The PRA: Starting to flex its enforcement muscles?

The UK Prudential Regulation Authority (PRA) has rarely used its enforcement powers. Instead, the PRA has preferred to nip problems in the bud before they warrant enforcement action. However, a recent flurry of enforcement activity by the PRA may signal a greater willingness on its part to flex its enforcement muscles.

A look-back at the PRA’s enforcement record

Examples of enforcement action taken by the PRA have been few and far between. This is not necessarily unsurprising. The PRA has publicly stated that it does not intend to take as much enforcement action as the FCA. The reason for this approach being that the PRA would rather tackle issues proactively, as opposed to waiting for things to go wrong and only then stepping in and taking action.

However, since the start of 2016, the PRA has concluded more enforcement cases (four) than it did in 2013, 2014 and 2015 combined (three).

Of the Final Notices issued by the PRA since 2013, three have concerned individuals and the other four firms. The topics covered by these enforcement cases have been varied, ranging from outsourcing to IT system failures to risk management.

The fines imposed by the PRA on firms and individuals pale in comparison to those imposed by the FCA. Since 2013, the PRA has imposed fines totalling approximately £18.3 million. Nowadays it is rare for a single fine imposed by the FCA on a firm to be less than this amount. In the same time period, the FCA has fined firms and individuals almost £2.9 billion.

What factors tend to push the PRA to take enforcement action?

With more enforcement outcomes coming out of the PRA, firms may be left wondering when they can expect a call from the PRA’s Enforcement Division. The enforcement cases that have been concluded by the PRA to date have provided us with a better steer as to the types of cases where the PRA may take enforcement action.

So what factors have tended to push the PRA towards taking enforcement action?

• Stability of the UK financial system: For example, the PRA is likely to show an interest from an enforcement perspective if a breach of regulatory requirements has impacted UK markets, or had a widespread, negative impact on UK customers.
• Controls impacting the safety and soundness of a firm: If failings identified in relation to a firm’s controls are deemed to be so serious so as to risk the safety and soundness of the firm, this is a factor which may cause the PRA to show interest from an enforcement perspective.
• Culture: To the extent that the PRA identifies cultural deficiencies within firms which are linked to the factors listed above, this may prompt concerns on the part of the PRA and contribute to a decision on its part to enforcement action.
• Being open and co-operative with the PRA: Like the FCA, the PRA attaches considerable importance to firms being open and co-operative with it. This obligation does not only extend to sharing information relating to enforcement matters, which has traditionally been a focus for the FCA. For example, in one of the Final Notices issued by the PRA, a firm was censured for having failed to inform the PRA promptly of proposed changes to its senior management.

These factors align with the PRA’s statutory objective to promote the safety and soundness of firms it regulates. However, as is demonstrated by the fact that the FCA also took enforcement action in three of the seven enforcement cases that have been concluded by the PRA, there is often a considerable degree of overlap in terms of breaches that the FCA and the PRA may show an enforcement interest in.

As a result, firms that have identified regulatory breaches should think hard about whether, based on the factors listed above, the FCA and/or the PRA may show an interest. This analysis could prove particularly helpful in terms of identifying whether there is scope for arguing that only one of the FCA or the PRA should investigate a particular issue. Under the terms of their Memorandum of Understanding, the FCA and the PRA are required to consider whether it is appropriate for them to undertake joint enforcement investigations, with a view to minimising duplication and the regulatory burden on firms.

A shift in the PRA’s approach to enforcement?

The recent spate of PRA enforcement activity does not necessarily indicate a sudden, new enthusiasm on the part of the PRA to take enforcement action against firms and individuals. Most, if not all, of the enforcement cases concluded by the PRA will have taken a considerable time to investigate and conclude. The fact that these enforcement cases have tended to concern incidents or issues that have already arisen is consistent with the PRA’s overall approach of trying to tackle issues proactively and without resorting to enforcement action where this is possible.

Although its financial penalties may be lower than those imposed by the FCA, it is clear that the PRA is expending time and resources on enforcement action and is willing to go down this path when opportunities arise. In the UK, when we mention enforcement action, people can automatically assume this means enforcement action taken by the FCA. However, firms facing regulatory breaches should not discount the risk that the PRA may show an interest from an enforcement perspective, as well as - or even instead of - the FCA.