'Naming and shaming' by the FCA

The backlash towards a Financial Conduct Authority (FCA) consultation, which proposed to publically ‘name and shame’ some companies under investigation, was immediate. Marcus Ashworth, writing for Bloomberg, labelled the plan “Mad, Bad and Dangerous to the City”. A House of Lords committee warned that it could risk the integrity of the market. Yet, the FCA’s plans are consistent with a move, championed by the press (for obvious reasons), towards greater transparency more generally in legal and regulatory decision making.

In May, The Times trumpeted a ruling in the High Court in Belfast in favour of media scrutiny. The ruling found that legislation (The Justice (Sexual Offences and Trafficking Victims) Act) providing for anonymity for those suspected of committing sexual offences unlawfully inhibited the press’ role as “a watchdog” for the public. The proposed legislation followed the media frenzy that occurred during a 2018 case concerning two Ulster rugby players. Other moves towards greater transparency have been witnessed in the Family Court and championed by the President of the Family Division. These changes can have profound and lasting consequences, and warrant careful consideration.

The policy considerations behind the FCA’s proposal are straightforward. These include increasing transparency and accountability, deterring misconduct and building public trust in the system. Some (including the FCA) also see the changes as a means of encouraging witnesses to come forward. All these arguments are regularly deployed across the justice system. The consultation also makes clear that the FCA is obliged under the Financial Services and Markets Act 2000 (FSMA) and the Legislative and Regulatory Reform Act 2006 (LRRA) to exercise their functions in a transparent, proportionate and consistent way.

However, public trust in brands and the reputation of UK financial institutions are also important, highly valuable, and require protection from unwarranted allegations. Long periods of adverse publicity can cause serious damage to share prices, careers and consumer confidence, and it hardly needs to be said that not every investigation will result in an adverse finding.

Innocent until proven guilty applies equally in the corporate regulatory sphere as it does in criminal law. The FCA has accounted for this inevitability in their consultation, where they state that they will publish updates on investigations, including announcing when “we have closed cases where our investigations have not led to regulatory or other action.” Rather than providing comfort to the financial sector, this statement emphasises the inherent risk with naming any company or individual under investigation. At the point the investigation concludes, the damage may well be done.

What exactly is the FCA proposing?

Chapter 3 of the consultation paper outlines the FCA’s proposed changes and how those changes will apply.

The FCA intends to publish “the identity of the subject of the investigation, if we assess that it is in the public interest to do so and if there are no compelling legal or other reasons not to”. This begs the question, how will the FCA define ‘public interest’ and what are compelling legal or other reasons?

Their proposed public interest framework is made up of a number of factors .which indicate that an announcement or update will be in the public interest. One factor is whether it will “help our investigation, for example by encouraging potential witnesses or whistleblowers to come forward”. This factor is vague and arguably could apply to most FCA investigations. Another is the likelihood that making an announcement will “deter future breaches of our rules or other requirements or prohibitions”. Once again, this statement could apply to almost any company under investigation.

One factor that is less generic, is the likelihood that publication will “address public concern or speculation, including by correcting information already in the public domain.” One can see how correcting false information may be in the public interest, however, given the potentially damaging impact of publication; it will be for the FCA to conduct a delicate balancing exercise and to be slow to publish allegations that cannot easily be retracted. In many cases, the companies may prefer to correct information themselves rather than rely on the FCA to do so.

Similarly, the FCA has outlined a set of factors that could indicate that an announcement may not be in the public interest. These include when it is likely to have an adverse impact on:

• the conduct of an FCA investigation, or an investigation by another regulatory body or law enforcement agency.
• the interests of consumers.
• the stability of the UK financial system or the FCA’s ability to carry out its statutory functions.

Notably, unfair or unwarranted reputational damage does not feature as a relevant factor. The FCA is candid about this in paragraph 3.8 of their consultation:

“We recognise that this more transparent approach may raise concerns about potential impact on our investigation subjects. We have, however, not included such impact as a specified factor in our proposed framework.”

Notwithstanding, the FCA makes clear that the factors (both for and against publication) are non-exhaustive and that any announcement or update will be determined on a case-by-case basis, taking all relevant factors into account. However, the fact that the impact on investigation subjects has been specifically excluded as a specified factor implies that this alone is unlikely to sway the FCA against publication.

Where then, does this leave companies? The case-by-case approach, while helpful in preventing the FCA from being restricted by an overly formulaic decision-making process, also leaves room for uncertainty and wide discretion – something which could be contrary to the FCA’s legal obligation to exercise their functions in a consistent way. Inevitably, well-funded companies under investigation are going to have to invest heavily in legal and PR strategies to manage the reputational risks.

The FCA should be careful of unforeseen consequences. The potentially deterrent effect of a more public investigation process may well have unforeseen consequences upon the financial system and drive companies away from UK regulatory oversight, which is the very last thing the FCA should be doing.

Will individuals be affected?

The forward to the consultation states that, “given the specific legal considerations regarding information about individuals, we will not generally announce when we’ve opened an investigation into a named individual”. This is unsurprising in light of the Supreme Court decision in Bloomberg LP v ZXC [2022] UKSC 5, where the Court held that an individual has a reasonable expectation of privacy in connection with an investigation at the pre-charge stage. Although this case related to a criminal offence, the judgment has wide utility and publishers will be at risk of an injunction and damages if they seek to name individuals subject to an FCA investigation without a powerful public interest basis for doing so.

The FCA also has to comply with the UK GDPR and the Data Protection Act 2018. In the context of regulators, this means that any processing of personal data must be for a lawful reason, such as it being necessary in order for them to perform a task which is in the public interest.

What can be done?

The risk of a competitor or a disgruntled ex-employee making a spurious complaint, while small, is not insignificant. Thus, the FCA has an obligation to exercise extreme caution when considering publication. The FCA may argue that they will only consider publication when there is significant evidence pointing to wrongdoing. Yet, it is difficult to reconcile this with their objective to use publication as means of “helping their investigation” alongside their concession that they are likely to need to update the public following publication, when the investigation closes without any regulatory or other action.

While data protection and privacy laws may provide protection for individuals who are under the scrutiny of a regulatory body, the same cannot be said for companies. The Defamation Act 2013 made corporate reputation far more difficult to protect, imposing an obligation of having to prove “serious financial loss” to be able to get over the first hurdle in bringing a defamation claim.

Thus, a threat of a defamation claim to attempt to repair unwarranted damage to reputation should only be deployed as an absolute last resort and in the most serious cases. It will be for companies to have effective contractual protections and processes in place and be ready to move fast to demonstrate to the FCA, and the press, why publication is not warranted.

It will be particularly important (both internally for companies and for the FCA itself) to prevent information leaks at the preliminary stages of an investigation, where false/unsustainable allegations or complaints may not yet have been ‘weeded out’ as disingenuous.

What next?

It remains to be seen what the outcome of the FCA’s consultation will be, but those subject to its regulatory oversight would do well to be prepared for a move towards greater transparency. We fear that the potential for publication of the names of businesses under investigation will lead to yet slower and more contentious processes, and the FCA would be well advised to publish only in exceptional cases. The financial press will be seeking juicy morsels from the FCA table. The “watchdog” is ready, are you?