CASS crusade gets personal: CF10 fined and banned

The FSA's commitment to personal enforcement action as part of its senior management responsibility drive was confirmed today by the publication of the Final Notice against David McGrath, formerly of ActivTrades.

As well as reinforcing the FSA's current focus on CASS compliance, this also serves as a significant warning to compliance officers that they can be held personally responsible for their firm's systems and controls failures.

I noted in March that ActivTrades plc, a foreign exchange broker, had been fined over £85,000 for failings during a 'relevant period' that partly post-dated the high profile CASS cases in June 2010.  As the CF10 responsible for compliance oversight, McGrath was found to have breached Statement of Principle 7 for Approved Persons which required him to take reasonable steps to ensure that the business for which he was responsible complied with the relevant requirements and standards of the regulatory system.

McGrath's failings were deemed particularly serious because the systems and controls deficiencies were not identified through compliance monitoring but by third parties.  He also relied on an external consultant for guidance with regard to client money but, because of his inadequate knowledge of the CASS rules, did not (or was not able to) consider the adequacy of the advice or whether it was reasonable for him to rely on it.

The breaches of CASS rules identified are by now familiar from previous Final Notices, but the fact the FSA has taken such draconian steps against a compliance officer for non-deliberate systems and controls breaches is (as far as I am aware) a first and, therefore, very significant.  The firm still has 13 approved persons, suggesting this is not like previous enforcement cases against CF10s in which the misconduct has related more to their role as partner, director or adviser in a small firm where they also happened to carry out the compliance function.

The Final Notice identifies some very particular failings by ActivTrades and McGrath but, to the extent it sets any precedent, there are a number of quite alarming implications for other CF10s:

• The Final Notice confirms that McGrath's conduct was not deliberate but the FSA thought it proportionate to ban him for life and impose a fine of £3,000 (despite his acknowledged financial hardship)
• As CF10, McGrath ought not to have relied as he did on external consultants despite rules such as COBS2.4 which anticipate reasonable reliance on third parties
• Paragraph 2.3(1) of the Final Notice goes beyond the burden imposed by Statement of Principle 7 for Approved Persons ('to take reasonable steps to ensure...') and SYSC3.2.8 which requires the CF10 to have responsibility for oversight of the firm's compliance and reporting to the firm's governing body.  The Final Notice says "compliance officers ... are responsible for ensuring that the businesses that they oversee comply with regulatory requirements and standards"
• Paragraph 4.29 suggests that McGrath ought himself to have checked at least some client money calculations or reconciliations.  Whilst that may have been the case on these facts, it would be worrying indeed for CF10s if their role is interpreted to include a personal verification obligation

During this year, the FSA is introducing a CF10a or CASS operational oversight function and proposes similar for complaints.  Today's Final Notice will make these even less attractive roles.

The FSA has not (yet) issued a press release about this Final Notice - unlike the 2008 announcement about the first fine against an MLRO - and perhaps, therefore, does not see it as the seismic shift in approach that the above points would suggest it is.  Either way, CF10s - and senior managers - beware.