A round-up of recent enforcement actions and investigations in the financial services sector.
- SFO obtains £15m fine for bribery offences investigated for around a decade
- PRA fines Citigroup’s UK operations £44 million for failings in their regulatory reporting governance and controls
- “Principle of social justice” sees Bank liable for employee’s fraud
- New EU Whistleblowing Directive
- FCA fines PPC for misleading consumers and banks in first CMC case closed by the regulator
SFO obtains £15m fine for bribery offences investigated for around a decade
At the end of November, the Serious Fraud Office (SFO) secured a fine of £15 million against Alstom Network UK Limited (Alstom) for bribery offences. The SFO’s investigation had been ongoing for around ten years and involved cooperation with more than 30 countries.
Alstom was convicted of paying a bribe of €2.4 million to secure a €79.9 million contract, in the only conviction out of four charges the SFO brought against the company. Due to the age of the conduct under investigation the charges in this case were brought under s1 of the Criminal Law Act 1977 and s1 of the Prevention of Corruption Act 2010, rather than the Bribery Act 2010. This brings an end to the SFO’s investigations into Alstom.
The Prudential Regulation Authority PRA has imposed a combined financial penalty on Citigroup Global Markets Limited (CGML), Citibank N.A. London branch (CBNA London) and Citibank Europe Plc UK (CEP UK) branch (together, Citi) of £43.9 million for failings in relation to their internal controls and governance arrangements underpinning compliance with PRA regulatory reporting requirements.
Between 19 June 2014 and 31 December 2018, or parts thereof, Citi’s UK regulatory reporting framework was not designed, implemented or operating effectively. This led to Citi failing to submit complete and accurate regulatory returns to the PRA.
The pervasiveness of the errors and misstatements identified in the firm’s returns raised fundamental concerns about the effectiveness of Citi’s UK regulatory reporting control framework, did not provide the PRA with an accurate picture of CGML’s capital or liquidity position, and negatively impacted the PRA’s ability to supervise Citi.
Citi agreed to resolve this matter and therefore qualified for a 30% reduction in the fine imposed by the PRA. Without this discount, the fine imposed by the PRA would have been £62,700,000.
The Court of Appeal has agreed in Group Seven Limited v. Notable Services LLP  EWCA Civ 614 with the High Court decision to find LLB Veraltung (Switzerland) AG Limited (the Bank) vicariously liable for the wrongdoing of its employee.
Mr L, an employee of the Bank, fraudulently vouched to a law firm the good standing of a person involved in a €100 million fraud, allowing them to pass the firm’s money laundering checks.
Mr L’s relationship management position was considered particularly relevant by both the Court of Appeal and the High Court. The Court of Appeal found that Mr L’s conduct could be found to be within the nature of his job “viewed broadly” despite the fact he was not seeking to benefit the Bank through his actions.
This case reminds us that additional scrutiny is applied to “relationship managers” and demonstrates the broad application of vicarious liability.
On 17 December a new Directive on the protection of persons who report breaches of Union law came into force. The Directive guarantees protection to persons who publicly disclose information on breaches which is acquired in the context of their work-related activities, often referred to as ‘whistleblowers’ across a range of sectors, including financial services.
The Directive, which will remain relevant post-Brexit, sets out measure and requirements for protecting the confidentiality of whistleblowers, protecting them from retaliation, and providing advice and support.
The new provisions differ from the existing requirements in several ways. These include, but are not limited to:
- Applicability – the Directive appeals to any organisation, though Member States may exempt entities with fewer than 50 workers.
- Records – records should be made of oral reports and of meetings with reporting person. These records should be checked, rectified and agreed by signing by the reporting person.
- Prohibition on retaliation – threats and attempts of retaliation are expressly prohibited.
- Reversal of the burden of proof – in court proceedings relating to a detriment suffered by the whistleblower, if the whistleblower establishes that he/she made a report or disclosure pursuant to the Directive and suffered a detriment, it is presumed that the detriment was made in retaliation to the report. The burden shifts to the person who has taken the detrimental measure to prove it was based on “duly justified grounds”.
- Penalties – penalties must be available for retaliation, breach of confidentiality and knowingly reporting false information.
Whilst Member States have until 17 December 2021 to bring into force laws and regulations to comply with the Directive, financial services firms be prepared for potential regulatory and legal changes.
The Financial Conduct Authority (FCA) has fined Professional Personal Claims Limited (PPC) £70,000 for misleading consumers through its websites and printed materials. This follows the transfer of regulatory responsibility of claims management companies (CMCs) to the FCA in April 2019.
PPC’s websites and printed materials prominently used the logos of five major banks which was liable to mislead consumers into believing PPC was associated with these institutions.
PPC also failed to present accurate, fully formed, detailed and specific complaints to banks. It had submitted Financial Ombudsman Service (FOS) questionnaires to banks on behalf of different consumers. The questionnaires in part contained identical factual allegations where evidence specific to each client should have been presented.
The FCA took over the case from the previous regulator, the Claims Management Regulator (CMR) in December 2018, after PPC had appealed the CMR’s finding of breach and associated fine. In September 2019, after reviewing the evidence put forward by the FCA, PPC withdrew its appeal, and the FCA imposed the £70,000 fine on PPC for the failings identified in the CMR’s penalty notice.