SYSC 4.1 General requirements

1. (1)

   A firm must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems.

2. (2)

   [deleted]

[Note: article 74 (1) of CRD, article 16(5) second paragraph of MiFID, article 12(1)(a) of the UCITS Directive, and article 18(1) of AIFMD]

1. (3)

   Without prejudice to the ability of the FCA or any other relevant competent authority to require access to communications in accordance with MiFID and MiFIR, a common platform firm must have sound security mechanisms in place for the following, while maintaining the confidentiality of the data at all times:

   1. (a)

      to guarantee the security and authentication of the means of transfer of information;

   2. (b)

      to minimise the risk of data corruption and unauthorised access; and

   3. (c)

      to prevent information leakage.

[Note: article 16(5) third paragraph of MiFID]

1. (1) A common platform firm must, taking into account the nature, scale and complexity of its business, and the nature and range of the activities carried on in the course of its designated investment business, comply with the following organisational requirements:
   1. (a) establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;
   2. (b) establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the common platform firm;
   3. (c) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the common platform firm; and
   4. (d) maintain adequate and orderly records of its business and internal organisation.
2. (2) A common platform firm must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.
3. (3) A common platform firm must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, the preservation of essential data and functions and the maintenance of its designated investment business, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of its designated investment business.
4. (4) A common platform firm must establish, implement and maintain accounting policies and procedures that enable it, at the request of the FCA, to deliver in a timely manner to the FCA financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.
5. (5) A common platform firm must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.1-AR(1) to (4), SYSC 5.1.1R, SYSC 5.1.6R, SYSC 5.1.12R, SYSC 5.1.13R and SYSC 5.1.14R, and take appropriate measures to address any deficiencies.

A full-scope UK AIFM must comply with the AIFM Remuneration Code.

A full-scope UK AIFM must, in particular:

1. (1)

   have rules for personal transactions by its employees or for the holding or management of investments it invests on its own account;

2. (2)

   ensure that each transaction involving the AIFs may be reconstructed according to its origin, the parties to it, its nature, and the time and place at which it was effected; and

3. (3)

   ensure that the assets of the AIFs managed by the AIFM are invested in accordance with the instrument constituting the fund and the legal provisions in force.

A UK UCITS management company must comply with the UCITS Remuneration Code if it manages a UCITS scheme.

[Note: article 14a(1) of the UCITS Directive]

A UK UCITS management company must have appropriate procedures for its employees to report potential or actual breaches of UK provisions which implemented the UCITS Directive internally through a specific, independent and autonomous channel.

For a common platform firm, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R must be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and of the common platform firm's activities and must take into account the specific technical criteria described in SYSC 4.1.1-AR(3), SYSC 5.1.7 R, SYSC 7 and whichever of the following is applicable:

1. (1)

    [deleted];

2. (2)

    (for a full-scope UK AIFM) SYSC 19B (AIFM Remuneration Code);

3. (3)

    [deleted];

4. (4)

    (for a firm to which SYSC 19D applies) SYSC 19D (Dual-regulated firms Remuneration Code);

5. (5)

    (for a firm to which the remuneration part of the PRA Rulebook applies) the remuneration part of the PRA Rulebook; or

6. (6)

    (for a firm to which SYSC 19G applies) SYSC 19G (MIFIDPRU Remuneration Code).

For a management company or a full-scope UK AIFM, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R and SYSC 4.1.1A R must also take account of the UCITS schemes managed by the management company or the AIFs managed by the full-scope UK AIFM.

A management company and a full-scope UK AIFM must have, and employ effectively, the resources and procedures that are necessary for the proper performance of its business activities.

A full-scope UK AIFM must use, at all times, adequate and appropriate human and technical resources that are necessary for the proper management of AIFs.

A firm (with the exception of a common platform firm and a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)) must, taking into account the nature, scale and complexity of the business of the firm, and the nature and range of the financial services, claims management services and other activities undertaken in the course of that business:

1. (1)

   (if it is a management company) establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;

2. (2)

   establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm;

3. (3)

   establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the firm; and

4. (4)

   (if it is a management company) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the management company as well as effective information flows with any third party involved.

[Note: articles 4(1) final paragraph, 4(1)(a), 4(1)(c) and 4(1)(d) of the UCITS implementing Directive]

A management company must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.

[Note: article 4(2) of the UCITS implementing Directive]

A firm carrying on regulated pensions dashboard activity must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of any personal or pensions information held by the firm, taking into the account the nature of the information in question.

