we think is right for them, but doing what they ask us for.” The document went on to say that 2011/2012 was “the year to focus on the IFA” and to “consider every decision and ask “how will it benefit the IFA?””[167]Mr Palmer’s concerns regarding pressures from the Authority on the business 20 are further reflected in his Chief Executive’s report for March 2011 where he stated “[the Authority’s] intrusive and intensive supervisory style can be a distraction because ultimately we have to run the business for the benefit of consumers, not for the [Authority]! Hopefully Paivi’s appointment will help with this.” However, in his Chief Executive’s report for May 2011 he stated that “[the Authority’s] intrusive and 25 intensive supervisory style is welcomed as it helps to align our own interest with the [Authority]. Our business is regulation – so we expect nothing less! Some of the work has been relatively time-consuming and Paivi Grigg’s appointment as Risk Director has helped in this respect.”[168]The minutes of the Board Meeting held on 18 May 2011 recorded a discussion 30 on Mr Bell’s report in his capacity as Managing Director – Networks. In particular, Mr Bell referred to steps taken to terminate the appointment of two high-risk ARs and that the high rejection rate of candidates continues, showing that Financial requires advisers to have high standards. He also reported that after clearing the file check backlog the previous month, it had not built up again and in response to a question 35 from the Chairman stated that if file checkers deem advice given to be unsuitable, the network will take action to ensure that the case is unwound. Mr Bell also referred to the past business review and that Smith & Williamson had agreed with Financial’s assessment in the majority of cases.[169]The minutes of the same meeting record comments made by the Authority at its 40 interview of Mr Hayter, the new non-executive director of the Group, to the effect that it saw the most critical issue as being the effective monitoring of advisers and the systems and controls around it. 39[170]Ms Grigg’s report as Risk Director made to the Board for its meeting on 20 July 2011 refers to a recent meeting with the Authority at which it was made clear that the Authority considered Financial to be a high-risk firm, due to outstanding issues with HMRC (not related to compliance) and the past business review. Ms Grigg referred to the fact that there was unlikely to be any abatement from the constant 5 and intrusive supervision experienced in the last few months and that the Group should expect some action by the Authority to verify that the new controls and processes are having the desired impact on consumer outcomes.[171]It was at this point that the Board became aware of UCIS sales being shown to 10 pose risks to the Group. Mr Bell reported that a member of the network was under investigation with regard to the sales of UCIS to 31 clients and that the Authority had identified UCIS as an emerging risk. The minutes of the Board Meeting held on 28 September 2011 recorded Mr Bell reporting that UCIS were becoming a focus, both for the Authority and for Financial and that Financial was now pre-checking all UCIS 15 business. Ms Grigg reported that Financial will now be part of the Authority’s thematic review of UCIS sales.[172]Mr Palmer did appear to recognise potential difficulties in Mr Bell having sales responsibilities as well as being responsible for compliance. At the July 2011 board meeting, he reported that the Board was looking to recruit a sales director which 20 would have the result of freeing up Mr Bell from sales responsibilities and “prevent a potential conflict of interest as he is in charge of all the compliance of our organisation and sales targets do not always align with compliance targets!” The minutes for that meeting recorded that Mr Brian Galvin had been appointed to the position and that Mr Palmer said that “all areas are running well and he rarely has to 25 get involved in detailed management, therefore leaving more time for strategic thinking.”[173]It is clear that during 2011 Mr Palmer became more exercised by what he perceived as the Authority’s intrusive style of supervision. The Executive Management Meeting log records that on 5 September 2011 Mr Palmer reported on 30 his meeting with his local MP where he raised the “extreme level of regulation in the financial services industry, and the intrusive supervision practised by [the Authority]”. The note records that the MP had little sympathy with the arguments and saw tight regulation as achieving consumer protection. On 22 September 2011, Mr Palmer emailed Ms Grigg to observe that he was concerned that “we spend so much time 35 dancing to the fsa’s tune that we forget how to run the biz.”[174]There were other indications that Mr Palmer could find the impact of regulation frustrating. On 31 October 2011, the Sales Director informed Mr Palmer that Mr Bell was refusing to allow an AR to join the network because, among other things, he had failed the competency tests. Mr Palmer’s response was “I get worn down fighting 40 these battles… I can’t understand the risk.” He referred to the fact that the individual would be working abroad so he did not see that it was a concern of the Authority and went on to say that the individual would provide “real easy money” would not stay with the network for more than a year anyway “so I can’t see he can do any damage in that time.” He then said that he had been told by somebody else that “he is a good guy 40 just can’t do paperwork.” Mr Palmer did, however, recognise in this email that he could not overrule Mr Bell and there is no evidence that he did so on this occasion.[175]In a similar vein, on 11 November 2011 a director of one of Financial’s ARs sent Mr Palmer a link to a paper on risk to which Mr Palmer’s response was “I try not to think too hard about risk” and observed that Ms Grigg was 5 the risk director.[176]The minutes of the Board meeting held on 28 September 2011 record Mr Palmer as stating that whilst the Authority is very demanding on management time “its intervention is welcome, as it provides a barrier to entry into direct regulation and brings business to the network.” These are very much the words of Mr Palmer, the 10 salesman. As the minutes of the Board meeting held in February 2011 record, Mr Palmer stated that his strongest skills lay in marketing and sales and that he was looking to take a more active role in those areas of the business. Mr Palmer’s report tabled at the September 2011 Board meeting referred to the “number and aggression of recent [Authority] emails which put to bed any notion that we might have it slightly 15 easier.”[177]The Executive Management Meeting log records that on 10 October 2011 Mr Bell gave an update on how the review of UCIS sales which the Authority had asked the Group to undertake was progressing and reported that from responses received from ARs so far it appeared that there was no widespread usage of UCIS in client 20 portfolios.[178]Mr Palmer’s focus on strategic matters is again demonstrated by his report recorded in the minutes of the Board Meeting held on 7 March 2012 that “internal running of the organisation is smooth and he feels he has an excellent team around him. With the business running itself it would be an ideal time to look for mergers and 25 acquisitions.”[179]At the same meeting, it was reported that one of the RCMs had been seconded to the sales team with a view to increasing the number of leads.[180]The 2012/3 Business Plan for the Group, prepared by Mr Palmer, was prepared at this time and considered by the Board at its meeting on 25 April 2012. The plan 30 described the key theme for the year as being “to move the organisation from being compliance led to being advice led.” It explained what it meant by this as follows:
“This means that we will be looking to engage more with consumers, gather more feedback from them and rely less on auditing compliance solutions as a method of improving customer outcomes. Instead we will look more closely at 35 our IFAs business models and their holistic advice shape and seek to influence the look of that advice. In practical terms this means that we can expect to see more control over the investments recommended. This may mean that customer money is invested in fewer but larger firms that have perhaps a greater perceived control over the risks they may take with a customer’s money.” 40 181. This theme was reiterated later in the plan where it was stated that the Group wanted “to be closer to our end consumers and to engage more in the end solution that 41 is delivered face-to-face by our IFAs”
