Full Scope Firms in the UK are obliged to seek 'regulatory references,' i.e. job references of the kind prescribed by the country's financial regulator, in respect of people whom they want to appoint as senior managers, as 'significant harm/certification function holders' and as non-executive directors. There are six months to go before the regime is extended further.

Part 1 of this article explains the 'regulatory references' regime in detail. Part 2 discusses the difficult judgements that firms have to make when dealing with regulatory references.

Part 1 – What is a regulatory reference?

The Senior Managers and Certification Regime or SM&CR currently applies to "Full Scope Firms," namely banks, building societies, credit unions, Prudential Regulation Authority-designated investment firms and insurers. Full Scope Firms have to seek regulatory references for their senior managers, significant harm/certification function holders and non-executive directors. Other regulated firms do not currently have to request regulatory references. However, each one does have to respond to a regulatory reference request from a Full Scope Firm, albeit in a limited manner. In December 2019, the SM&CR will be extended to cover all firms regulated by the Financial Conduct Authority (other than appointed representatives) and such firms will become Full Scope Firms. The FCA has published some near-final rules regarding this extension.

What is the obligation?

Full Scope Firms must implement and maintain policies and procedures which comply with the regulatory reference regime.

Each Full Scope Firm must take all reasonable steps to obtain regulatory references from each firm that employed/engaged the individual in question in the previous six years before it asked for the references. It must request references from former employers even if those former employers are outside the financial services sector or based overseas. If a Full Scope Firm cannot obtain a regulatory reference from a former employer, it must obtain as much information as possible about an individual's fitness and propriety and it should record evidence of its efforts.

Timescales

A Full Scope Firm must obtain a regulatory reference:

• no later than one month before the end of the process of a senior manager applying for a senior management function;
• before issuing a certificate in respect of an individual being appointed to a certified function; and
• before appointing a non-executive director who is not a senior manager.

There are some limited exceptions to these timescales. For example, if it would breach the confidentiality of a commercial transaction, then it may be possible for a Full Scope Firm to delay obtaining a regulatory reference.

The FCA expects each regulated firm to respond to a request for a regulatory reference within six weeks.

What information must be requested?

A Full Scope Firm must request, from other regulated firms, the information set out in the FCA's mandatory regulatory reference template and must provide the referee firm with as much information as needed to let the referee firm understand what the individual's new function/role will involve (e.g. job title, role description, or an FCA controlled function code such as SMF4 Chief Risk).

A Full Scope Firm requesting information from a former employer outside the financial services sector will usually have to set out the information it is requesting from the former employer. An unregulated employer is not obliged to provide any information to the Full Scope Firm.

What information must be disclosed?

A Full Scope Firm must respond to a request for a regulatory reference by setting out the information requested in the FCA's mandatory reference template. Such questions include the following.

• Have there been any breaches of the individual or senior managers' conduct rules?
• Have there been any conclusions that the individual was not fit and proper to perform a regulated function?
• Have there been any disciplinary outcomes against the individual?

These are quite stark occurrences over which the firm has already deliberated. The real difficulty is that the mandatory form also (separately) requires a Full Scope Firm to provide all information it is aware of which it considers reasonably relevant to the individual's fitness and propriety. Although a firm does not have to disclose information that has not been verified, it still has to provide a full picture of the individual's fitness and propriety.

To what period of time should a reference relate?

A Full Scope Firm is only required to provide reference information in relation to the six-year period before the date of the request for the reference, save in the case of information concerning serious misconduct for which there is no time limit.

A Full Scope Firm is also required to update each regulatory reference it has given when matters come to light which would have meant that it would have drafted the reference differently, had it known about those matters when it provided the reference.

Overseas firms

The regulatory reference rules do not apply to overseas firms that do not have establishments in the UK. Overseas firms with establishments in the UK ought to provide regulatory references for individuals whom they employed in their branches in the UK and the content of each reference need only relate to their activities regarding the UK.

PART 2 – Examples of difficulties that the regime has

Regulatory references are not exempt from English laws regarding employment references. This puts Full Scope Firms between a rock (the regulatory reference regime) and a hard place (an individual's right to claim that his or her legal rights have been breached).

Here is a brief summary of the legal risks which apply to regulatory references in England and Wales.

