UK PRA updates its enforcement policies – but will this mean faster investigations and a change in penalty levels?

Following a consultation last year, the Bank of England policy statement (PS01/24) introduces changes to the Prudential Regulation Authority’s (PRA) enforcement policy from 30 January this year. Key changes affecting enforcement investigations include:

• A scheme for early factual accounts with admissions in return for an enhanced settlement discount of up to 50%.
• Business revenue is replaced as the starting point for a penalty calculation – Instead the PRA has a penalty range matrix based on the impact category of the firm and the seriousness of the breach.  
• Penalties on individuals will be set considering income over the period of the investigation, and possibly overall wealth.
• Income and wealth thresholds for individual serious financial hardship are set at two-thirds of national average each year to keep step with pay/wealth growth.

These changes are introduced with immediate effect although changes to penalty calculation will apply only to breaches after 30 January this year. The PRA enforcement policies have been drawn together into a consolidated enforcement approach. And further consultations are expected later this year in relation to enforcement powers for critical third parties and wholesale cash distribution, so we can expect there to be further changes to enforcement policies to come.

At first glance, the early account scheme and move away from business revenue to calculate an enforcement penalty for a firm are substantial changes but they may have less impact in large scale investigations.

How will the early account scheme work?

Both the FCA and PRA already provide penalty discounts for early settlement of enforcement actions – the FCA offers 30% discount for settlement at an early stage; the PRA has a graduated discount starting with 30% for settlement at an early stage. These settlement discounts are awarded in the majority of enforcement cases. The PRA is retaining its existing early settlement discount scheme for enforcement penalties but is offering a new, higher discount in connection with providing an “early account” in certain situations. 

The FCA also runs a “focused” settlement scheme that allows subjects to agree (whether in full or in part) facts and liability, or some combination of these (including partial agreement on penalty too), whilst contesting other elements of the FCA’s investigation team case. The PRA early account scheme is not intended to replicate the FCA’s focused settlement scheme but aims to cut down substantially on PRA resources required for an investigation if the subject provides a full factual account and admissions of misconduct at a very early stage. 

Subjects will be given 28 days from the notice to appoint investigators to decide whether they intend to provide an early account and, if the PRA allows, they then have six months to produce their Account. Once the PRA has agreed that the subject can participate in the scheme, it will agree the scope of the account and the terms of its statutory notices that will be used. The PRA will expect a subject to provide a full factual account, supporting documentation and transcripts of interviews, admissions of breaches and an attestation from a relevant senior manager within the allotted six months. An internal investigation report already prepared for a firm could fulfil part or the whole of the early account required. Following the Account, the PRA will decide whether to discontinue the process, continue the investigation or refer the matter to a Decision-Making Committee. The PRA then has a discretion to grant the enhanced 50% settlement discount if it is satisfied by the account provided. So, an enhanced discount on penalty is by no means guaranteed.

Also, the early account scheme is not available where there is suspected criminal misconduct and the PRA is less likely to accept requests for the early account scheme in general investigations under section 167 Financial Services and Markets Act, potential breaches of Fundamental Rule 1 (integrity) and potential breaches of Fundamental Rule 7 (openness). The PRA is, however, willing to accept accounts in multi-party investigations despite the complexities and longer timescales generally involved.

Six months is a tight deadline for an investigation on any scale in which large document reviews or multiple witness interviews are needed. 

Any early account must be accompanied by an attestation from a senior manager or executive confirming the account as accurate with no other related matters, relevant information or potential breaches. The PRA intends the attestation to give it confidence in the diligence taken in preparing the account, not to penalise a manager who signs off on an account that is later shown to be inaccurate or incomplete. Nevertheless, the need for an attestation is likely to be an important factor to firms considering whether to participate in the PRA’s scheme.

PRA policy for calculating a firm’s penalty

The PRA publishes fewer enforcement decisions than the FCA. To date, the PRA has published only a few enforcement decisions and penalties each year but many of these involve big ticket penalties for the larger firms. The nature of the decisions reflects the PRA’s role as a prudential regulator with a focus on capital adequacy, liquidity risks, risk governance and control, resolution planning and other areas of potential systemic risk. 

The PRA has a five step process for calculating a financial penalty akin to the process used by the FCA. In step 2, a percentage (depending on the perceived severity of a breach) is applied to the revenue of the relevant business unit for the period of the breach as a starting point for a penalty. But the PRA may use a different starting point for a penalty where this calculation results in a “disproportionate” figure. In the new policy, the PRA will move away from using business revenue in the financial penalty calculation. Instead, the PRA will use a range associated with the impact classification of the firm and whether the breach is low, medium or high severity. The PRA will select a value within that range as a starting point for the penalty, following which the usual adjustments for aggravating and mitigating factors, deterrence and early settlement will be applied.

In the largest PRA fine to date, the PRA did use the revenue of prime brokerage units of a bank during the period of the breach as a starting point for calculating a penalty but it is notable that there are other examples where the PRA uses a large unexplained figure instead of business revenue. For example in a recent case against a bank the relevant business revenue was considered disproportionate. This and other examples show that the PRA has indicative levels of penalty in mind based on the scale and impact of the firm and the severity of the breach. The matrix of penalty ranges makes this more transparent. 

What is the likely impact on PRA investigations and enforcement? 

Investigations at major institutions are often complex and time-consuming, and data published by the PRA shows that it has investigations open against up to 30 subjects at any time. PRA enforcement investigations currently take an average of 2.25 years (Speech by Oliver Dearie, PRA) and the early account scheme is intended to encourage faster resolution of some cases to free up resource to handle contested cases more quickly.

The early account scheme may encourage some subjects to admit breaches at this early stage in clear-cut cases but making a decision as to whether to participate in more complex cases is likely to be more challenging. The presence of multiple parties with potentially differing views as to the best approach, the potential for follow-on litigation, and the relatively short timeframes may all be relevant considerations here. As a result, there is an open question as to what the impact of the early account scheme will be in practice.

In relation to the change to the financial penalty calculation, penalties imposed on firms may become more consistent in future but there are enough moving parts  involved that regulatory discretion will still play a substantial role in the size of the penalty. The use of revenue from the relevant business unit to calculate a penalty based on a percentage associated with the perceived seriousness of a breach means that large firms receive large penalties and small firms receive smaller penalties. This disparity will not be completely removed with the change – the starting point for a serious breach by the lowest impact firm is £2m and for the highest impact class is £125m. There will still be a large element of PRA discretion and judgement in assessing the seriousness of the breach, where to set the penalty within the initial range and whether aggravating or mitigating factors justify an adjustment. We will have some time to wait to see the impact on financial penalties because the new penalty framework applies to breaches after 30 January this year.