. It was also stated that “consumer protection is the single most important part of our work and the theme for this business plan is aiming to move the organisation from a compliance base to an advice base – which means looking at the outcomes for customers more than the output of advisers.”[182]The plan recognised that management information on (5 TCF) was lacking, in particular in relation to the end consumer. Mr Bell was charged with producing a paper for the Board demonstrating how improvements will be made to management information and that there would be a customer contact exercise in order to gather improved consumer management information. 10 183. On 14 February 2012, Mr Palmer remarked to Mr Bell in an email that he was pleased that file check times had reduced “because it seems to me to be a straightforward logistical exercise.” Mr Palmer stated that he would like to see it further reduced over the next 6 months and wanted Mr Bell to work on ideas to achieve that. However, the minutes of the Board Meeting held on 7 March 2012 15 report that there was a backlog of both remedial work and monitoring, but that the recent recruitment of a new file checker would alleviate that.[184]On 10 April 2012, the Authority wrote to Ms Grigg informing her that it had now completed its assessment of a sample of Financial’s pension switching advice files. The letter set out the results of the assessment and the action it wanted Financial 20 to take as a result of the findings, which included taking remedial action to deal with those files where unsuitable advice and more general weaknesses had been identified. Based on the sample of files reviewed, the Authority considered that Financial continued to pose a risk of providing unsuitable advice to retail customers, specifically in consideration of the client’s attitude to risk and ensuring that any funds 25 selected do not expose the client to a level of risk not commensurate with their personal tolerance. The Authority expressed the view that there were weaknesses in the file checking process.[185]This letter was referred to in Mr Palmer’s Chief Executive’s report to the Board for its meeting on 20 April 2012, where Mr Palmer reported that the Authority had in 30 effect found that the Group’s fact-finding was deficient which stemmed from a lack of standardisation of documents. Mr Palmer expressed confidence that the Group could respond to the Authority in an “appropriate tone”.[186]In the same report, Mr Palmer referred to the UCIS review and that the Group needed to be better at anticipating high-risk areas. Nevertheless, he expressed 35 confidence of the actions taken in recent years by the Group over UCIS and was comfortable with the current approach.[187]At this time, the Group had begun to prepare for the forthcoming Arrow visit by the Authority. The Group had engaged a compliance consultant, Mr Tom Williams, to assist in these preparations. The assessment took place between 15 and 24 May 2012. 42[188]Mr Williams was given examples of the Group’s Board Packs in respect of which he made the following comments in an email to Mr Palmer on 7 February 2012:
“…the place [the Group is] most exposed is in relation to TCF MI (endcustomer satisfaction/number of clients per RI & firm,/5 product line spread by percentage by individual etc …). Lack of end customer MI is likely to leave you exposed to [Authority] criticism at ARROW – they are bound to ask how you can demonstrate embedding of TCF principles and are likely to aim that question at the NEDs” 10 “Reading all of the papers there is an underlying theme of being critical/ of the [Authority] and driving that point home time and again – suggest you change tone of Board minutes (and other docs) to reflect factual information only followed by considered response and then Board decision (leave all rhetoric or ancillary comment out of the equation as it suggests an anti- 15 [Authority] culture)…”
[189]Although Mr Palmer indicated when circulating these comments to EMT that they should be discussed, we have not seen the outcome of any such discussions.[190]On 8 May 2012 Mr Palmer sent an email to himself setting out the key messages he wished to give to the Authority during the forthcoming visit. He wished 20 to emphasise the high number of applicants to the network who were rejected and that the harder the Authority pushed the more likely it was that IFAs would seek direct authorisation. He referred to the fact that ARs constantly complained to the Group of “the compliance grief that we give them.” He also referred to 25% of all files being checked, including all high-risk areas, improvements in file checking that are taking 25 place since the last past business review, that customer focus was a key component of the latest business plan and that 100% file checking would be expensive for the AR and would drive IFAs to seek direct authorisation from the Authority.[191]In his Chief Executive’s report to the Board for its meeting on 27 June 2012, Mr Palmer made some observations on the ARROW visit. He expressed the view that the 30 visit “went very well”, although he expressed disappointment that the Authority had said that a skilled person report may be required in three of the four areas examined. He did, however, express the view that all issues with the Authority could be resolved. The Authority had clearly identified that Mr Palmer had not been formally approved as CEO and communicated that to Mr Palmer who expressed the view that 35 he would be facing “an uphill battle to get authorised.” It would appear that this view was based on the fact that he would need to undertake a challenging interview for the position with the Authority. In the same report, however, he expressed the view that “the [Authority’s] intensive and intrusive approach to regulation is here to stay and is compounded as a result of Financial’s past issues. The only way forward is to work 40 with the regulators and constantly improving standards within the industry.”[192]At the same meeting, Mr Bell reported an area of concern in that backlogs of files for monitoring had accumulated, caused largely by the 100% pre-sale checking of pension switching files, which was instigated by the Authority following its review 43 of the pension switching cases. He stated that the movement of resources into presales checking had also created a large number of remedial cases which were forming a backlog and that most of the file failures (which amounted to 30% of all files reviewed in the first instance) were caused by documentary deficiencies resulting in a drive to 5 improve file quality.[193]Ms Grigg’s own report to the Board as to the Arrow visit at the same meeting was less positive than Mr Palmer had been. She reported on the initial feedback given to the Group by the Authority after the meetings and which was reflected in the Authority’s formal report on the visit referred to below. 10 194. By the time of his Chief Executive’s report to the Board for its meeting on 31 July 2012, Mr Palmer appeared to have appreciated the serious criticisms of the Group that would be contained in the visit report. Mr Palmer said that the Authority should be pleased that the Group was working mostly to the Authority’s objectives of increased compliance, improve process, better decisions and anticipation of risk and 15 improved adviser controls and he expressed agreement with the Authority’s approach in the light of the anticipated growth of the Group.[195]On 31 July 2012, the Authority wrote to Mr Palmer with the results of its thematic review visit to Financial regarding UCIS. The Authority referred to its concerns in respect of UCIS activity in its report issued in July 2010, following 20 previous thematic work with a number of small investment firms and also its ongoing concerns expressed in other publications issued in 2011 and 2012 regarding the risks posed to retail customers by the promotion of UCIS.[196]The conclusion reached by the Authority was that its review identified serious concerns around Financial’s historic and current UCIS promotion and selling 25 practices and its systems and controls. In particular, the Authority identified the following shortcomings:(1) prior to January 2011 the firm was unable to identify all UCIS transactions consequently senior management did not know the level of UCIS business being written which resulted in the firm being unable to 30 undertake appropriate risk-based monitoring of these high-risk transactions;(2) the firm did not carry out due diligence centrally into UCIS funds so that each AR carried out its own due diligence, suggesting that the firm had not adequately considered which UCIS investments may be 35 appropriate for its ARs’ client base resulting in an increased risk of unsuitable sales;(3) virtually all of the files reviewed showed shortcomings in terms of promotion, suitability and disclosure; and(4) the firm failed to ensure that advisers were adequately trained and 40 competent to provide advice on UCIS historically. 44[197]Following this letter, Financial voluntarily agreed to conduct an internal past business review of the Firms’ past sales and promotions of UCIS funds. On 13 August 2012, Mr Bell drafted a response to the Authority’s findings which accepted the findings around failings in business monitoring, training and competence and due diligence. He said that 89% of UCIS transactions reviewed to 5 date had been found to be potentially unsuitable.[198]By September 2012, Mr Palmer had appeared to recognise the limitations of network models. The minutes of the meeting of the Board held on 26 September 2012 record the following observations from Mr Palmer: 10 “There is concern that the network model is becoming infeasible [sic] and a better direction would be a national adviser firm with heavily restricted offering… strict controls. Much more support would have to be provided to the advisers and for that c. 40 – 50% of the fee income would need to be charged for central services. This is likely to provide a model that is more beneficial to the 15 consumer, as mis-selling would be minimised, and more profitable for the Group. However, such an offering may not be attractive to the current day IFA, who fiercely defend their independence.”[199]On 5 October 2012, the Authority wrote to Mr Palmer with the results of the Arrow visit. The report was highly critical of the Group’s systems and controls, risk 20 management and governance. The overall assessment was that the Group “poses a high risk to our objectives and we have set out below a number of serious concerns” with “evidence of significant weaknesses in adviser controls that the Group should have identified and addressed”.