• Defamation. If Firm A makes a false statement to Firm B which harms an individual's reputation, that individual could claim against Firm A for defamation. Therefore, Firm A must ensure that any references that it gives are true and supported by evidence.
• Malicious falsehood. If Firm A provides a reference which contains untrue comments which were made maliciously or recklessly, the individual can sue Firm A for damages.
• Deceit. If Firm A intentionally and knowingly makes a factual statement which it knows is not (or is reckless as to whether it is) true, and that reference is relied upon to an individual's detriment, the individual can sue Firm A for deceit.
• Negligent misstatement. Firm A owes a duty of care to Firm B and the individual when writing a reference. A failure to comply with the duty can give rise to a claim of negligent misstatement.
• Breach of duty. If Firm A fails to comply with the FCA's rules regarding regulatory references, Firm B and the individual could claim against Firm A for breach of duty.
• Constructive dismissal. If Firm A gives someone a damaging reference, or fails to give him a reference, in relation to an existing employee, the employee could (if he has at least two years' service) claim that the firm has breached the term of mutual trust and confidence and claim constructive unfair dismissal. (Members of a limited liability partnership cannot claim constructive dismissal.)
• Victimisation. If Firm A provides a reference which is tainted by the fact that an individual has raised a complaint about characteristics which are protected under equality legislation (such as age, sex, disability/health, pregnancy/maternity), then the individual can sue Firm A for victimisation.

Firm B can also be liable for acting on the basis of information related to such complaints. The individual may also have grounds to make a claim against Firm B if Firm B discriminates in the way it responds to a reference request because of the protected characteristics of the individual or any other person.

The way in which many a firm avoids these risks when giving normal (non-regulatory) references is to provide a factual reference only (e.g. with dates of employment and job title) or to not provide a reference at all. However, it will not be possible for a Full Scope Firm to take these approaches to regulatory references because they are required to respond fully to the questions on the mandatory template reference form.

Why are these real risks?

A blemished regulatory reference could prevent an individual from working in the financial services sector for a long time. Many firms do not take the risk of recruiting a candidate who has a regulatory reference which casts even a small doubt on his or her fitness and propriety.

Individuals do not have many ways of offsetting their financial losses if they receive damaging references. Accordingly, their losses are likely to be substantial. The new rules will motivate individuals (and their lawyers) to start disputes readily with former employers to try to prevent or limit damaging regulatory references. We have attended presentations given by lawyers who act mainly for individuals (not employers) and that was their message to us – an individual has to do whatever he or she can to prevent a damaging reference.

Of course, each time a firm provides a regulatory reference which states anything negative about an individual, it might give rise to a fresh claim against that firm.

A real-life scenario

Allegations of misconduct are raised by an employee about a senior manager. These allegations, if proven, would affect the firm's view of the manager's fitness and propriety. The manager is suspended, pending an investigation. However, before the firm has the chance to investigate the allegations against the individual, he or she resigns. A short time later, the firm receives a request for a regulatory reference.

The FCA has confirmed that firms are not obliged to conclude investigations in these circumstances but believes that it would be best practice for them to do so. However, let us suppose that the investigation is not concluded. In that case, Human Resources, Compliance and/or the management now have to decide what (if anything) the firm will say in the reference. The FCA has said in a policy statement that firms are not obliged to disclose the details of individuals who have been suspended pending internal investigations. A firm could therefore take the view that it does not need to disclose the details of the allegation in the reference. However, this does not sit easily with the obligation on firms to provide all information which is reasonably relevant to an assessment of the individual's fitness and propriety. One can imagine that if allegations are related to, say, sexual harassment or dishonesty, the firm giving the reference may feel quite uneasy about not referring to such allegations in the reference.

A further difficult decision is whether to offer the individual the opportunity to review the underlying evidence and to respond, so that the firm can take his or her response into account when it provides the reference. To be clear, the firm is not required to allow the employee to see the draft reference or to comment on the drafting.

Let us suppose that the individual then raises convincing and/or plausible defences to the allegations which further investigation might well corroborate. How far down the rabbit hole is the former employer prepared to go to be fair to the individual?

Finally, if something is stated in the reference about the individual's alleged conduct, the firm that is giving the reference should consider whether that would then trigger a reporting obligation to the regulator because there has been a breach of the 'conduct' rules.

Conclusions

As Andrew Bailey (the chief executive of the FCA) has put it, the regulatory reference regime was designed to prevent "rolling bad apples." At the core (pardon the pun) of the regime is a requirement for firms to make relatively frank disclosures about outgoing or former staff. Such firms face a real risk of litigation from individuals who may (justifiably) be very worried that they cannot work in the financial services sector again because trivial or unfounded allegations of misconduct have found their way into their regulatory references.

* Claire Cummings can be reached on 0207 585 1406 or at claire.cummings@cummingsfisher.com; Nancy King can be reached on 0207 205 2249 or at nancy@portmancompliance.com