Is a bank, in the United Kingdom

Consumer Credit Act 1974 (c. 39), ss. 158 and 159 · Read the law's page

• If you are a credit reference agency, give a consumer that asks in writing, supplies particulars enabling you to identify the file and pays the fee, a copy of the file you keep on that consumer within the prescribed period, in plain English (section 158(1) and (5)).
• If you are a credit reference agency, give the consumer, with the copy of the file, a statement in the prescribed form of the consumer's rights under section 159 (section 158(2)).
• If you are a credit reference agency and keep no file relating to the consumer, give the consumer notice of that fact (section 158(3)).
• If you are a credit reference agency and an individual who considers that an entry in the file is incorrect and likely to prejudice the individual gives you notice, inform the individual within 28 days that you have removed the entry, amended it or taken no action (section 159(1) and (2)).
• If you are a credit reference agency and the objector serves a further notice, add to the file an accompanying notice of correction of not more than 200 words and include a copy of it when furnishing information based on that entry, or tell the objector within 28 days that you intend to comply or apply to the relevant authority (section 159(3) to (5)).

PRA Rulebook, Fundamental Rule 5 · Read the law's page

• It reaches you if you are a firm to which the Fundamental Rules Part of the PRA Rulebook applies. The Part applies to all firms unless otherwise stated, and the Fundamental Rules apply with respect to the carrying on of regulated activities, dealing in investments as principal and ancillary activities in relation to PRA-regulated activities, wherever those activities are carried on. Fundamental Rule 5 also applies to unregulated activities, but only in a prudential context, and takes into account any activity of other members of a group of which the firm is a member.
• A firm must have effective risk strategies and risk management systems (Fundamental Rule 5).

FCA Handbook, SYSC 4.1 · Read the law's page

• It reaches you if you are a firm to which the common platform requirements apply, which is every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless a specific rule provides otherwise (SYSC 1 Annex 1 2.1R): have robust governance arrangements, which include a clear organizational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks you are or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems (SYSC 4.1.1R(1)).
• If you are a common platform firm, make the arrangements, processes and mechanisms in SYSC 4.1.1R comprehensive and proportionate to the nature, scale and complexity of the risks inherent in your business model and activities (SYSC 4.1.2R).
• If you are a common platform firm, have sound security mechanisms in place, while maintaining the confidentiality of the data at all times, to guarantee the security and authentication of the means of transfer of information, to minimise the risk of data corruption and unauthorised access, and to prevent information leakage (SYSC 4.1.1R(3)).
• If you are a common platform firm, taking into account the nature, scale and complexity of your business, establish, implement and maintain decision-making procedures and an organizational structure that specifies reporting lines and allocates functions and responsibilities, adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels, effective internal reporting and communication of information at all relevant levels, and adequate and orderly records of your business and internal organization (SYSC 4.1.1-AR(1)).
• If you are a common platform firm, establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question (SYSC 4.1.1-AR(2)).
• If you are a common platform firm, establish, implement and maintain an adequate business continuity policy aimed at ensuring, if your systems and procedures are interrupted, the preservation of essential data and functions and the maintenance of your designated investment business or, where that is not possible, the timely recovery of such data and functions and the timely resumption of that business, and take reasonable steps to ensure continuity and regularity in the performance of your regulated activities (SYSC 4.1.1-AR(3) and SYSC 4.1.6R).
• If you are a common platform firm, monitor and, on a regular basis, evaluate the adequacy and effectiveness of your systems, internal control mechanisms and arrangements, and take appropriate measures to address any deficiencies (SYSC 4.1.1-AR(5)).
• If you are a firm other than a common platform firm or a sole trader with no employee who must be approved under section 59 of the Act, taking into account the nature, scale and complexity of your business, establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm and effective internal reporting and communication of information at all relevant levels (SYSC 4.1.4R(2) and (3)).

FCA Handbook, SYSC 6.1.1R and 6.1.4AR · Read the law's page

• It reaches you if you are a firm to which the common platform requirements apply, which is every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless a specific rule provides otherwise (SYSC 1 Annex 1 2.1R): establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm, including its managers, employees and appointed representatives, with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime (SYSC 6.1.1R).
• If you are a firm which is not a common platform firm or management company and you carry on designated investment business with or for retail clients or professional clients, allocate to a director or senior manager the function of having responsibility for oversight of your compliance and of reporting to the governing body in respect of that responsibility (SYSC 6.1.4AR).