[200]There was also strong criticism of both Mr Palmer and the non-Executive 25 Chairman of the Group. The Authority found that they did not demonstrate the level of knowledge of the Group’s business including the risk to consumers posed by the Group that the Authority would expect.[201]The detailed findings on these issues can be summarised as follows: Adviser Controls – the Group does not have adequate controls in place to ensure the 30 accuracy of the information provided by ARs on PHOSSIL, and indeed whether all the required information is actually being put on the system by the ARs in the first place. Risk Management – the Group’s Risk Management was not operating effectively to protect consumers and prevent unsuitable sales. It lacked sufficient pace when dealing 35 with identified risks and was reactive rather than proactive in its approach to risk identification. The Authority said that was evidenced by the time lapse between the Authority publishing its thematic findings on UCIS business in 2010 and the Group acting to mitigate the risks to consumers of this product type. Governance – the report had this to say about board effectiveness: 45 “During our meetings, we were concerned and surprised at the lack of knowledge and awareness of the business, especially the risks that the Group poses to consumers, displayed by both the CEO and the Chair. We were particularly surprised by the inability of both to discuss the result of the [Authority’s] recent pensions switching outcomes-testing 5 and would have expected this to be an important area for Board attention. This concern was compounded by a general inability to articulate the risks affecting the business. For example, the Chair was unaware that the Group no longer had an Internal Audit function, did not know why the current pension switching past business 10 review…. is taking so long to complete and did not appear to understand the concept of unsuitable advice. The CEO was unable to inform us of key issues discussed at the last Board meeting, could not outline a coherent and achievable strategy for the Group and could only suggest one risk faced by the Group. As a consequence, we are unconvinced that the Chair and the CEO have assessed the 15 overall robustness of the Group’s adviser controls or the risks posed to consumers. The Board is heavily reliant upon MI that partly originates from information provided by the Appointed Representatives…. without having adequate controls in place to ensure the quality and accuracy of the information provided. 20 Therefore, there is a significant risk that the Board’s oversight of the controls environment is compromised as the information received as part of the Board MI may be inaccurate and/or misleading. In addition to the above concerns, both the CEO and Chair fail to convince us that the Group has a coherent and achievable business plan in place. The CEO 25 appeared to be working to a different growth strategy than the other Executive Directors, acknowledging that the Group was not meeting its projected growth, but stating that the firm would not review the strategy. We would expect the Board to have a clear and achievable business plan and strategy in place that is uniformly understood by the key personnel within the business.” 30202. As a consequence, the Authority required the Group to appoint a non-executive director with industry and business sector experience and to undertake a Board effectiveness review with focus placed on the Board’s oversight of the controls environment. As we have seen, it was that recommendation which resulted in the restructuring of the Board in October 2012. 35203. It was clear from his cross examination that Mr Palmer does not accept all these criticisms of himself. He said that he was “extremely angry” to be told that he was unable to articulate the risks posed to the Group and that he was “devastated to get the Arrow visit results”. He accepted that the Authority was looking for more granular or specific appreciation of particular risks than he was able to give at the visit, although 40 Mr Palmer was critical of the amount of time he was given to respond to the many questions that were put to him. He felt that Mr Bell had let him down by not providing the answers he needed.[204]Mr Palmer did not accept in his cross examination that there were insufficient controls to mitigate risk from incorrect information being posted to PHOSSIL. He 45 accepted that he had a different view on growth to the other Directors because 46 mergers and acquisitions were more a matter for the shareholder rather than the executive.[205]On 19 November 2012, the Firms were notified that they had been referred to Enforcement and on the same day investigators were appointed in respect of Mr Palmer 5 and Financial.[206]In December 2012, a new Risk and Compliance Director to replace Mr Bell, Mr Warrington, was appointed. Mr Palmer ceased to be CEO of the Group on 20 December 2012.[207]On 11 February 2013, the Authority required the Firms to commission a skilled 10 person’s report to review the effectiveness of the Firms’ systems and controls and risk management framework. The ensuing report, prepared by The Consulting Consortium, was issued on 11 September 2013.[208]The overall findings of the report were that the control environment within the Group was weak. The report identified material deficiencies with both the design of 15 adviser controls and the application of appropriate standards. It found that the absence of robust controls had afforded the Group’s advisers too much flexibility and created an environment which in the skilled person’s opinion increased the likelihood of poor customer outcomes. Similarly, the report found that the Group had not implemented a robust risk management framework, which enabled the firm’s senior management to 20 proactively identify and manage risk.[209]As regards adviser controls, the report summarised the deficiencies found in the following terms:
“  The Network does not set clear procedures and standards of business for Appointed 25 Representatives (ARs) to follow. Upon joining the Network, ARs are permitted to follow their own sales practices, which could be wide and varied across the Network. The risks with this approach are exacerbated by the following: – [the Group] does not take sufficient steps to assess a new AR’s business model and business practices to determine whether or not they are likely to 30 deliver good customer outcomes; – [the Group] does not provide timely and comprehensive training to ensure that advisers understand the minimum standards they are expected to meet; and – Upon joining the Network, [the Group] does not carry out a suitable 35 assessment of an adviser’s knowledge and skills in order to determine their development needs before they begin to advise customers.  We have found that key standards for advisers have been set too low and that monitoring and supervision of advisers lacks sufficient intensity. 47 – The standards for obtaining a licence do not require advisers to demonstrate their ability to produce good quality records which fully evidence the suitability of their advice; – The methodology used to determine whether a licence should be withdrawn is not sufficiently sensitive to trigger a timely 5 review. There is a risk therefore that a licence is not withdrawn despite a down-turn in performance; – The metrics used to determine the risk rating of advisers do not take into account all relevant performance factors and are not based on recent 10 performance information. As a consequence, an adviser’s risk rating might not actually reflect the risk they pose. This in turn might result in the adviser being subject to lower levels of supervision than they should be; – Until recently, where an adviser did not hold a licence for high-risk products they were permitted to give advice before the advice was checked 15 by the Central Monitoring Team.  We have identified a number of weaknesses in the file checking process. Although [the Group] has recently made some improvements, which we support, the changes do not go far enough: – The level of checking carried out historically was too low and did not 20 ensure that a sufficient spread of the adviser’s business would be checked. While some improvements in this area have been made, weaknesses still exist; – Levels of checking are not sufficiently risk-based as they are not influenced by the risk rating of the adviser and do not ensure that a spread 25 of high-risk products is checked. We believe the new levels of checking would only be appropriate for competent advisers that exhibit good standards of compliance and TCF; – There are weaknesses in the file review methodology that make file checking less reliable and there is an increased risk that file checking 30 might not deliver a robust assessment of suitability. From sampling, we identified a number of instances where we did not find the file check to be sufficiently robust, as we did not feel suitability had been fully evidenced.  We found that the supervision of the advisers lacks sufficient intensity and, on the whole, to be ineffective because: 35 – The monitoring carried out by Regional Compliance Managers (RCMs) in the past has not been sufficiently challenging. This is due to both the design and execution of monitoring activity; – Through sampling, we identified a high proportion of instances where RCMs had failed to analyse information on adviser performance, to 40 identify development needs and to take appropriate action; 48 – Generally, there appears to have been a reluctance or inability to undertake appropriate supervisory activity outside of the normal monitoring/supervisory cycle, which for some advisers can be very infrequent. Overall, we feel there is insufficient contact between advisers and Supervisors for the supervision 5 to be effective.”