A firm carrying on regulated pensions dashboard activity must keep appropriate records to demonstrate compliance with SYSC 4.1.5AR.

1. (1)

   If there is an incident which may compromise the security, integrity or confidentiality of any personal or pensions information held by the firm, the firm must immediately notify the FCA using the relevant form in Connect.

2. (2)

   A notification under (1) must contain:

   1. (a)

      a description of the incident;

   2. (b)

      the time of the incident (where known); and

   3. (c)

      a description of the steps the firm is taking since being made aware of the incident (where applicable).

A common platform firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. To this end the common platform firm must employ appropriate and proportionate systems, resources and procedures.

[Note: article 16(4) of MiFID]

A CRR firm and a management company must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited, the preservation of essential data and functions, and the maintenance of its regulated activities, or, in the case of a management company, its collective portfolio management activities, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of those activities.

[Note: article 4(3) of the UCITS implementing Directive and article 85(2) of CRD]

1. (1)

   An operator of an electronic system in relation to lending must have arrangements in place to ensure that P2P agreements facilitated by it will have a reasonable likelihood of being managed and administered, in accordance with the contract terms between the firm and its relevant borrower and lender customers, if at any time it ceases to manage and administer those P2P agreements.

2. (2)

   Under (1), and wherever the requirement in (1) is referenced in the FCA’s rules and guidance, the reference to P2P agreements includes any non-P2P agreement included in a P2P portfolio.

3. (3)

   The arrangements under (1) must not be designed to prefer any particular customers or class of customers for whom it manages and administers P2P agreements or non-P2P agreements.

An operator of an electronic system in relation to lending must produce and keep up to date a P2P resolution manual which contains information about the firm that, in the event of the firm’s insolvency, would assist in resolving the firm’s business of management and administration of P2P agreements that it has facilitated. For these purposes, the reference to P2P agreements includes any non-P2P agreement included in a P2P portfolio. It must, as a minimum, include a written explanation of each of the following:

1. (1)

   how the firm conducts the business of management and administration of P2P agreements that it has facilitated, what the day-to-day operation of that business entails and what resources would be needed to continue that business if the firm ceased to carry it on, including a specification of:

   1. (a)

      critical staff and their respective roles;

   2. (b)

      critical premises;

   3. (c)

      the firm’s IT systems, including details of data storage and data recovery arrangements;

   4. (d)

      the firm’s record-keeping systems, including how records are organised;

   5. (e)

      all relevant bank accounts and payment facilities;

   6. (f)

      all relevant persons outside of the firm, and their respective roles, including any outsourced service providers;

   7. (g)

      all relevant legal documentation, including customer, service and supplier contracts;

   8. (h)

      the firm’s group, using a structure chart showing:

      1. (i)

         the legal entities in the group;

      2. (ii)

         the ownership structure of those entities; and

      3. (iii)

         the jurisdiction of those entities; and

   9. (i)

      how the firm holds and manages any security for loans;

2. (2)

   the steps that would need to be implemented under the arrangements in place under SYSC 4.1.8AR in order for P2P agreements facilitated by the firm to continue to be managed and administered;

3. (3)

   any terms in contracts that may need to be relied on to ensure P2P agreements facilitated by it will continue to be managed and administered under those arrangements; and

4. (4)

   how the firm’s systems can produce the detail specified in COBS 18.12.31R (Ongoing disclosures) for each P2P agreement facilitated by it.

An operator of an electronic system in relation to lending must put in place arrangements to ensure that its P2P resolution manual would be immediately available to:

1. (1)

   an administrator, receiver, trustee, liquidator or analogous officer appointed in respect of it or any material part of its property; and

2. (2)

   the FCA, on request.

A operator of an electronic system in relation to lending must store its P2P resolution manual in the same place as its CASS resolution pack, if CASS 10 (CASS resolution pack) applies to it.

1. (1)

   An operator of an electronic system in relation to lending must not accept, take, or receive the transfer of full ownership of money relating to P2P agreements.

2. (2)

   If an operator of an electronic system in relation to lending has made a client money election under CASS 7.10.7AR, when it is operating an electronic system in relation to non-P2P agreements it must also not accept, take, or receive the transfer of full ownership of money relating to non-P2P agreements.

A management company must establish, implement and maintain accounting policies and procedures that enable it, at the request of the FCA, to deliver in a timely manner to the FCA financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.

[Note: article 4(4) of the UCITS implementing Directive]

A management company must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.4 R to SYSC 4.1.9 R and take appropriate measures to address any deficiencies.

[Note: article 4(5) of the UCITS implementing Directive]