Changing banking culture

The banking crisis, which exposed some reckless lending, coupled with the long-running saga of overcharging on mortgages, has fuelled the question of why senior banking executives escape sanction when poor governance, excessive risk-taking or clear wrongdoing is exposed in their organisations.

In June 2022 the Central Bank fined AIB a record €96.7m for denying customers access to cheaper mortgages that tracked base rates, citing ‘devastating consequences’ for around 13,000 households.

But as well as stiff financial penalties, the Central Bank’s 2018 report into the prevailing attitudes within Irish banks also underlined the need for cultural change in the financial services industry to regain consumer and investor trust, and ensure business models are sustainable.

The issue of accountability in financial services is not unique to Ireland. Globally it has been the subject of a recent legislative push, with the EU, US, Hong Kong, Australia and most notably the UK leading the way.

In 2016, the senior managers and certification regime (SMCR) was introduced in the UK, firstly targeting banks, but subsequently extended to all solo-regulated firms. The SMCR sets out standards of conduct expected of individuals working in such firms, with particular emphasis on the responsibilities of senior managers.

While a 2020 report by KPMG argued that ‘the jury is still out on the extent to which the SMCR has driven large-scale changes in culture’, it found that ‘senior managers have become wary of the possible sanctions on them for regulatory breaches in their areas of responsibility, and this has promoted greater control and scrutiny over their respective areas’.

Comprehensive scope

The UK approach provides the model for long awaited legislation in Ireland. Four years after proposals were first published, the Central Bank (Individual Accountability Framework) Bill 2022 is now on the verge of becoming law. As in the UK, the new legislation is intended ‘to drive a forward-looking “whole-firm” organisational change within regulated firms’, explains Josh Hogan, partner with law firm McCann FitzGerald.

There are four key pillars of the legislation:

• the introduction of a senior executive accountability regime (SEAR) similar to the SMCR
• the setting out of conduct standards for a broader swathe of personnel, which reflect the UK approach
• an enhanced fitness and probity regime that requires an annual certificate of compliance to confirm that individuals performing controlled functions are ‘fit and proper’
• an enhanced administrative sanctions procedure, which sets out how the Central Bank will investigate and take action should an issue arise.

The bill also aims to fix some weaknesses in existing legislation, most notably by removing the so-called ‘participation link’, which experts believe has stymied investigations in the past by requiring that wrongdoing by a firm first be proved before any enforcement action is taken against its personnel.

Spirit of compliance

‘There is no doubt that implementing the new regime will be a significant undertaking for regulated firms and will involve considerable management and administration time,’ Hogan says.

‘Firms will be required to implement and promote the new framework from the top down, starting with board and management buy-in. Management will also need to emphasise the Central Bank expectation that staff comply with the spirit, not just the letter, of the legislation,’ he adds.

Preparations for the new regime may be complicated by the fact the bill allows for the extension and expansion of its measures through regulations issued by the Central Bank.

This means the granular detail of some requirements – for example, the preparation of management responsibility maps and statements of responsibility – will depend on information provided by the Central Bank after the bill is made law. And, of course, it also means requirements are likely to change over time.

Act now

Finance firms, however, don’t have the luxury of waiting for every detail to emerge before acting. On the question of where to begin, Hogan advises that ‘regulated firms should prepare to establish a cross-functional implementation group (commercial, regulatory, compliance, legal, HR, and other relevant stakeholders) that has board access.’

Mazars identifies the key challenges as ensuring the firm has the buy-in and engagement of senior management, setting the right tone from the top, and designing and implementing fit-for-purpose documents, systems and controls.

‘The Central Bank’s expectations around conduct risk management have been well aired over the years and many firms have already been working on meeting them,’ says Kian Caulwell, Mazars partner and head of financial services consulting.

‘For most firms it shouldn’t require a paradigm shift to comply with the new rules. However, for firms that haven’t been implementing conduct risk frameworks, it’s going to be a challenge to demonstrate internally and externally that the firm is acting in the customer’s interests.’

Significantly, firms will be required to provide training for employees as they embed the expected conduct standards in the culture of the firm.

For those individuals found to be in breach of the new regulations, sanctions are set to vary from reprimands to fines of up to €1m to disqualification from future management roles in financial firms. However, any sanction imposed as a result of a Central Bank inquiry must be confirmed by the High Court to take effect.

Positive expectations

The Prudential Regulation Authority's (PRA) December 2020 evaluation of the SMCR found that 96% of the 140 firms surveyed believed the framework ‘had brought about positive and meaningful changes to behaviour’. However, the UK regulator also noted that from March 2016 to October 2020 it had received only 16 notifications about senior managers (out of a total of around 7,850 people approved to perform in a senior manager function) – a number that it described as ‘modest’.

With legislation in Ireland unlikely to come into effect until late 2023, it may be the end of the decade before its impact can be assessed. Tempering expectations, Hogan says: ‘It would be unrealistic to expect any legislation to prevent all conduct risks. Inevitably issues may arise in regulated firms, whether as a result of human error, system failures or fraud.’

A jaundiced public may not have all their misgivings addressed, but embedding the principle of accountability in law will, at the very least, offer a foundation for further progress in the future.