[210]As regards risk management, the report summarised the deficiencies in the following terms:
“  Regarding risk management, the Risk Management Framework within [the Group] 10 is not sufficiently embedded. The main issues are: – Whilst there is some evidence historically of risk management activity, the Risk Management Framework (RMF) defined by [the Group] in January 2013 has not been fully embedded. The focus of senior management in recent months has been on dealing with risks and issues 15 that have already materialised such as past business reviews and the Risk Mitigation Program issued by the [Authority] in 2012. In our opinion this is taken focus and resources away from developing the firm’s risk management arrangements. This has resulted in key aspects of the framework not being successfully 20 implemented.  Currently [the Group’s] management information is not sufficient to enable senior management to identify and monitor risk effectively;  On a more positive note, we believe that the recent appointment of a new Risk and Compliance Director and 3 new Non-Executive Directors (NEDs) has had a 25 positive impact on the governance of the firm. There is greater awareness of the weaknesses in the firm’s systems and controls and evidence of challenge by the NEDs. We are however concerned about whether these individuals have sufficient capacity to drive through the improvements needed.”
[211]The report set out what the skilled person regarded as the causes of these 30 failings as follows:
“  From a cultural perspective, we believe that [the Group’s] focus has historically been on serving the AR (adviser) rather than the AR’s customers. All of the new NEDs confirmed to us their view that in the past [the Group] had lost sight of who 35 the customer is and in the more recent past the firm has been working to ensure there is a more appropriate balance in respect of serving the AR and meeting its obligations to the underlying customer.  [The Group’s] business model creates an environment where advisers are afforded a high degree of flexibility and as a consequence the Network has lower levels of 40 control. We believe a lack of resources to be a key contributor to the weaknesses set out in this report. We are of the view that the design of some of [the Group’s 49 process and controls have been constrained and influenced by limited resources. It is clear that recent remedial activity has put further strain on resources and as a consequence some of the firm’s internal controls have been weakened, for example quality assurance of the file checking ceased in May 2012 due to a lack of resources. We believe that [the Group] will require additional 5 resources to address the issues set out in this report; however we are concerned that it is not able to commit the financial resources it is likely to need.”
[212]In his cross examination, Mr Palmer accepted the findings in the report as to the weaknesses identified by the skilled person but he did not accept that these 10 weaknesses simply flowed from the flexibility of the business model nor, did he accept any personal responsibility for them.[213]In particular, Mr Palmer accepted that the fact that no quality assurance checking on file checks had been carried out since May 2012 had been down to a lack of resources of which he was aware but said that it would have been unwise for him 15 as Chief Executive to put in this resource over the head of Mr Bell who had not asked him to provide extra resource.[214]In relation to risk management, Mr Palmer accepted that it was necessary to have an internal audit function overseeing the work of the compliance department.[215]It is clear that the findings in the skilled person’s report formed the basis of the 20 findings that the Authority made at the conclusion of its Enforcement investigations against the Firms. These were set out in Final Notices dated 23 July 2014. The Authority found that the Firms breached Principle 3 of the Authority’s Principles for Businesses which requires a firm to take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems. The 25 reasons for these findings were, in summary that the Firms failed to:(1) establish and operate effective systems and controls sufficient to ensure that their ARs and RIs met applicable requirements and standards under the regulatory system, namely: (a) recruitment processes which assessed prospective ARs’ 30 business models and business practices to determine whether they were suitable to act for the Firms; (b) effective training and suitability assessments which would have determined the competence of RIs before they began advising underlying customers; 35 (c) effective supervisory processes which would have ensured that the Firms’ ARs and RIs were appropriately and effectively supervised at all times; and (d) adequate compliance and file checking arrangements appropriate to the size and types of business conducted by the 40 Firms’ ARs and RIs; 50(2) implement effective processes to enable senior management to identify, measure, manage and control the risks that the Firms were, or might be, exposed to in that: (a) the scope and quality of MI provided to the Board and its sub-committees was not sufficient to enable 5 the Firms’ senior management to identify and monitor risk effectively; (b) the Board and the Firms’ senior management team focused on dealing with incidents and issues that had already materialised, rather than proactively identifying and monitoring 10 ongoing risks; and (c) the absence of an internal audit function meant that there was no robust mechanism for assessing the effectiveness of the Firms’ internal systems and controls.(3) implement an effective risk management framework and control 15 framework to ensure that: (a) the material risks to underlying customers arising from the Firms’ business model were identified and understood by the Board; (b) appropriate controls and mitigating measures were put in 20 place in relation to these risks; (c) the effectiveness of the controls and mitigating measures was being objectively assessed; and (d) sufficient, relevant and reliable information was provided to the Board in relation to the controls and mitigating measures. 25 216. The Authority publicly censured the Firms as a result of the breach of Principle[3]The Final Notices stated that were it not for the Firms’ financial positions, the Authority would have imposed penalties of £12,589,134 on Financial and £621,583 on Investments. Issue (1): Whether Mr Palmer breached Statement of Principle 6 30 217. We start by reminding ourselves that the Authority’s case is limited to contending that Mr Palmer acted without due skill, care and diligence in performing his functions as an approved person carrying out the functions of a director (CF 1).[218]As is apparent from the discussion at [54] to [56] above, there is no case that Mr Palmer failed to ensure that adequate systems and controls were put in place to deal 35 with the risks that the Firms’ business model posed to customers or that he was knowingly concerned in the Firms’ breaches of Principle 3 which were found by the Authority in its Final Notices issued to the Firms in July 2014. Personal responsibility for the deficiencies in the systems and controls insofar as they related to compliance systems and controls was found to lie with Mr Bell according to the terms of his Final 40 Notice as summarised at [128] above. 51[219]In our view the contention made by the Authority, as set out at [4 (2)] above shows a degree of conflict with that position by stating that Mr Palmer had responsibility for taking adequate steps to ensure that the Firms put in place an appropriate control framework and an appropriate risk management framework. That contention relates to the Firms’ responsibility to establish 5 adequate systems and controls and as we have said, the Authority does not contend that Mr Palmer had responsibility for that failure.[220]As clarified in the course of argument (and in our view this should have been better expressed in the Authority’s Statement of Case) the basis of the Authority’s 10 case against Mr Palmer regarding the operation of the Firms’ systems and controls is that he failed to respond with due skill, care and diligence in respect of his responsibility as a director, in common with the other members of the Board, in its overall responsibility to manage the risks to underlying customers as a consequence of the risk which arose from the nature of the Firms’ business model. 15 221. As we have found at [102] above, Mr Palmer had assumed the responsibility to monitor the way the Firms systems and controls were operating in practice. In other words, he had responsibility, by virtue of his position as de facto Chief Executive and dominant Executive Director on the Board, of taking adequate steps to ensure that the systems and controls operated according to the terms of the framework that had been 20 laid down by the Board and also that they were operating effectively in practice, with any concerns in that respect being identified and acted upon appropriately.[222]Neither is there any case that Mr Palmer was in breach of any obligation to supervise Mr Bell or Ms Grigg in the performance of their respective duties.[223]Nor is there is any case against Mr Palmer that the Firms’ business model was 25 in itself inappropriate or that Mr Palmer acted without due skill, care and diligence in developing and adopting that business model or failing to modify it. Such a case would be impossible for the Authority to bring, bearing in mind that it was aware of the Firms’ business model at all relevant times, and certainly following its supervision visit in 2008 which led ultimately to the disciplinary action against Mr Palmer in 30 2010. Any such case would therefore have inevitably been time-barred, at least in respect of disciplinary action.[224]Nevertheless, as we have found at [80] above, the Firms’ business model gave rise to enhanced risks requiring very robust systems and controls with constant monitoring as to how they were operating in practice, with the need to make 35 adjustments in the light of operating experience. This is consistent with the findings of the skilled person’s report in 2013, as summarised at [209] above, which found that the risks involved in the fact that ARs were permitted to follow their own sales practices was exacerbated by failures to carry out an adequate assessment of the AR’s business model and practices, training and knowledge and skills on appointment. 