FCA Handbook, SYSC 8.1.1R, 8.1.4AR and 8.1.6-AR to 8.1.11-BR · Read the law's page

• It reaches you if you are a common platform firm, meaning a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator (SYSC 1 Annex 1 3.2G and Table A): when relying on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services on a continuous and satisfactory basis, take reasonable steps to avoid undue additional operational risk, and do not undertake the outsourcing of important operational functions in such a way as to impair materially the quality of your internal control or the ability of the FCA to monitor your compliance with all obligations under the regulatory system (SYSC 8.1.1R).
• If you are a common platform firm and you outsource critical or important operational functions, remain fully responsible for discharging all of your obligations under the UK law on markets in financial instruments, and comply with the conditions that the outsourcing must not result in the delegation by senior management of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6-AR).
• If you are a common platform firm, exercise due skill and care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any relevant services and activities (SYSC 8.1.7R).
• If you are a common platform firm, take the necessary steps to ensure that the conditions in SYSC 8.1.8R are satisfied, among them that the service provider has the ability, capacity, appropriate organizational structure and any authorization required by law to perform the outsourced functions reliably and professionally (SYSC 8.1.8R(1)), that you establish methods for assessing the standard of performance of the service provider and for reviewing on an ongoing basis the services it provides (SYSC 8.1.8R(2)), and that you effectively supervise the outsourced functions and manage the risks associated with the outsourcing, retaining the necessary expertise and resources to do so (SYSC 8.1.8R(5)).
• If you are a common platform firm, ensure that you can terminate the arrangement for the outsourcing where necessary, with immediate effect when this is in the interest of your clients, without detriment to the continuity and quality of your provision of services to clients, and that the continuity and quality of the outsourced functions or services are maintained also in the event of termination (SYSC 8.1.8R(7) and (12)).
• If you are a common platform firm, ensure that you, your auditors, the FCA and any other relevant competent authority have effective access to data related to the outsourced activities and to the business premises of the service provider, where necessary for the purpose of effective oversight, and that the service provider cooperates with the FCA and any other relevant competent authority in connection with the outsourced activities (SYSC 8.1.8R(8) and (9)).
• If you are a common platform firm, ensure that the service provider protects any confidential information relating to you and your clients, and that you and the service provider establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities where that is necessary having regard to the function, service or activity outsourced (SYSC 8.1.8R(10) and (11)).
• If you are a common platform firm, set out the respective rights and obligations of you and the service provider clearly in a written agreement, keeping your instruction and termination rights, your rights of information and your right to inspections and access to books and premises, and ensure that the agreement lets the service provider outsource only with your consent in writing (SYSC 8.1.9R).
• If you are a common platform firm, make available on request to the FCA all information necessary to enable the FCA to supervise the compliance of the performance of the outsourced activities with the requirements of the UK law on markets in financial instruments (SYSC 8.1.11-AR).
• If you are a common platform firm and you outsource functions related to portfolio management provided to clients to a service provider located in a third country, ensure that the service provider is authorized or registered in its home jurisdiction to provide that service and is effectively supervised by a regulatory body in that third country, and that there is an appropriate cooperation agreement between the FCA and that regulatory body (SYSC 8.1.11-BR).

