Reliance Update and Trends in the 2019 Examination

As part of its Thematic Examination Programme for 2023, the JFSC has selected Reliance on Obliged Persons as one of its themes and last week, issued an Industry Update – Additional Information on 2023 Reliance Thematic.

Reliance and examination of compliance with the associated obligations has been a longstanding feature of the Jersey financial services environment, being included within the 2015 Moneyval Evaluation and the JFSC’s thematic examination programme in 2019 – Examination report reliance on obliged people — Jersey Financial Services Commission (jerseyfsc.org). Those in scope for participation within the newly scheduled examination should, therefore, already have good understanding of the nature of reliance, mandated conditions and obligations in respect of identity measures helpfully included within the additional information notice (if not, call the Efficace emergency number).

Within the Industry Update, the JFSC provides its rationale for undertaking this further examination of Reliance, as a desire to ensure its expectations with regard to feedback papers are met. It’s the JFSC’s expectation that all feedback papers are reviewed by businesses with a view to identifying any need for amendment or enhancement to the way in which risks are mitigated and managed. In addition to ensuring that you are in a position to robustly demonstrate compliance with your obligations in relation to Reliance, businesses may also consider reviewing internal governance arrangements for the identification, management and implementation of all thematic examination feedback papers.

Moving to the 2019 Themed Examination – we’re told that feedback papers from Thematic Examinations are a useful source of information for Supervised Persons as they extract identified Good and Bad practices. The use of the word “Good” in the 2019 report is limited. The report reflects 54 findings identified against a sample of 11 businesses. The best within the sample are said to be largely compliant and the remainder requiring significant changes to internal systems and controls.

The 2019 Thematic Examination Report (issued August 2020) is detailed and provides a granular view of findings. However, from our analysis, several broader themes emerge, and we include details of these below with some high- level views on effective practice:

Strong Initial and Ongoing Regulatory Analysis
Examination: A number of examples are provided where businesses have failed to apply the regulatory framework in a manner consistent with the requirements of the Reliance regime. This includes technical findings identified in relation to compliance with specific legal and regulatory requirements for the written assurance, the risk assessment, governance and testing as well as other areas.

Efficace: A documented, robust regulatory and technical analysis should form the basis of any compliance arrangement or application, including Reliance. Systems and controls must be developed on the basis of this analysis and calibrated in accordance with the specific risks identified and assessed. Regulatory analysis and risks must be reviewed and updated at regular intervals, identifying and responding to change, adapting and enhancing systems and controls at each relevant juncture.

Record Keeping and Failure to Document
Examination: Maintenance of adequate and orderly records is a consistent theme with businesses unable to produce records of written assurance, risk assessments, documents being completed with insufficient detail or incorrectly, inadequate or insufficient recording of risks.

Efficace: Maintenance of adequate and orderly records not only meets the regulatory requirements but also supports businesses in robustly demonstrating compliance with their obligations. Good records are those that are completed accurately, contemporaneously and kept up to date, are of sufficient quality and detail and maintained in an adequate and orderly manner.

Governance and Oversight
Examination: Identified failures to effectively capture Reliance within Financial Crime Business Risk Assessment and apply effective governance in the approval and oversight of Reliance arrangements. Further findings relating to effective oversight of arrangements and monitoring and testing of Obliged Persons were noted.

Efficace: Where arrangements, such as those relating to obliged persons are entered into, these must be the subject of ongoing attentive and effective governance. Analysis of the risks presented by such arrangement must be captured within a business’s Financial Crime Business Risk Assessment. The extent and nature of the risks posed by Reliance arrangements must be subject to regular oversight, review and reporting for scrutiny, discussion and challenge by relevant boards/committees. The results of testing of arrangements should be included within reporting and appropriate actions determined where any failures are identified or any backlogs or delays in testing may exist.

Compliance Monitoring Programme
Examination: A number of findings related to failure to comply with systems and controls for entering into, and compliance with, obligations on Reliance. This includes, among other things, failing to document risk assessments, failure to obtain written assurances, failures to adequately document risks and failure to obtain required identity information. There is limited information on the extent to which businesses had self-identified findings through the execution of a compliance monitoring programme (“CMP”).

Efficace: Businesses must have in place a CMP to test compliance with robust systems and controls. In the context of Reliance, the CMP must be calibrated to test systems and controls, to include policies and procedures, related to the establishment, management and oversight of Reliance arrangements. This would include testing of adherence to the statutory testing requirements of Obliged Persons. Where areas of deficiency are identified action must be determined and taken to ensure compliance with the regulatory framework.

In relation to Reliance, it is easy to conflate the Obliged Person testing that must be performed on external parties and the internal independent second line of defence testing characterised by the CMP. This would be a mistake. These two distinct practices, operating in concurrent operation, are key to management of external and internal risk related to Reliance arrangements and ensuring demonstrable compliance with legal and regulatory obligations.

Should you wish to discuss any of the themes raised within this document or our services more broadly, please get in touch through our website www.efficace.je or e-mail hello@efficace.je.