FCA enforcement - Learning lessons from FCA action

Posted: 23rd June 2015

This month we’re looking at one of the largest fines of 2015 so far.

On 24 February, the FCA announced it was fining Aviva Investors £17.6m for failing to manage its conflicts of interest fairly. This fine is on top of the firm paying out £132m in compensation to eight affected funds in 2013.

So let’s start at the beginning - between August 2005 and June 2013, funds that paid differing levels of performance fees were managed on the same desk within its Fixed Income area (referred to as ‘side by side’ management). This created a conflict of interest in that traders had an incentive to favour one fund over another because of enhanced performance fees they’d get from certain funds. 

Aviva Investors did recognise the conflict of interest and risk inherent in side by side management and recorded it in its ‘conflict log’. But, it was weaknesses in the firm’s ‘risk management framework’ that meant that these conflicts actually materialised. Traders could delay allocating trades that had already been executed, and in some cases for several hours. This meant that they could assess a trade’s performance in this time, and allocate trades that were doing well to funds from which they’d receive better performance fees. The trades that didn’t do so well were allocated to other funds. This practice is often referred to as ‘cherry picking’. Essentially traders cherry-picked the best trades for the hedge funds.  

The FCA noted that since the firm discovered these issues, it has engaged with the regulator in an “exceptionally open and cooperative manner”. It also noted that as well as making a number of changes to its ‘control environment’, the firm was working to drive a healthier culture across the business under the leadership of a new management team.

But even with these positive steps, the size of the fine demonstrates how serious the FCA considers the effective management and mitigation of conflict of interests.

THREE LINES OF DEFENCE

Like many firms, Aviva Investors operated a ‘three lines of defence’ risk management model which for the firm, failed at each line:

First line of defence – systems and controls

The first line (the business) had the main responsibility of identifying and managing the risk.

Responsibility for identifying and managing risks should be clear. In Aviva Investors’ case:

• The Compliance function, for part of the relevant period, sat in the first line thereby combining what are normally separate lines of risk management
• There were a number of structural and risk management changes which meant that responsibilities, reporting lines, and personnel frequently changed
• The firm failed to document the roles and responsibilities of the direct line management of the trading staff

This ongoing lack of clarity within the Fixed Income area as to who had responsibility for oversight of the area meant that the management of traders and risks was informal, unrecorded and lacking in accountability.

• Are your business’ accountability and oversight arrangements clearly documented?

Risks should be recorded and controls should be in place to manage them

Although there were policies in place in the trading process, none of these addressed the specific risks associated with the side-by-side management of funds.

• Have you done enough to identify the potential conflicts across your business?
• Are they being appropriately managed?

Make sure the right processes are in place, to capture the right information, at the right time.

The lack of certain processes meant the traders didn’t need to record when a trade was allocated before they booked it. They could also misreport the time the trade was placed, so widespread delays could go undetected.

• How confident are you that all the necessary information to avoid conflicts of interested are being reported and recorded?

The correct level and use of management information (MI) is essential. 

Management need to be confident that staff are following defined processes, and that the controls in place are working as intended. In this case the MI available to line managers was weak and insufficient. What little was available was not effective to enable line managers to gain comfort that traders were following processes and that controls were operating effectively. 

• When was the last time you reviewed your MI to check its relevance and assurance value?
• How confident are you that it is actually ‘fit for purpose’?

Second line of defence – monitoring and oversight

The second line (Compliance) was meant to act as a safety net to catch issues that were not prevented and / or detected by the first line.

The Compliance function should be able to monitor risk effectively and operate as an independent check on the business

The Compliance team at Aviva Investors faced challenges, or were ineffective in a number of ways:

• The fixed income area executed a large volume of high value trades but the compliance monitoring of these trades was for the most part, manual. This meant the sizes of the samples they examined were disproportionately small
• Any monitoring of side-by-side trades was made even more complex by the fact that trading data was held on different systems
• It was also rare for ‘enhanced compliance monitoring’ of the issues listed in the conflict log to ever take place

A key element of an effective ‘risk management framework’ is that it is appropriate to the size and complexity of a firm’s operations. In particular, it should be capable of effectively identifying, managing, monitoring and reporting the risks it is, or might be exposed to. If it’s difficult to measure whether a risk has crystallised, then other options need to be considered; in this case, whether a side-by-side arrangement should operate at all.

