The FCA fined Citigroup Global Markets Limited (“CGML”) £12.6m for failing to properly implement the Market Abuse Regulation (“MAR”). Regulatory change is coming thick and fast for financial services firms, making effective change management controls more important than ever.  Below we look at some of the underlying failures in this case, in the hope that other participants can learn from them.

Background

MAR became effective on 3 July 2016 and expanded requirements to detect and report potential market abuse.  Further delegated regulation containing a non-exhaustive list of indicators of market manipulation was published prior to the MAR effective date. The regulations require firms to establish and maintain effective arrangements, systems and procedures to detect and report suspicious orders and transactions. The FCA found that CGML failed to properly implement MAR, and took 18 months to identify and assess the specific market abuse risks its business may have been exposed to and which it needed to detect.

The main issues

CGML failed to consider the specific indicators of market manipulation in delegated regulation 2016/522 when implementing MAR Article 16(2). This led to gaps in the arrangements, systems and procedures for trade surveillance.

CGML failed to complete an initial MAR gap analysis until October 2017. The gap analysis did not provide CGML with the means to prioritise the most serious market abuse risks affecting its business.

CGML did not begin preparing an Article 16(2) risk assessment until December 2017.

CGML used a project tracker to record the progress of each task within the project. However, the tracker did not contain a line for the MAR gap analysis that would identify the market abuse risks that CGML needed to address to comply with Article 16(2). The FCA found that in May 2016, the project tracker incorrectly showed certain items as complete or underway when they were not.

CGML’s 2016 Compliance Plan contained a MAR objective to “develop and implement training, policies and procedures to give effect to new MAR across EMEA Region”. However, there was confusion internally over who owned the MAR objective, and the deliverable was too broad to be effectively monitored without being broken down into smaller milestones. When the MAR Objective was closed in July 2016, EMEA Product Compliance did not consider compliance with Article 16(2) to be a prerequisite for the completion of the MAR Objective.

CGML had a MAR Working Group to coordinate CGML’s various MAR implementation projects. However, the group did not have a designated owner who was responsible for overseeing and confirming the completion of all the projects.

The CGML Board and the UK Business Risk, Compliance, and Control Committee (“UK BRCC”) were wrongly advised in late 2016 that MAR implementation was complete. CGML EMEA Compliance understood that compliance with Article 16(2) would be achieved as part of a separate internal remediation programme, but that understanding was incorrect.

Key takeaways

This case highlights the importance of an effective regulatory change framework. Firms need a clear regulatory change roadmap that begins with:

• the scope and objectives of the project;
• identification and engagement of stakeholders;
• the senior manger responsible for the project; and
• a project plan with clearly defined deliverables, ownership and deadlines.

The Senior Managers and Certification Regime (“SMCR”) was designed to ensure firms and staff clearly understand and can demonstrate where responsibility lies. In the case of CGML, the responsibility and ownership for key aspects of the MAR implementation were not clear. If you are undertaking a major regulatory change project, you should ensure that responsibility for both delivery and oversight are clearly communicated and documented.

If you are a senior manager responsible for oversight of a regulatory change project, you may wish to appoint an independent third party to assess the effectiveness of your implementation.

How we can help

C & G offers strategic support helping you comply with a continuously changing regulatory environment. We can review past project implementations (e.g. MAR/SMCR/IFPR), or help prepare for those on the horizon such as the FCA Consumer Duty.

If you need support in this area, contact us today.