Sneaking in the back door? CiCs and VoPs are starting to raise some alarm bells

Following on from our series of articles on new firm authorisations, and our popular webinar on the FCA Authorisations ‘gateway’ function, this article looks at two of those other regulatory transactions – changes in control (CiCs) and variations of permission (VoPs)- in a bit more detail. It examines how the processes and procedures surrounding them have been undergoing a little transformation by the Financial Conduct Authority (FCA) and subsequently provides guidance on what that means for firms. The overall takeaway is that now, what was seen by some as a means of obtaining authorisation through the back door, CiCs and VoPs are allowing the FCA to focus on firms’ businesses and activities to a greater extent than previously and are giving them scope to ask more questions.

Changes in Control

Whereas a new firm applying for FCA authorisation might be seen as seeking authorisation through the front door, a CiC notification, or ‘Section 178 notice’, has long been seen as a means of obtaining authorisation through the back door, given the shorter statutory clock in which the FCA has to process them. But does it deserve that reputation? Some individuals may be under the impression that CiCs can circumvent the due process that is seen with FCA applications for authorisation and indeed represent a shortcut for firms to gain a licence to operate in the UK by simply buying one in the form of an already regulated financial entity. Of course, that is not always the case and many (I would stick my neck out and say most) CiC notifications are perfectly logical and sensible transactions, where perhaps a modest share (10% or more) of a regulated firm is acquired, or where a new company is inserted into an existing shareholding structure.

Also, to dismiss any idea that CiCs could provide a shortcut, there are different controller ‘share bands’ that are likely to influence the level of scrutiny applied by the FCA; the greater the shareholding, the greater the scrutiny. Of these, it is more the 100% acquisitions (that see a completely new and unrelated firm/group wishing to take over the regulated firm), that warrant the most intense scrutiny. Often, such a transaction is simply to acquire the target firm’s permission/licence, rather than the firm’s business and infrastructure. Having previously worked in the CiC team, I always recall the mantra “UK licences are not for sale”, however the legislation does at least allow for that possibility.

How are CiCs being affected by The FCA’s ‘transformation’?

Notwithstanding the earlier comment about ‘share bands’, the level of scrutiny being applied to all CiCs at the moment has become absolutely consistent with the ‘more robust gateway’ we have been commenting on since the FCA Business Plan 21/22 was published, and which seems to be continued as part of the Business Plan 22/23 and Three Year Strategy. Whilst the focus of the CiC assessment is primarily on the acquirer (corporate, trust or individuals), such scrutiny may also be increased depending on the situation of the target firm. By virtue of it being a regulated firm, the FCA will already know something about it that may influence the assessment.

Perhaps the most extreme situation of all is where a firm has a permission but is not actively using it e.g. it may not have any staff or customers and has, essentially, an empty permission. Now, the likelihood of such a firm is constantly reducing, as the FCA ramps up its ‘use it or lose it’ campaign to cancel such firms (indeed, it has recently announced plans to speed up this process). All that said however, there are still some firms out there up ‘for sale’. Such acquisitions are likely to be seen by the FCA as what they are, a shortcut to gaining an FCA licence through regular arbitrage. I would suspect that such applicants would now be politely directed to the front door and encouraged to submit a new firm authorisation application.

It’s a matter of…timing

Given the concerns and the scrutiny being applied, how long might the process take? On its website, the FCA says...

‘We have up to 60 working days (excluding any interruption period) to assess a change in control case. This period begins on the day we acknowledge receipt of a complete [my emphasis] Section 178 [of the Financial Services & Markets Act 2000 (‘FSMA’)] notice’.