• Are you confident that you’re able to identify, monitor and report the risks that your firm might be exposed to?

Aviva Investors’ compliance team was under-resourced and lacked the necessary skills and experience to challenge the existing business practices. This meant the team lacked credibility and respect within the firm to challenge business decisions, and create the appropriate risk focused culture. This is a common scenario. A relatively simple, low cost and helpful solution is to assign an external resource to your compliance team to support on the more complex, technical elements of the monitoring programme.

• Does your compliance team have the necessary skills, experience and credibility to monitor the more complex areas of your business?

Third line of defence – independent assurance

The purpose of the third line was to provide independent assurance of the risk management framework operated throughout the firm.

One of the most interesting elements of this case is that following a number of audits, the third line did actually identify many of the issues raised in the final notice. The problem however, was in addressing and closing the issues once they were identified. There was also the assumption that strategic change projects would fully be able to address the issue themselves, which they might not have been able to.

• How confident are you that issues, once identified, are appropriately escalated and monitored until they are closed?

CULTURE

In the case of Aviva, inappropriate incentives and reward structures certainly fostered poor conduct. In a business environment that was so heavily focused on performance, risk controls were seen as a barrier to success. Individuals were promoted based on financial performance, without the right balance and consideration given to risk management.

For many investment firms, potential conflicts of interest are commonplace. The lesson from this fine is about making sure you have effective controls to be sure that the conflicts are being properly managed. 

The issues raised by the FCA, together with the size of the fine, highlights the need for firms to proactively identify and effectively manage conflicts of interest, and to make sure that this is embedded in the mind-set and culture of the organis

This month we’re looking at one of the largest fines of 2015 so far.

On 24 February, the FCA announced it was fining Aviva Investors £17.6m for failing to manage its conflicts of interest fairly. This fine is on top of the firm paying out £132m in compensation to eight affected funds in 2013.

So let’s start at the beginning - between August 2005 and June 2013, funds that paid differing levels of performance fees were managed on the same desk within its Fixed Income area (referred to as ‘side by side’ management). This created a conflict of interest in that traders had an incentive to favour one fund over another because of enhanced performance fees they’d get from certain funds. 

Aviva Investors did recognise the conflict of interest and risk inherent in side by side management and recorded it in its ‘conflict log’. But, it was weaknesses in the firm’s ‘risk management framework’ that meant that these conflicts actually materialised. Traders could delay allocating trades that had already been executed, and in some cases for several hours. This meant that they could assess a trade’s performance in this time, and allocate trades that were doing well to funds from which they’d receive better performance fees. The trades that didn’t do so well were allocated to other funds. This practice is often referred to as ‘cherry picking’. Essentially traders cherry-picked the best trades for the hedge funds.  

The FCA noted that since the firm discovered these issues, it has engaged with the regulator in an “exceptionally open and cooperative manner”. It also noted that as well as making a number of changes to its ‘control environment’, the firm was working to drive a healthier culture across the business under the leadership of a new management team.

But even with these positive steps, the size of the fine demonstrates how serious the FCA considers the effective management and mitigation of conflict of interests.

THREE LINES OF DEFENCE

Like many firms, Aviva Investors operated a ‘three lines of defence’ risk management model which for the firm, failed at each line:

First line of defence – systems and controls

The first line (the business) had the main responsibility of identifying and managing the risk.