FCA Handbook, PRIN 2A and Principle 12 · Read the law's page

• It reaches you if you are a firm carrying on retail market business, meaning the regulated activities and ancillary activities, payment services and issuing of electronic money of a firm in a distribution chain that involves a retail customer, or if you communicate or approve a financial promotion addressed to or likely to be received by a retail customer, to the extent you are responsible for determining or materially influencing retail customer outcomes: act to deliver good outcomes for retail customers (Principle 12, PRIN 2.1.1R, and PRIN 3.2.6R to 3.2.7R).
• Act in good faith towards retail customers (PRIN 2A.2.1R); the standard of conduct is set out in PRIN 2A.2.2R and includes fair and open dealing and acting consistently with the reasonable expectations of retail customers.
• Avoid causing foreseeable harm to retail customers, whether by act or omission, in your direct relationship with a retail customer or through your role in the distribution chain (PRIN 2A.2.8R and 2A.2.9R).
• Enable and support retail customers to pursue their financial objectives (PRIN 2A.2.14R).
• If you identify, through complaints, your internal monitoring or any other source, that retail customers have suffered foreseeable harm as a result of your acts or omissions, act in good faith and take appropriate action to rectify the situation, including providing redress where appropriate (PRIN 2A.2.5R).
• Products and services: as a manufacturer, maintain, operate and review a process for approving a product, and significant adaptations of it, before it is marketed or distributed to retail customers, and test products appropriately (PRIN 2A.3.2R and 2A.3.9R); as a distributor, maintain, operate and review distribution arrangements that avoid causing, and where that is not practical mitigate, foreseeable harm to retail customers (PRIN 2A.3.14R).
• Price and value: as a manufacturer, ensure your products provide fair value to retail customers in the target market and carry out and regularly review a value assessment (PRIN 2A.4.2R); as a distributor, do not distribute a product unless your distribution arrangements are consistent with the product providing fair value (PRIN 2A.4.16R).
• Consumer understanding: support retail customer understanding so that your communications meet the information needs of retail customers, are likely to be understood by them and equip them to make decisions that are effective, timely and properly informed, and communicate information in a way which is clear, fair and not misleading (PRIN 2A.5.3R); where appropriate, test communications before use and regularly monitor their impact (PRIN 2A.5.10R).
• Consumer support: design and deliver support to retail customers that meets their needs, including those with characteristics of vulnerability, lets them use their product as reasonably anticipated, includes appropriate friction in customer journeys, and does not put unreasonable barriers in their way during the product lifecycle (PRIN 2A.6.2R).
• Ensure the Consumer Duty is reflected in your strategies, governance, leadership and people policies, and that retail customer outcomes are a central focus of your risk control arrangements under SYSC and of your internal audit function (PRIN 2A.8.1R).
• Regularly monitor the outcomes retail customers receive from your products, your communications and your customer support, in a way that lets you determine whether you are complying with Principle 12 and PRIN 2A.2 and whether any group of retail customers is experiencing different outcomes from another group of the same product (PRIN 2A.9.8R to 2A.9.10R).
• Prepare a report for your governing body on the results of that monitoring and any actions required, and at least annually have the governing body review and approve it, confirm whether it is satisfied that you are complying with the Consumer Duty, and assess whether your future business strategy is consistent with it (PRIN 2A.8.3R and 2A.8.4R).
• Where monitoring shows that retail customers are not receiving the outcomes listed in PRIN 2A.9.9R, that any group is receiving worse outcomes than another for the same product, or that you are not complying with Principle 12 and the cross-cutting obligations, take appropriate action to address the situation (PRIN 2A.9.12R).

FCA Handbook, SYSC 6.1.2-AR to 6.1.3-CR · Read the law's page

• It reaches you if you are a common platform firm, meaning a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator (SYSC 1 Annex 1 3.2G and Table A).
• If you are a common platform firm, taking into account the nature, scale and complexity of your business and the nature and range of financial services and activities undertaken in the course of your designated investment business, establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the UK law on markets in financial instruments, as well as associated risks, and put in place adequate measures and procedures designed to minimize such risks and to enable the FCA to exercise its powers effectively under that law (SYSC 6.1.2-AR).
• If you are a common platform firm, establish and maintain a permanent and effective compliance function which operates independently and which monitors on a permanent basis and assesses, on a regular basis, the adequacy and effectiveness of the measures, policies and procedures put in place under SYSC 6.1.2-AR and the actions taken to address any deficiencies in your compliance with your obligations; advises and assists the relevant persons responsible for carrying out your designated investment business to comply with your obligations under the UK law on markets in financial instruments; reports to the management body, at least on an annual basis, on the implementation and effectiveness of the overall control environment for your designated investment business, the risks that have been identified and the complaints-handling reporting as well as remedies undertaken or to be undertaken; and monitors the operations of the complaints-handling process and considers complaints as a source of relevant information (SYSC 6.1.3-AR).
• If you are a common platform firm, have the compliance function conduct an assessment on the basis of which it establishes a risk-based monitoring program that takes into consideration all areas of your designated investment business and any relevant ancillary services and ancillary activities, including relevant information gathered in the monitoring of complaints-handling, with priorities determined by the compliance risk assessment so that compliance risk is comprehensively monitored (SYSC 6.1.3-BR).
• If you are a common platform firm, ensure that the compliance function has the necessary authority, resources, expertise and access to all relevant information; that a compliance officer is appointed and replaced by the management body and is responsible for the compliance function and for any reporting as to compliance; that the compliance function reports on an ad-hoc basis directly to the management body where it detects a significant risk of failure by the firm to comply with its obligations under the UK law on markets in financial instruments; that the relevant persons involved in the compliance function are not involved in the performance of the services or activities they monitor; and that the method of determining their remuneration does not compromise their objectivity and is not likely to do so (SYSC 6.1.3-CR).

FCA Handbook, SYSC 8.1.6R · Read the law's page

• It reaches you if you are a firm other than a common platform firm, apart from an insurer, a UK ISPV, a managing agent, the Society, a full-scope UK AIFM of an unauthorized AIF, a MiFID optional exemption firm or a third country firm (SYSC 1 Annex 1 3.3R).
• If you are a firm other than a common platform firm and you outsource critical or important operational functions or any relevant services and activities, remain fully responsible for discharging all of your obligations under the regulatory system, and comply with the conditions that the outsourcing must not result in the delegation by senior personnel of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6R).