In this blog, we offer a timely update for legal and compliance folks, with a spotlight on recent FCA fines, the growing impact of AI and the critical role of governance.
Recent Fines and Regulatory Developments:
- Equifax incurred an £11 million penalty from the FCA for a cybersecurity breach, with authorities noting, "There were known weaknesses in Equifax Inc’s data security systems, and Equifax failed to take appropriate action in response to protect UK customer data." In 2018 the Information Commissioner's Office (ICO) imposed a fine of £500K for the direct breach of data protection. This fine highlights the regulatory emphasis on governance and oversight.
- The FCA Consumer Duty came into full swing. By requiring fintech companies to maintain a robust process for product approvals, engage in regular product reviews, and take necessary actions based on these assessments (PRIN 2A.3) in addition to the consumer duty champion requirements, the FCA is reinforcing the critical role that governance plays in safeguarding consumer interests.
- Modulr faced regulatory action resulting in restrictions on new customer onboarding, citing "systems and processes".
- The Bank of England and FCA jointly published a discussion paper (DP) 5/22 – Artificial Intelligence and Machine Learning – in October 2022 to explore the potential impacts of AI on firms. Respondents highlighted various concerns and suggestions related to governance in the context of AI, including the risks of bias, discrimination, lack of transparency, and the challenges associated with data and model oversight.
What is Governance: Governance is the framework of rules, processes, and structures that shape how an organisation operates. It defines who makes decisions, ensures accountability, promotes transparency, and manages risks.
Governance is vital for several reasons:
- Trust and Reputation: Trust is paramount. Good governance fosters trust among stakeholders, including customers, investors, and regulators.
- Risk Mitigation: Governance helps identify, assess, and mitigate risks.
- Compliance: With the introduction of regulations like Consumer Duty and growing concerns about AI, governance ensures that organisations comply with legal and regulatory requirements.
The Challenge of Embedding Governance: Embedding governance into the fabric of an organisation is often easier said than done. It involves significant cultural shifts, changes in behaviour, and the adoption of new processes.
Challenges include:
- Change Management: Implementing governance often requires a shift in mindset and behaviour across all levels of the organisation. Resistance to change can be a barrier.
- Remote Work and Information Overload: The rise of remote work and information overload in the digital age can complicate governance efforts. Ensuring that all team members are aware of and adhere to governance practices becomes more challenging.
- Tech Integration: There aren't a lot of good modern tech tools that integrate governance in a flexible, effective, efficient way that keep both 1st and 2nd line teams happy.
- Training and Awareness: Education and awareness-building are crucial aspects of governance. Ensuring that every team member understands and complies with governance requirements is a continuous effort.
As we go into Q4, governance remains a central theme. Its importance in building trust, managing risks, and ensuring compliance cannot be overstated. However, embedding governance into the culture and operations of an organisation is a real challenge—one that requires strategic planning, effective change management, and a commitment to transparency and accountability.