40225. In his closing, Mr Herberg accepted that the case is, centrally, whether Mr Palmer failed in his role as de facto Chief Executive to manage the business adequately, in the light of the enhanced risks presented by the hybrid business model 52 operated by the Firms. As Mr Herberg observed, this is consistent with the way that Mr Philipps described the key issue in the proceedings in his opening, that is whether Mr Palmer, recognising as he did that the business model devised by him differed from the “centralised” model adopted by other networks, acted with due skill, care and diligence to be expected of the CEO of the Firms to ensure 5 that the business undertaken by individual ARs was regulatorily compliant. On that basis, notwithstanding the lack of clarity in the Authority’s Statement of Case we are satisfied that this key issue was properly resolvable on the evidence put before us and Mr Philipps did not submit otherwise. 10226. We have therefore concentrated on this central issue in determining whether on the facts Mr Palmer was in breach of the standard laid down by Statement of Principle 6 in the way that he performed his controlled function.[227]In summary, Mr Herberg relies on the following matters which he submits demonstrates that Mr Palmer failed to meet the required regulatory standard: 15(1) Mr Palmer’s inadequate knowledge of the risks arising from the hybrid model which gave rise to the regulatory concerns;(2) Mr Palmer’s failure in relation to setting the Firms’ tone, culture and agenda which were an essential part of his failure to ensure that risks, and particularly customer risk, were being effectively managed by the Firms. 20 The root cause of this was Mr Palmer’s disproportionate and heavy emphasis on the Firms’ ARs as their customers, as opposed to emphasising that the Firms’ customers were, in reality the end consumers. This led directly to preferring the interests of ARs to the interests of consumers and the communication of messages by Mr Palmer which 25 undermined the role that the compliance department was or should have been playing within the Firm and generally set a combative and oppositional tone towards regulation and the Authority;(3) Mr Palmer’s failure to respond appropriately to compliance issues which arose in respect of which he had notice, such as the deficiencies in 30 the adviser recruitment and joining procedures, his lack of appreciation of the importance of the file checking process, and a lack of quality assurance of file checking;(4) Mr Palmer’s failure to respond adequately to the Authority’s concerns regarding the Firms’ management, control and mitigation of risk despite 35 being alerted to them since August 2008 and to respond adequately to the risks posed by UCIS promotion and selling practices;(5) Although on paper, Mr Palmer established a framework to manage risk which included a Risk Director, a risk committee, an audit committee and an internal audit function, as a result of decisions taken by Mr Palmer 40 (or failures to act when he should have acted) and as he knew, that framework did not operate in the manner set out in the written documentation or adequately. As a result, the Firms did not have a risk function that was considering compliance risk nor an audit function 53 monitoring compliance with the result that compliance was effectively left to oversee itself;(6) In the absence of a functioning risk committee, a Risk Director who was considering customer risks and an internal audit function, management information was impaired and was not 5 sufficient to enable senior management to identify and monitor risk effectively;(7) Mr Palmer did not expect Mr Bell to be checking compliance in relation to discretionary fund management carried on in Investments and therefore the control environment in respect of discretionary fund 10 management activity was completely absent; and(8) Mr Palmer’s failure to apply for approval to perform the CF 3 Function (Chief Executive) without good reason.[228]Mr Philipps submitted that the Authority has not made out its case that Mr Palmer failed to exercise due skill, care and diligence in his day job of managing the 15 Firms. His detailed submissions can be summarised as follows:(1) The Authority’s case had changed during the course of the hearing so that the central matter on which the Authority now relied was that the deficiencies in the controls would or should or might have been identified if the Firms had had an effective internal audit function. That reliance was 20 misplaced because it was wrong to say that the Firms had no internal audit function in the Relevant Period. Although there was not a person who was specifically employed to work on internal audit there was an internal audit function and the supervision of that function was part of the risk management function for which Ms Grigg was responsible and there is no 25 suggestion that Mr Palmer failed to supervise, or inappropriately delegated to, Ms Grigg; Ms Grigg understood that she was responsible for internal audit and that if her work in that area resulted in findings, they should be taken to the Audit Committee and then the Board; she knew precisely what she had to 30 do and the Board was entitled to rely upon that. There is no evidence that Mr Palmer was at fault or that he knew or should have known that Ms Grigg was not doing what she was expected to be doing;(2) Whilst matters such as culture or tone potentially come within the ambit of Principle 6 the Authority is guilty of cherry picking a number of 35 small incidents which in themselves do not merit the imposition of a prohibition order. Furthermore, although the skilled person’s report, on which the Authority relied, attributed the control failings in the Firms to their treating ARs rather than end consumers as their customers there was no explanation of how that causal link was said to operate. In any event, it 40 had not been explained why Mr Palmer was wrong to regard the ARs as customers, rather than the end consumers, whilst recognising that the customers of the ARs were the people that both the ARs and the network were bound to protect. It had to be recognised that the network was a compliance business and regulatory compliance was the product being 54 sold to the members of the network in order that they could service their customers in a regulatory compliant way;(3) As regards Mr Palmer’s relationship with the Authority, there was nothing wrong in Mr Palmer’s view that his job was to run the business and he knows how to run his business for the benefit 5 of consumers within the parameters set by the Authority better than the Authority did. Neither did the fact that he did on occasion express frustration and even irritation with the Authority as he laboured under the burden of dealing with its ever closer scrutiny create a valid basis for the Authority to fine or 10 prohibit;(4) The strapline in the 2012/2013 business plan to the effect that the business should be moved from being compliance-led to advice-led was irrelevant because this was a commercial decision rather than a shift to consumer focus; 15(5) Whilst Mr Palmer had accepted that there should have been controls over discretionary management, the responsibility lay with Ms Grigg as CF 10 for Investments and there is no suggestion on the part of the Authority that Mr Palmer knew or should have known that she was not performing that responsibility; 20(6) Whilst it was accepted that customers of the Firms have suffered detriment by the mis-selling of UCIS which was caused or contributed to by the weaknesses in the Firms’ systems and controls, this was not the responsibility of Mr Palmer and there was no case to say that he personally should have caused the Firms to prohibit representatives from 25 selling UCIS earlier than the time that the prohibition was imposed. Mr Palmer wished to ban it but the Board was not prepared to do so;(7) The evidence showed that after the 2010 Final Notice given to him the Chairman was concerned that the Board should be seen to be running the Company although Mr Palmer was the principal voice on the Board; and 30(8) The criticisms made with regard to the way committees operated were simply criticisms of form over substance.[229]We have concluded that whilst the Authority has not satisfied us on all of the issues that it raises we are satisfied overall that the Authority has demonstrated that 35 Mr Palmer failed to act with due skill, care and diligence in performing his functions as a director of the Firms in a number of important respects and that the failings he has demonstrated are serious.[230]As Mr Philipps recognised in his closing submissions, the Firms’ sole business was the provision of compliance services. They were providing those services in the 40 context of a business model that called for very robust systems and controls. The success of the Firms would stand or fall according to how successful those systems and controls were. In the event, the weaknesses and the inability of the Firms to 55 correct them meant that the business model failed and the Firms ceased to carry on business shortly after the Final Notices were given to them in July 2014.[231]Unfortunately, this was a fundamental point that in our view Mr Palmer never grasped. His measure of success was growth and, in particular, the growth in the number of ARs in the network and the fees they could produce, whether 5 that growth was achieved by organic growth or, as he came to believe later during the Relevant Period only by merger and acquisition. In our view the leadership of a network with such a business model required Mr Palmer to show keen and close attention to how in practice the risks to which the customers of the ARs were exposed were being 10 addressed. This would involve continual and proactive challenge to those charged with the responsibility of putting systems and controls in place and operating them so as to be satisfied that the procedures were operating satisfactorily. This is not the same as supervising the performance of the individuals concerned; it is a question of senior management fully understanding the risks to which the business was subject 15 and how in practice those risks were being addressed. The evidence shows Mr Palmer was never anything more than reactive to problems that emerged.