The CEO of a mortgage intermediary is challenging a Financial Conduct Authority (FCA) decision to fine and prohibit him in relation to oversight failures.

The FCA’s pursuit of the Firm and its sole director

Mr Markou is CEO, sole-director and shareholder of a small mortgage and insurance intermediary (the Firm). He is approved by the FCA to perform the SMF1 (Director) and SMF3 (Chief Executive) controlled functions at the Firm.

In 2011, the FCA investigated the Firm in relation to concerns it had about financial crime systems and controls. Since then, the Firm has been subject to varying levels of scrutiny and intervention from the regulator, culminating in a Decision Notice issued in 2019. The Decision Notice set out the regulator’s intention to cancel the Firm’s Part 4A permissions, meaning that it would no longer be authorised to conduct regulated business.

The Firm successfully referred this decision to the Upper Tribunal. The FCA was ordered to reconsider its decision and pay the Firm’s costs. No further action was taken against the Firm.

Six months later, the FCA issued a Decision Notice to Mr Markou, claiming that he had acted without integrity in breach of Principle 1 of the FCA’s Statements of Principle and Code of Practice for Approved Persons (APER) and was not a fit and proper person to perform the controlled functions for which he has approval. The FCA claims that Mr Markou:

• did not have appropriate oversight of the Firm’s mortgage business
• failed to take sufficient steps to prevent the firm transacting business when it did not have professional indemnity insurance (PII)

The FCA characterised Mr Markou’s failure to implement effective financial crime controls and provide appropriate oversight as components of a breach of APER Principle 1, by finding that Mr Markou had demonstrated “a reckless failure to take appropriate steps to run a compliant business”.

Mr Markou has referred this decision to the Upper Tribunal on a number of grounds, including that:

• this is an abuse of process and / or
• the issues on which the FCA relies have already been litigated and decided in its case against the Firm

This is an interesting and novel challenge to the FCA’s conduct and decision making.

Issue estoppel – these issues have already been determined

Mr Markou claims that the issue of whether the Firm carried on regulated activities after its PII cover collapsed (the PII Issue), was an essential component of the FCA’s case against the Firm. In that case, the FCA claimed the Firm had failed to pay its fees and levies; while the Firm explained that it had not been able to pay these fees because it had not been able to trade while it did not have PII. Mr Markou, therefore, claims that the Tribunal was required to engage with this issue and made a finding of fact that the Firm had not conducted regulated business whilst it did not have PII cover.

The FCA argues that the Tribunal’s finding of fact was based on Mr Markou’s witness testimony, which the FCA did not dispute because its case against the Firm had not contained any allegations relating to the PII Issue. Accordingly, the regulator contends the issue has not actually been “litigated and decided”.

Abuse of process – regulator can’t have two bites of the cherry

The rule in Henderson v Henderson [1843-1860] All ER Rep 378 prevents a party advancing a cause of action that they could have advanced in earlier proceedings. Mr Markou claims that the FCA could have advanced the case it now makes against him, in its case against the Firm. Whilst the FCA accepts that it could have done so, it does not agree that it should have and disputes the allegation that its failure to do so was a result of negligence, inadvertence or accident. Again, the FCA’s position rests on its claim that the issue, of whether regulated business was conducted when no PII was in place, was not fundamental to the FCA’s case against the Firm.

Evidencing oversight – having policies is not enough

Whatever the Tribunal decides on these procedural arguments, a more practical lesson is highlighted in the FCA’s submissions in this case.

The FCA found that Mr Markou’s knowledge of how risks had arisen at the Firm in the past, coupled with his lack of oversight and control during the period in question, demonstrated a “reckless failure to take appropriate steps to run a compliant business”. It also highlighted how “regular interactions” that it had with Mr Markou led to the FCA “flagging concerns around lack of oversight and control” within the Firm, meaning that Mr Markou “ought to have been aware of the risks created by his conduct”. However, the FCA found that Mr Markou “ignored those risks and recklessly failed to” establish, maintain and enforce effective financial crime systems and controls; establish and practice an appropriate level of control and oversight and monitoring of the Firm’s mortgage advisers; and ensure that the Firm’s mortgage advisers did not carry on regulated mortgage business beyond the date upon which he knew that the Firm’s PII had lapsed. These factors led the FCA to conclude that Mr Markou had failed to act with integrity in breach of APER Principle 1.

The FCA’s findings demonstrate that the mere existence of compliance policies will be insufficient to convince the regulator that a firm and its senior managers have taken sufficient steps to monitor risk and compliance issues relating to the conduct of regulated business. Nor will a lack of identified wrongdoing count as evidence that policies and procedures are robust.

Mr Markou was unable to provide evidence to the FCA to demonstrate that advisers (most of whom worked remotely) actually followed the procedures specified in the Firm’s sales process document. At the same time, the FCA has been able to point to evidence demonstrating deviation from the firm’s policies and procedures.

Mr Markou seeks to justify his light-touch approach in various ways, including: that the Firm’s practices were “consistent with working practices during the COVID-19 pandemic”; that he trusted the experience of the Firm’s advisers; and regular monitoring of customer files was not required in the absence of customer complaints. Perhaps unsurprisingly, the FCA considers Mr Markou should have taken a more proactive approach to oversight; particularly where he had the means to oversee remote workers but chose not to.

The regulator’s expectations, in this respect, are relevant to firms of all sizes, as well as regulated individuals.