Responsibility for identifying and managing risks should be clear. In Aviva Investors’ case:

• The Compliance function, for part of the relevant period, sat in the first line thereby combining what are normally separate lines of risk management
• There were a number of structural and risk management changes which meant that responsibilities, reporting lines, and personnel frequently changed
• The firm failed to document the roles and responsibilities of the direct line management of the trading staff

This ongoing lack of clarity within the Fixed Income area as to who had responsibility for oversight of the area meant that the management of traders and risks was informal, unrecorded and lacking in accountability.

• Are your business’ accountability and oversight arrangements clearly documented?

Risks should be recorded and controls should be in place to manage them

Although there were policies in place in the trading process, none of these addressed the specific risks associated with the side-by-side management of funds.

• Have you done enough to identify the potential conflicts across your business?
• Are they being appropriately managed?

Make sure the right processes are in place, to capture the right information, at the right time.

The lack of certain processes meant the traders didn’t need to record when a trade was allocated before they booked it. They could also misreport the time the trade was placed, so widespread delays could go undetected.

• How confident are you that all the necessary information to avoid conflicts of interested are being reported and recorded?

The correct level and use of management information (MI) is essential. 

Management need to be confident that staff are following defined processes, and that the controls in place are working as intended. In this case the MI available to line managers was weak and insufficient. What little was available was not effective to enable line managers to gain comfort that traders were following processes and that controls were operating effectively. 

• When was the last time you reviewed your MI to check its relevance and assurance value?
• How confident are you that it is actually ‘fit for purpose’?

Second line of defence – monitoring and oversight

The second line (Compliance) was meant to act as a safety net to catch issues that were not prevented and / or detected by the first line.

The Compliance function should be able to monitor risk effectively and operate as an independent check on the business

The Compliance team at Aviva Investors faced challenges, or were ineffective in a number of ways:

• The fixed income area executed a large volume of high value trades but the compliance monitoring of these trades was for the most part, manual. This meant the sizes of the samples they examined were disproportionately small
• Any monitoring of side-by-side trades was made even more complex by the fact that trading data was held on different systems
• It was also rare for ‘enhanced compliance monitoring’ of the issues listed in the conflict log to ever take place

A key element of an effective ‘risk management framework’ is that it is appropriate to the size and complexity of a firm’s operations. In particular, it should be capable of effectively identifying, managing, monitoring and reporting the risks it is, or might be exposed to. If it’s difficult to measure whether a risk has crystallised, then other options need to be considered; in this case, whether a side-by-side arrangement should operate at all.

• Are you confident that you’re able to identify, monitor and report the risks that your firm might be exposed to?

Aviva Investors’ compliance team was under-resourced and lacked the necessary skills and experience to challenge the existing business practices. This meant the team lacked credibility and respect within the firm to challenge business decisions, and create the appropriate risk focused culture. This is a common scenario. A relatively simple, low cost and helpful solution is to assign an external resource to your compliance team to support on the more complex, technical elements of the monitoring programme.

• Does your compliance team have the necessary skills, experience and credibility to monitor the more complex areas of your business?

Third line of defence – independent assurance

The purpose of the third line was to provide independent assurance of the risk management framework operated throughout the firm.

One of the most interesting elements of this case is that following a number of audits, the third line did actually identify many of the issues raised in the final notice. The problem however, was in addressing and closing the issues once they were identified. There was also the assumption that strategic change projects would fully be able to address the issue themselves, which they might not have been able to.

• How confident are you that issues, once identified, are appropriately escalated and monitored until they are closed?

CULTURE

In the case of Aviva, inappropriate incentives and reward structures certainly fostered poor conduct. In a business environment that was so heavily focused on performance, risk controls were seen as a barrier to success. Individuals were promoted based on financial performance, without the right balance and consideration given to risk management.

For many investment firms, potential conflicts of interest are commonplace. The lesson from this fine is about making sure you have effective controls to be sure that the conflicts are being properly managed. 

The issues raised by the FCA, together with the size of the fine, highlights the need for firms to proactively identify and effectively manage conflicts of interest, and to make sure that this is embedded in the mind-set and culture of the organisation.