[232]It is clear to us Mr Palmer did not regard himself as having that responsibility and in our view the evidence shows that Mr Palmer did not have the necessary skills to discharge that responsibility. This is demonstrated by a number of the findings of 20 fact that we have made as follows:(1) The emphasis he put on his marketing and sales skills and his desire to take a more active role in those areas of the business: see [172], [176] and [178]. Mr Palmer’s assessment in March 2012 that the running of the organisation is smooth has an air of complacency about it bearing in mind 25 that this was shortly before the Arrow visit when one would have expected the Chief Executive to have been devoting his main focus to ensuring a satisfactory outcome to that visit;(2) His comment, recorded at [175] above, that he tried not to think too hard about risk; 30(3) His failure to react to the perceptive comments of Mr Williams recorded at [188] above that the lack of end customer management information is likely to leave the Firms exposed to criticism following the Arrow visit; if Mr Palmer had been fully engaged with the preparations for this visit he would have paid close attention to this comment and 35 ensured that the concerns were addressed;(4) His failure to understand the risk involved in taking on an adviser who had failed competency tests on the basis that the adviser would be working abroad and would not be working for the Group for more than a year as recorded at [174] above, again illustrating the priority given to 40 growing the business over the customer risk posed by an incompetent adviser;(5) Giving Mr Bell responsibilities for sales alongside his compliance responsibilities. As recorded at [172] above, Mr Palmer belatedly 56 recognised the conflict of interest involved, but it was an error of judgement to have created the conflict in the first place;(6) permitting one of the RCMs to be seconded to the sales team with a view to increasing the number of leads: see [179]; and(7) his view that it would be unwise for him as Chief Executive 5 to take the initiative in putting extra resource into quality assurance when Mr Bell had not asked him to do so: see [213]. Clearly, it fell within Mr Palmer’s sphere of responsibility to keep under proactive review the resource that was available to both the compliance and risk functions whereas his 10 evidence on this point was that it was merely his responsibility to react to requests from those who were responsible for the functions in question.[233]In our view the reason that Mr Palmer’s approach to compliance and risk issues was purely reactive was that he did not, as Mr Herberg submitted, have adequate knowledge of the risks arising from the hybrid model. The evidence recorded at [81] 15 to [86] above demonstrates that Mr Palmer was aware in broad terms of those risks. However, it was clear that he was unable to articulate those risks in any detail at the Arrow visit. He accepted as much in his cross examination. We do not accept Mr Palmer’s explanation that he was not given an adequate opportunity to answer the Authority’s questions at that meeting. In our view, his approach to leaving questions 20 of compliance and risk to his subordinates meant that he was inadequately prepared for that meeting. The evidence indicates that he realised that to be the case after the Arrow visit and it is no coincidence that Mr Palmer’s relationship with Mr Bell and his assessment of Mr Bell’s capabilities changed markedly after the Group had been informed in April 2012 of the concerns that the Authority had following the review of 25 the pension switching advice: see [133] above.[234]Mr Palmer’s response to the difficulties encountered at the Arrow visit however was to blame Mr Bell for his own lack of understanding: see [137] above. Again, this demonstrates a failure to appreciate that it is the responsibility of senior management themselves to understand compliance issues, particularly so in a firm whose only 30 business is the provision of compliance services.[235]It is clear that this lack of understanding is to be attributed in part to the fact that Mr Palmer did not respond adequately to the findings that were made in relation to his own disciplinary proceedings in 2010. We accept, as the 2010 Final Notice recognises, that Mr Palmer ensured that on paper wide-ranging changes to the 35 organisation, governance and compliance arrangements were made following Moore Stephens’ skilled person’s report. However, the failings identified in the 2010 Final Notice related to the compliance arrangements surrounding a high-risk product, namely pension switching and, as we record at [107] above, Mr Palmer accepted that he was put on notice of the need for him personally to exercise sufficient oversight so 40 he could be satisfied of the adequacy of controls in relation to the advice given to customers.[236]However, as we have found, there is no indication that Mr Palmer took a proactive role in this respect. In our view this is illustrated by the problems caused to the Group by the promotion and sales of UCIS. As Mr Herberg submitted, while the 57 2010 Final Notice was in the specific context of pension switching advice, the concerns raised in it around senior management oversight could not reasonably have been thought to be limited to the Firms’ pension switching business and this was not contended otherwise by Mr Palmer.[237]It was common ground that UCIS are high-risk products. 5 They can invest in highly speculative and illiquid assets, such as real estate or unquoted securities and undeveloped locations anywhere in the world, derivatives or exotic financial instruments. There could be a concentration of risk in a limited spread of assets, heightening the risk of loss, and restrictions on the ability of an investor to realise his 10 investment, either in respect of how long he is locked in and on what terms he can realise his investment. There may be no guarantees that his investment will be independently and fairly valued. There may be limited controls over conflicts of interest affecting the operator of the scheme in relation to the management and acquisition and disposal of assets which the investor, with no right to participate in the 15 management of the scheme, will not be in a position to monitor. There may be no guarantee that the assets of the scheme would be adequately segregated from the operator’s own assets if no independent custodian was appointed.[238]It is for these reasons that such schemes may only be lawfully promoted to sophisticated, experienced or professional investors who are familiar with this type of 20 investment and are capable of managing the risks involved.[239]As we have seen, the business model did not initially prevent ARs from promoting UCIS nor did it put any extra compliance checks around those products, such as pre-checking of sales until September 2011, as recorded at [171] above. Nor did the Firms’ systems adequately record the number of UCIS recommendations. Mr 25 Palmer accepted in his cross examination that senior management had been slow to react to the risks posed by UCIS sales, bearing in mind the Authority’s publication of its thematic findings on UCIS business in 2010 which in our view should have led Mr Palmer to have taken the initiative in considering whether extra safeguards and controls were necessary, bearing in mind the findings around another high-risk 30 product, pension switching, in 2010.[240]In our view, bearing in mind the risks attached to these products, Mr Palmer should have made himself aware of the levels of UCIS business being written promptly after the Authority’s initial warnings on this issue so that he could consider whether further safeguards were necessary. 35 241. However, Mr Palmer’s evidence was that he wanted Mr Bell to ban the sale of UCIS but the Board would not agree. We do not find that claim to be credible, bearing in mind none of the relevant board minutes recorded discussion on that point, Mr Palmer’s dominant position on the Board and his reference in the 2012/13 Business Plan to UCIS being an issue where exposure was minimal. As the evidence showed, 40 that turned out not to be the case. We therefore find that Mr Palmer must accept personal responsibility for not having reacted to the emerging UCIS issue earlier than he did (such sales were only prohibited following the Arrow visit). In our view this was another issue where Mr Palmer as Chief Executive needed to be proactive 58 particularly bearing in mind his previous experience in relation to the pension switching exercise and this was not another issue that he could leave to Mr Bell to take the lead on. He remained complacent in his view on the UCIS risk as late as April 2012: see [186] above.[242]There are further examples of Mr Palmer’s failure to understand 5 adequately the nature of the risks to customers and the fact that they were not being adequately addressed.[243]As our findings of fact show, there were continuing problems throughout the Relevant Period regarding the span of control for file checkers and RCMs with 10 backlogs in file checking arising from time to time. This was at a time when Mr Palmer had recognised that the Authority had continuing concerns regarding the Firms: see [165] above. Mr Palmer regarded file checking as a “straightforward logistical exercise” and therefore rather than seeing the need to increase its intensity stated that he would like to see file check times reduced: see [183] above. At no point 15 did Mr Palmer seem to take an interest in the quality of the file checking. One of the key findings of the skilled person’s report in 2013 was the fact that levels of checking were not sufficiently risk-based. In our view, Mr Palmer simply did not appreciate the importance of robust file checking processes.