| UK & Europe | Articles
The FCA has confirmed a significant increase in the number of firms required to submit a REP-CRIM Financial Crime report. The policy statement PS21/4: Extension of Annual Financial Crime Reporting Obligation, follows last year’s consultation and is likely to impact around 4500 firms who were not previously in scope. Although new returns are not due until next year, those submitting a REP-CRIM for the first time may find the process challenging.
What is REP-CRIM?
The purpose of the REP-CRIM is to provide the FCA with insight into the potential financial crime risks faced by firms. The annual financial crime reporting obligation (REP-CRIM) was introduced in 2016 and requires firms to provide a range of aggregated information to the FCA. The obligation to provide this financial crime information is set out in the FCA’s Handbook (SUP 16.23 Annual Financial Crime Report).
What’s changing?
The number of firms who will have to complete REP-CRIM is increasingly considerably from approximately 2,500 firms to 7,000 firms. In summary, the following additional firms will be required to provide the FCA with REP-CRIM information (irrespective of their total annual revenue):
- Certain FSMA authorised firms and payment institutions (who the FCA deem to pose higher inherent risks from a money laundering perspective)
- All electronic money institutions
- All multilateral trading facilities
- All organised trading facilities (a type of firm introduced by MiFID II)
- All cryptoasset exchange providers and custodian wallet providers.
What’s the FCA hoping to achieve?
The FCA hopes the extension will provide them with a greater breadth and depth of data from firms of differing size, customer and product profiles, business strategies and across more sectors. As evidenced within the latest Business Plan, the FCA wants to be more data driven when it comes to identifying which firms require their direct scrutiny.
The FCA expects firms to follow a risk-based approach to financial crime compliance and this is a way in which the regulator can practice what they preach when it comes to firm supervision.
How might the FCA utilise the data to inform its supervisory activity?
- report a disproportionately high or low number of high-risk customers when compared to peers
- report a disproportionately high or low number of SARs when compared to peers
- report inconsistencies in a firm’s reported jurisdictional exposure when compared to the business model
- appear to have insufficient financial crime or fraud resource.
It’s worth noting that reporting inaccurate data could inadvertently result in your firm being identified as an outlier, which could trigger a regulatory visit and unnecessary scrutiny.
When is this coming into force?
Firms being brought into scope are required to submit their first REP-CRIM within 60 business days after their first Accounting Reference Date, falling after 30 March 2022. This may seem like some time away, however, firms that were not previously required to submit REP-CRIM may find identifying data in an accessible, complete and accurate way to be challenging. Uplifts, especially in relation to IT, can be time consuming and expensive.
The FCA is conscious that firms who are new to this submission will likely complete it on a ‘best endeavours’ basis, especially at the start. However, the regulator has publicised its view that the data covered within REP-CRIM should already be held by firms, in order for them to effectively manage their financial crime risks. In addition, the FCA feels that twelve months is a reasonable time to uplift systems where required. This indicates the FCA has limited appetite to accept data submitted on a ‘best endeavours’ basis. Firms need to hit the ground running, come formal submission time.
What our experience tells us
Our work with firms already reporting under the existing regime has highlighted the importance of providing the FCA with complete and accurate data. Inaccuracies or discrepancies in reporting will bring increased scrutiny from the regulator when it comes to future submissions. Errors can also indicate deeper inadequacies in a firms systems and controls.
We have worked with many firms who were caught under the previous REP-CRIM regime to help both comply with the reporting requirements and the simplification of what can be a burdensome data gathering exercise. Firms already reporting to the FCA have found, in our experience, that it is most advantageous not to treat this as discrete exercise in completing the REP-CRIM submission. Instead it is best to treat this as an opportunity to enhance financial crime management information, MLRO reports and governance arrangements.
