Upper Tribunal Tax and Chancery Chamber

UT-2022-00097 - [2024] UKUT 00352 (TCC)

Fecha: 17-Sep-2024

Step 2: The seriousness of the breach

Step 2: The seriousness of the breach

(1)

The Authority will determine a figure that reflects the seriousness of the breach. In many cases, the amount of revenue generated by a firm from a particular product line or business area is indicative of the harm or potential harm that its breach may cause, and in such cases the Authority will determine a figure which will be based on a percentage of the firm’s revenue from the relevant products or business areas.

(2)

In those cases where the Authority considers that revenue is an appropriate indicator of the harm or potential harm that a firm’s breach may cause (as it is common ground is the position in this case), the Authority will determine a figure which will be based on a percentage of the firm’s “relevant revenue”. “Relevant revenue” will be the revenue derived by the firm during the period of the breach from the products or business areas to which the breach relates.

(3)

Having determined the relevant revenue, the Authority will then decide on the percentage of that revenue which will form the basis of the penalty. In making this determination the Authority will consider the seriousness of the breach and choose a percentage between 0% and 20%. This range is divided into five fixed levels which represent, on a sliding scale, the seriousness of the breach. The more serious the breach, the higher the level. For penalties imposed on firms there are the following five levels:

(a)

level 1 - 0%;

(b)

level 2 - 5%;

(c)

level 3 - 10%;

(d)

level 4 - 15%; and

(e)

level 5 - 20%.

(4)

The Authority will assess the seriousness of a breach to determine which level is most appropriate to the case.

(5)

In deciding which level is most appropriate to a case involving a firm, the FCA will take into account various factors, which will usually fall into the following four categories:

(a)

factors relating to the impact of the breach;

(b)

factors relating to the nature of the breach;

(c)

factors tending to show whether the breach was deliberate; and

(d)

factors tending to show whether the breach was reckless.

(6)

Factors relating to the impact of a breach committed by a firm include:

(a)

the level of benefit gained or loss avoided, or intended to be gained or avoided, by the firm from the breach, either directly or indirectly;

(b)

the loss or risk of loss, as a whole, caused to consumers, investors or other market users in general;

(c)

the loss or risk of loss caused to individual consumers, investors or other market users;

(d)

whether the breach had an effect on particularly vulnerable people, whether intentionally or otherwise;

(e)

the inconvenience or distress caused to consumers; and

(f)

whether the breach had an adverse effect on markets and, if so, how serious that effect was. This may include having regard to whether the orderliness of, or confidence in, the markets in question has been damaged or put at risk.

(7)

Factors relating to the nature of a breach by a firm include:

(a)

the nature of the rules, requirements or provisions breached;

(b)

the frequency of the breach;

(c)

whether the breach revealed serious or systemic weaknesses in the firm’s procedures or in the management systems or internal controls relating to all or part of the firm’s business;

(d)

whether the firm’s senior management were aware of the breach;

(e)

the nature and extent of any financial crime facilitated, occasioned or otherwise attributable to the breach;

(f)

the scope for any potential financial crime to be facilitated, occasioned or otherwise occur as a result of the breach;

(g)

whether the firm failed to conduct its business with integrity; and

(h)

whether the firm, in committing the breach, took any steps to comply with the Authority’s rules, and the adequacy of those steps.

(8)

In following this approach factors which are likely to be considered ‘level 4 factors’ or ‘level 5 factors’ include:

(a)

the breach caused a significant loss or risk of loss to individual consumers, investors or other market users;

(b)

the breach revealed serious or systemic weaknesses in the firm’s procedures or in the management systems or internal controls relating to all or part of the firm’s business;

(c)

financial crime was facilitated, occasioned or otherwise attributable to the breach;

(d)

the breach created a significant risk that financial crime would be facilitated, occasioned or otherwise occur;

(e)

the firm failed to conduct its business with integrity; and

(f)

the breach was committed deliberately or recklessly.

(9)

Factors which are likely to be considered ‘level 1 factors’, ‘level 2 factors’ or ‘level 3 factors’ include:

(a)

little, or no, profits were made or losses avoided as a result of the breach, either directly or indirectly;

(b)

there was no or little loss or risk of loss to consumers, investors or other market users individually and in general;

(c)

there was no, or limited, actual or potential effect on the orderliness of, or confidence in, markets as a result of the breach;

(d)

there is no evidence that the breach indicates a widespread problem or weakness at the firm; and

(e)

the breach was committed negligently or inadvertently.