[244]In our view, Mr Palmer took too much comfort from the fact that a considerable 20 number of advisers were rejected and was over influenced by the costs to the business of more intensive file checking. As we record at [190] above, when making a note to himself of the key messages he wished to give the Authority during the forthcoming Arrow visit, Mr Palmer appeared to take comfort purely from the fact that ARs complained about the “compliance grief” and the emphasis on the high number of 25 applicants to the network who were rejected. It was therefore clear that Mr Palmer was giving no consideration to the wider questions as to how effective the Firms’ systems and controls were in practice in ensuring that customers were treated fairly. It was also inappropriate that quality assurance ceased in May 2012 due to a lack of resources: see [213] above. Once again, Mr Palmer’s response as to his own 30 responsibility for this was that it was for Mr Bell to ask him for extra resource if it was needed but in our view it was Mr Palmer’s responsibility to be proactive. He should have been aware of what was being undertaken as regards an important area of quality assurance and taken the initiative in ensuring that more resource was committed if necessary. 35 245. As we have found, Mr Palmer himself thought immediately after the Arrow visit that it had gone well. He also said the he was “extremely angry” about some of the personal criticisms of him in the Arrow visit report and he was devastated by the results: see [203] above. Again, in our view these reactions are consistent with Mr Palmer having little appreciation of the risks to which the business was subject and 40 the serious problems that were identified with the Firms’ systems and controls and which he now accepts did exist. The findings of the Arrow visit report would not have been a surprise to a Chief Executive who was fully aware of the risks to which his business was subject and had performed his role of monitoring how the Firms’ systems controls were operating in practice to the requisite standard. 59[246]We accept Mr Herberg’s submissions regarding Mr Palmer’s failures in relation to the management of risk. We regard Mr Palmer’s failings in this respect as being particularly serious because as a result there was no adequate monitoring of customer risk and no adequate review of the effectiveness of the compliance function.[247]As we have found at [141] above, although on paper there 5 was a separate Risk Director with an appropriate job description, Mr Palmer accepted that he had put emphasis on form over substance in order to demonstrate to the Authority that the Group had implemented the kind of systems and controls that the Authority would consider appropriate. 10248. In practice, as we have seen, the reality was quite different. Mr Palmer simply did not see the value of a robust risk management function in the context of the enhanced risks to customers created by the Firms’ business model. There was therefore a lack of clarity in practice as to the division of responsibility between Mr Bell and Ms Grigg and Mr Palmer must bear responsibility for that. On paper, Ms 15 Grigg had responsibility for internal audit but in practice at all times during her appointment the Firms operated without an internal audit function. It is quite clear that Mr Palmer did not see the value of an internal audit function, as we have found at [155] above. This is further illustrated by Mr Palmer’s decision that Ms Grigg should also do operational work as well, which was not appropriate: see [142] above. 20249. The alternative procedure, which Mr Palmer accepted of Ms Grigg undertaking “informal quality checking” was simply inadequate bearing in mind the risks the business model created and the fact that, as we have found, Ms Grigg was not given responsibility for assessing customer risk.[250]As a consequence of Mr Palmer’s failure to ensure that the risk framework 25 operated in the manner set out in the written documentation and did so adequately in practice, as Mr Herberg submitted, the Firms did not have a risk function that was considering compliance risk (a major gap for a group whose entire business was to provide compliance services), nor an internal audit function monitoring compliance. This was further compounded by the fact that the Audit Committee did not, as we 30 have found, perform the functions that were allocated to it, one of which was receiving reports from internal audit. As a result, in practice compliance was effectively left to oversee itself which Mr Palmer conceded in his cross examination was not acceptable, despite his previous contentions that the size of the Firms’ business did not warrant having a separate Risk Director and Compliance Director. In 35 our view, such a division was essential in the context of the Firms’ business model. It was provided for on paper and it should have been provided for in practice. The fact that it was not was a matter for which Mr Palmer was personally responsible.[251]Mr Philipps was right to recognise that the failings in relation to internal audit were an important aspect of the Authority’s case. However, as will be apparent from 40 our findings of fact and our conclusions as set out above, we cannot accept Mr Philipps submissions to the effect that the failings in risk management can be laid entirely at the door of Ms Grigg and that Mr Palmer cannot be held responsible because there was no suggestion that he failed to supervise or inappropriately 60 delegated to Ms Grigg. Mr Palmer’s failings were a failure to appreciate the importance of the assessment of customer risk and the supervision of the compliance function and his failure to act with due skill, care and diligence in monitoring whether the framework laid down to address that in the form of an internal audit function and the duties conferred upon Ms Grigg in the context of the risk management 5 framework that was established operated effectively in practice. These failures arose because he simply did not see the importance of the function in the context of the Firms’ business model.[252]With regard to the criticisms the Authority makes with respect to the lack of 10 controls in respect of the discretionary fund management activity carried on by Investments, we accept that there was a lack of clarity as to where responsibility lay for carrying out the checks. As Mr Philipps observed, Ms Grigg held the CF 10 function for Investments and therefore on paper had the responsibility for ensuring that compliance checks were carried out. Mr Palmer was aware of this, as shown by 15 the email of 30 November 2010 that we refer to in the footnote to [139] above, but that email also suggested that Mr Bell dealt with a particular compliance matter. In our view this is further evidence of Mr Palmer creating a degree of uncertainty about where the responsibilities lay and it may have contributed to the lack of day-to-day observation of the activities of the discretionary management business. In any event, it 20 was Mr Palmer’s responsibility to check whether these controls were taking place as envisaged and he accepted in his cross examination that there was a senior management failure in not focusing on compliance in respect of discretionary fund management. We therefore find that he failed to act with due skill, care and diligence in this regard. 25 253. It follows from the findings we have made above, that the failings which we have identified impaired the management information that the Board received as regards customer risk. As the skilled person found in 2013, the Group’s management information was not sufficient to enable senior management to identify and monitor risk effectively and in our view Mr Palmer must bear a degree of responsibility for 30 that.[254]We also accept Mr Herberg’s submission that Mr Palmer’s failure to apply for approval to hold the CF 3 function demonstrated a lack of due skill, care and diligence. He had no good reason to delay in making the application in 2008 simply because he was then under investigation or again in 2012 when he became aware of 35 the issue again in the context of the Arrow visit and Mr Palmer was unable to give any adequate explanation during his cross examination. We accept Mr Herberg’s submission that this demonstrates an ignorance of the system of approvals which is worrying in itself but what was also more worrying was the fact that it appears that he delayed making the application because of concerns that it would not be approved. As 40 we have found at [191], Mr Palmer accepted that he would be facing an “an uphill battle to get authorised”.[255]We now turn to the questions of tone and culture in which the Authority placed considerable reliance. 61[256]In summary, the Authority contends that Mr Palmer placed a disproportionate and heavy emphasis on the Firms’ ARs as their customers which led directly to the preferring of the interests of ARs over the interests of consumers. The Authority also contends that Mr Palmer communicated messages which undermined compliance and generally set a combative and oppositional tone towards regulation 5 and the Authority.[257]We are reluctant to say that matters of tone and culture in themselves can amount to demonstrating a lack of due skill, care and diligence. Clearly, the tone and culture of a firm can influence the manner in which individuals perform their controlled functions. Therefore, if an individual does not see the point and value of 10 regulation then that is likely to manifest itself in a failure to meet the standards of the regulatory system when performing the functions in question. However, in our view it is important to focus on the outcome of the individual’s efforts rather than the factors that may have influenced the manner in which he behaved. That is what we have done in relation to the findings set out at [229] to [254] above and those findings are 15 sufficient in themselves to demonstrate that Mr Palmer has failed seriously in a number of important respects to act with due skill, care and diligence.