However, recently the FCA appears to be conflating the ‘complete’ status of a Part 4A permission application [see our second Authorisations article] with that of the s178 notice, asserting that the 60 days applies from when the application is ‘complete’. For me, ‘complete’ in the s178 context used to simply be a filled-in notification form and was not even mentioned in legislation. In addition, if further information may be required by the FCA, it is anticipated by the clock stop facility written into legislation– s.190(1). However, having been involved in the European working group that developed the Guidelines supporting such CiC notifications, that is not my recollection of how the legislation was to be interpreted: two days to acknowledge a quantitively complete application (i.e. all the questions answered and supporting documentation provided); 60 days from then to assess; if further ‘clarification’ is needed, the FCA can effectively ‘stop the clock’ (for up to 30 days, by day 50, s.190(1)).

Section 189(6) says that the acquisition is deemed approved if the FCA has neither communicated approval of (or proposal to refuse) the application or informed the notice-giver that the application is incomplete. Now instead, we are routinely seeing s.178 notice givers being advised that the application is ‘incomplete’ and that the 60-day clock won’t commence until it has been assessed as complete. Consequently, CiC notifications are taking longer than ever before. This is now stated on the FCA’s CiC landing page with the added statement that “currently, there is a delay of approximately two months between submission of a complete application and allocation to a case officer”.

What is causing this change in interpretation of the legislation and Guidelines, by the FCA? Brexit has provided the opportunity to ‘disregard’ or reinterpret some of the provisions that the FCA previously signed up to and this development around CiCs will likely be more formalised in the Financial Services and Markets Bill which will, among other things, continue to revoke certain parts of retained EU law and replace with regulation better designed for the UK.

Oh, and don’t forget; failure to obtain prior FCA approval of a change in control is a criminal offence!

Variations of permission

As we explained in our webinar, the assessment process for a VoP is broadly similar to that for a new firm authorisation.

Keeping with our clunky housing analogy, a VoP sees the firm seeking to build an extension, for which it needs planning permission. Historically, the FCA has appeared to be more relaxed about such applications, on the basis that the firm itself is already authorised (and subject to supervision – if only through regulatory reporting – by the FCA) and is therefore ‘known’ to the FCA. In that context, the assessment of a VoP application has often been seen limited only to the new activity for which permission is being sought.

However, that perception is certainly being dispelled if we are to examine recent FCA behaviour when a firm’s VoP is submitted. In line with its approach to new firm authorisations, the FCA is now looking at the entirety of the firm’s arrangements and business (including unregulated business), consistent with its 21/22 Business Plan statement that “Our standards will be higher, with more intensive assessment and greater scrutiny of firms’ financials and business models”.

Whilst the VoP form itself is less onerous than that for new firm authorisations, don’t be lulled into a false sense of security and feel your responses can be similarly brief. Many firms applying for a VoP may not have been formally or holistically assessed by the FCA since they were first granted permission. The FCA is now seeing this as an opportunity to run the rule over the entire firm to ensure that it continues to meet threshold conditions, taking into account any regulatory/supervisory history, as well as the new activities being requested.

The timings for assessment of VoP applications is the same as for new firm applications:

• FSMA: determination within six months of receipt of a ‘complete’ application (or within six months of it becoming complete) or within 12 months of an ‘incomplete'

• Payment Services Regulations (PSRs)/ EMRs (and insurance distribution): determination within three months of receipt of a ‘complete’ application (or within three months of it becoming complete) or within 12 months of an  ‘incomplete' application

Unfortunately, this additional scrutiny, combined with the fact that many VoP applications go into the same ‘queue’ for case office allocation as for new firm authorisations, means that VoPs are also taking the FCA longer to determine.

Conclusion

As we noted, the FCA has said “Our standards will be higher, with more intensive assessment and greater scrutiny of firms’ financials and business models” and “we will expect [refusal/withdrawal/rejection rates] to increase initially as we make the gateway more robust.” Whilst the focus of such messages has been on new firm authorisations, it is absolutely being applied across all regulatory transactions. It is important that you approach each application/notification to (or, indeed, any interaction with) the FCA, with clarity, honesty and with an appreciation that it’s not likely to be a quick process. We can help you with your preparations, having helped over 1,100 firms become authorised, and assisted many more with other regulatory transactions.