SYSC 6
Compliance, internal audit and financial crime
SYSC 6.1
Compliance
- 01/01/2007
[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]
SYSC 6.1.1
See Notes
A firm must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and appointed representatives(or where applicable, tied agents) with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime.
[Note: article 13(2) of MiFID and article 12(1)(a) of the UCITS Directive]
[Note: article 13(2) of MiFID and article 12(1)(a) of the UCITS Directive]
- 01/04/2013
SYSC 6.1.2
See Notes
A common platform firm and a management company must, taking intoaccount the nature, scale and complexity of its business, and the nature and range of financial services and activities undertaken in the course of that business, establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the regulatory system, as well as associated risks, and put in place adequate measures and procedures designed to minimise such risks and to enable the appropriate regulator to exercise its powers effectively under the regulatory system and to enable any other competent authority to exercise its powers effectively under MiFID or the UCITS Directive.
[Note: article 6(1) of the MiFID implementing Directive and article 10(1) of the UCITS implementing Directive]
[Note: article 6(1) of the MiFID implementing Directive and article 10(1) of the UCITS implementing Directive]
- 01/04/2013
SYSC 6.1.2A
See Notes
Other firms should take account of the adequate policies and procedures rule (SYSC 6.1.2 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
- 01/04/2013
SYSC 6.1.3
See Notes
A common platform firm and a management company must maintain a permanent and effective compliance function which operates independently and which has the following responsibilities:
[Note: article 6(2) of the MiFID implementing Directive and article 10(2) of the UCITS implementing Directive]
(1) to monitor and, on a regular basis, to assess the adequacy and effectiveness of the measures and procedures put in place in accordance with SYSC 6.1.2 R, and the actions taken to address any deficiencies in the firm's compliance with its obligations; and
(2) to advise and assist the relevant persons responsible for carrying out regulated activities to comply with the firm's obligations under the regulatory system.
[Note: article 6(2) of the MiFID implementing Directive and article 10(2) of the UCITS implementing Directive]
- 01/04/2013
SYSC 6.1.3A
See Notes
(1) Other firms should take account of the compliance function rule (SYSC 6.1.3 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
(2) Notwithstanding SYSC 6.1.3 R, as it applies under (1), depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have a separate compliance function. Where a firm has a separate compliance function the firm should also take into account SYSC 6.1.3 R and SYSC 6.1.4 R as guidance.
- 01/04/2013
SYSC 6.1.4
See Notes
In order to enable the compliance function to discharge its responsibilities properly and independently, a common platform firm and a management company must ensure that the following conditions are satisfied:
[Note: article 6(3) first paragraph of the MiFID implementing Directive and article 10(3) of the UCITS implementing Directive]
(1) the compliance function must have the necessary authority, resources, expertise and access to all relevant information;
(2) a compliance officer must be appointed and must be responsible for the compliance function and for any reporting as to compliance required by SYSC 4.3.2 R;
(3) the relevant persons involved in the compliance functions must not be involved in the performance of services or activities they monitor;
(4) the method of determining the remuneration of the relevant persons involved in the compliance function must not compromise their objectivity and must not be likely to do so.
[Note: article 6(3) first paragraph of the MiFID implementing Directive and article 10(3) of the UCITS implementing Directive]
- 01/04/2013
SYSC 6.1.4-A
See Notes
In setting the method of determining the remuneration of relevant persons involved in the compliance function:
(1) firms that SYSC 19A applies to will also need to comply with the Remuneration Code;
(2) BIPRU firms will also need to comply with the BIPRU Remuneration Code;
(3) firms that SYSC 19D applies to will also need to comply with the Dual-regulated firms Remuneration Code; and
(4) firms that the Remuneration part of the PRA Rulebook applies to will also need to comply with it.
- 01/07/2015
SYSC 6.1.5
See Notes
A common platform firm and a management company need not comply with SYSC 6.1.4 R (3) or SYSC 6.1.4 R (4) if it is able to demonstrate that in view of the nature, scale and complexity of its business, and the nature and range of financial services and activities, the requirements under those rules are not proportionate and that its compliance function continues to be effective.
[Note: article 6(3) second paragraph of the MiFID implementing Directive and article 10(3) second paragraph of the UCITS implementing Directive]
[Note: article 6(3) second paragraph of the MiFID implementing Directive and article 10(3) second paragraph of the UCITS implementing Directive]
- 01/04/2013
SYSC 6.1.6
See Notes
Other firms should take account of the proportionality rule (SYSC 6.1.5 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
- 01/04/2013
SYSC 6.1.7
See Notes
(1) This rule applies to a common platform firm conducting investment services and activities from a branch in another EEA State.
(2) References to the regulatory system in SYSC 6.1.1R, SYSC 6.1.2 R and SYSC 6.1.3 R apply in respect of a firm'sbranch as if regulatory system includes a Host State's requirements under MiFID and the MiFID implementing Directive which are applicable to the investment services and activities conducted from the firm'sbranch.
[Note: article 13(2) of MiFID]
- 01/04/2013
SYSC 6.2
Internal audit
- 01/01/2007
SYSC 6.2.1
See Notes
A common platform firm and a management company must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of its financial services and activities, undertaken in the course of that business, establish and maintain an internal audit function which is separate and independent from the other functions and activities of the firm and which has the following responsibilities:
[Note: article 8 of the MiFID implementing Directive and article 11 of the UCITS implementing Directive]
(1) to establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the firm's systems, internal control mechanisms and arrangements;
(2) to issue recommendations based on the result of work carried out in accordance with (1);
(3) to verify compliance with those recommendations;
(4) to report in relation to internal audit matters in accordance with SYSC 4.3.2 R.
[Note: article 8 of the MiFID implementing Directive and article 11 of the UCITS implementing Directive]
- 01/04/2013
SYSC 6.2.1A
See Notes
Other firms should take account of the internal audit rule (SYSC 6.2.1 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
- 01/04/2013
SYSC 6.2.2
See Notes
The term 'internal audit function' in SYSC 6.2.1 R (and SYSC 4.1.11 G) refers to the generally understood concept of internal audit within a firm , that is, the function of assessing adherence to and the effectiveness of internal systems and controls, procedures and policies. The internal audit function is not a controlled function itself, but is part of the systems and controls function (CF28).
- 01/04/2013