[258]As the Authority’s Chief Executive himself has recognised in a speech delivered to a conference for non-executive directors on 16 March 2017 under the heading “Culture in financial institutions: it’s everywhere and nowhere”, the subject of culture 20 has an elusive nature. Whilst we accept that the Authority may well regard a firm’s culture as an important factor in the way that they assess firms and look for improvements where they are needed there is a danger in concluding that it is the culture itself that fails to meet the requisite regulatory standards.[259]We therefore accept Mr Philipps’ submissions that there is nothing wrong in 25 itself that the Firms regarded the ARs as their customers; that was manifestly the legal and commercial position as the AR is contracted to obtain compliance services from the Firms. The important point is that at all times because of the regulatory obligations stemming from s 39 FSMA and the Authority’s provisions regarding systems and controls the Firms were obliged to ensure that the underlying customers 30 were treated fairly and it is in that respect that the Firms have been found to have failed. We therefore accept that the Authority has not satisfied us as to the causal link between treating the ARs as customers and failing to deliver fair treatment for the underlying customers.[260]Similarly, we are not satisfied that the manner in which Mr Palmer interacted 35 with the Authority in itself amounted to a failure to act with due skill, care and diligence. Whilst there are frequent examples of Mr Palmer demonstrating his frustration with what he regarded as an intrusive style of regulation, he was right in his view that ultimately it was his judgment as to how he should run the business and in that context how he would meet the Authority’s requirements. He did say in his 40 answers to the Tribunal’s questions that he regretted antagonising the Authority and that there were a number of communications that were made in the heat of the moment. However, there are also instances of Mr Palmer recognising that it was not a surprise that the Firms were subject to intensive scrutiny bearing in mind its past record. As we found at [176], he did see that there were benefits to the Firms’ 62 business from the Authority’s style of regulation. It was no part of the Authority’s case that Mr Palmer’s attitude to the Authority amounted to a failure on his part to deal with his obligation under APER 4 to deal with the Authority in an open and cooperative way.[261]Nevertheless, we have found that Mr Palmer has failed to 5 act with due skill, care and diligence in performing his functions as CF 1 of the Firms. These failings are particularly serious in the light of the findings made against him in 2010 and Mr Palmer’s failure to respond adequately to the failings found at that time. The Authority had given clear warnings of the risks that were particular to networks as 10 long ago as December 2005, as summarised at [37] and [38] above, many of which were particularly germane to the Firms’ business model. Mr Palmer failed to have adequate regard to those issues in carrying out his functions as de facto Chief Executive of the Firms. Issue 2: financial penalty 15 262. We have no doubt that Mr Palmer’s failings were sufficient to justify the imposition of a significant financial penalty. Mr Philipps did not seek to argue otherwise were we to find, as we have done, that Mr Palmer failed to meet the requisite standard in the performance of his functions.[263]Neither did Mr Philipps seek to argue that if a penalty was to be imposed, that 20 the amount determined by the Authority as set out in the Decision Notice was inappropriate. The relevant amount was calculated pursuant to the five-step framework for calculating financial penalties as set out in section 6 of that part of the Authority’s Handbook known as DEPP. In accordance with those provisions, the amount of the financial penalty has been calculated by reference to the relevant 25 income received by Mr Palmer from his employment with the Firms during the Relevant Period, by multiplying that figure by a percentage of 20% on the basis that the Authority determined the breaches to be at Level 3, that is in the middle of the range of 0% to 40% provided for by the relevant provisions of DEPP, but increased to take account of aggravating circumstances, namely the previous disciplinary record 30 and general compliance history of Mr Palmer and the fact that the Authority’s guidance or other published materials had already raised relevant concerns.[264]In our view, the Authority’s calculations have produced an appropriate figure for the amount of the financial penalty to be imposed upon Mr Palmer. Issue 3: prohibition 35 265. Mr Philipps submits that on any view a prohibition from performing any senior management function in this case is so disproportionate as to be irrational, and the only rational prohibition in the case of this kind is prohibition from acting as Chief Executive, because it was in that capacity that Mr Palmer’s alleged failings have been manifested. He submits that there is no suggestion that in any other senior 40 management function he would present a danger to the public. 63[266]The Authority seeks to justify a prohibition order on the grounds of lack of competence and capability on the part of Mr Palmer to perform significant influence functions. We accept that in the case of a lack of competence, it would be irrational to impose a prohibition order except where the lack of competence demonstrated was such that the person concerned is likely to represent a risk to the 5 public in the future.[267]However, our view is in this case that Mr Palmer has demonstrated a lack of competence and capability over a long period. That period followed him having been disciplined for a number of serious failures which were similar in character to those which we have found to be present in relation to the current case. Mr Palmer was put 10 on notice of the need for fair treatment of underlying customers to be central to the Firms’ business and for the Firms’ ARs to be controlled effectively in order to ensure that they treated underlying customers fairly. It is therefore apparent to us, that Mr Palmer did not learn sufficient lessons from the previous disciplinary proceedings. We have attributed a number of our findings to a lack of understanding on Mr Palmer’s 15 part as to the risks that customers of the ARs were subject as a result of the Firms’ business model.[268]We are also seriously concerned that even at this stage Mr Palmer shows limited insight into the seriousness of his misconduct and has given no serious thought to what he would need to do to address his failings. As we have observed at [51] above, 20 whether an individual has learned lessons from his failures and would not make the same mistakes again were he to continue to exercise senior management functions is a very important factor in assessing whether the individual concerned has the necessary competence and capability to perform those functions. When asked by the Tribunal whether there are things that he would have done differently, Mr Palmer could only 25 identify what he had done to antagonise the Authority. There was no reference to the risks to underlying customers which had arisen as a result of the failures that we have identified.[269]We are therefore not satisfied that it would be disproportionate or irrational to make a full prohibition order against Mr Palmer in respect of significant influence 30 functions and it should not be limited to performing the Chief Executive function. Mr Palmer’s failings and his failure to appreciate the significance of them are of such a nature that in our view there is a clear risk that they would be repeated whatever the nature of the significant influence function he was seeking to perform. Significant influence functions can be performed in a wide variety of situations and we accept 35 that the risk to consumers can be different, depending upon the nature of the business in which the individual wishes to perform the functions and the particular risk to customers which results. It would of course be open to Mr Palmer, if there were an opportunity to perform a significant influence function in a firm with a different risk profile to those of the Firms, to seek to ask the Authority to vary the prohibition order 40 so as to allow him to perform that function based on the circumstances of the case.[270]We have considered, whether in the light of the fact that we have not accepted all of the factors that led the Authority to conclude that a prohibition order was appropriate and it might therefore be said that the Authority has taken into account irrelevant considerations in deciding whether to impose a prohibition order, it would 64 be appropriate to remit the decision to the Authority for further consideration. However, in our view the seriousness of the failings which we have found would lead inevitably to the Authority reaching the same decision were that course to be followed.[271]We therefore see no basis on which we should interfere with 5 the Authority’s decision to prohibit Mr Palmer from performing any significant influence function. Conclusion[272]The reference is dismissed. Our decision is unanimous. Directions 10 273. In relation to Mr Palmer’s disciplinary reference we determine that the appropriate action for the Authority to take is to impose on him a financial penalty of £86,691 pursuant to s 66 (3)(a) FSMA for failure to comply with the requirements of Statement of Principle 6 in carrying out his controlled function at the Firms by failing to exercise due skill, care and diligence in managing the business of the Firms for 15 which he was responsible in his controlled function.[274]In accordance with s 133 (6) FSMA we have dismissed the non-disciplinary reference. It is therefore open to the Authority to make a prohibition order against Mr Palmer prohibiting him from performing significant influence functions.[275]We remit the references to the Authority with a direction that effect be given to 20 our determinations. JUDGE TIMOTHY HERRINGTON 25 UPPER TRIBUNAL JUDGE RELEASE DATE: 8 AUGUST 2017

Cited in 6 later judgments