UT-2022-00097 - [2024] UKUT 00352 (TCC)
Upper Tribunal Tax and Chancery Chamber

UT-2022-00097 - [2024] UKUT 00352 (TCC)

Fecha: 17-Sep-2024

Step 2 - The seriousness of the breach

Step 2 - The seriousness of the breach

94.

In our view, the Authority was fully justified in deciding that at Step 2 the financial penalty should be calculated on the basis that there was a Level 4 breach, as set out at paragraphs 6.7 to 6.27 of the Decision Notice.

95.

As regards paragraph (2) of DEPP 6.5A, the Authority decided that revenue was an appropriate indicator of the harm or potential harm in this case. The figure for “relevant revenue” in this case was £448,645, being the revenue derived by the Applicant during the period of the breach from the product or business area to which the breach related (in this case the gross commission payable by the Solo Group). This point was common ground and we agree with it.

96.

In deciding that the breach was at Level 4, the Authority correctly considered the factors set out in paragraph (5) of DEPP 6.5A, namely:

(a)

factors relating to the impact of the breach;

(b)

factors relating to the nature of the breach;

(c)

factors tending to show whether the breach was deliberate; and

(d)

factors tending to show whether the breach was reckless.

97.

As regards the impact of the breach, the Authority placed no emphasis on the factors listed in paragraph (6) of DEPP 6.5A, and in particular did not consider that the orderliness of, or confidence in, the markets in question have been damaged or put at risk.

98.

As regards the nature of the breach and the factors set out in paragraphs (7) and (11) of DEPP 6.5A, as set out at paragraph 6.13 of the Decision Notice, the Authority correctly identified the following Level 4 factors:

(1)

the breach revealed serious or systemic weaknesses in the firm’s procedures or in the management systems or internal controls relating to all or part of the firm’s business; and

(2)

the breach created a significant risk that financial crime would be facilitated, occasioned or otherwise occur.

99.

The Authority does not appear to have placed an emphasis on one of the factors referred to at paragraph (7), namely whether the firm, in committing the breach, took any steps to comply with the Authority’s rules, and the adequacy of those steps.

100.

The Applicant does not dispute the seriousness of the failures in the firm’s procedures and controls nor does it dispute the fact that the breach created a significant risk that financial crime would be facilitated. That is clearly self-evident from the findings of fact that we have made, as set out above and we do not need to repeat any of those matters here. The Solo Trading clearly gave the opportunity for the Solo Clients to make large numbers of tax reclaims to which they were not entitled. The Applicant recognised that if it had been more diligent in investigating the reasons why these particular Clients were trading in the vast volumes that they did and more diligent in investigating the profiles of those clients it may well have declined to take on the business.

101.

As regards the Level 3 factors, as set out at paragraph (12) of DEPP 6.5A, the Authority only considered, at paragraph 6.14 of the Decision Notice, that one factor was relevant, namely that the breach was committed negligently or inadvertently. It did not specifically consider another of the Level 3 factors, namely that there was no, or limited, actual or potential effect on the orderliness of, or confidence in, markets as a result of the breach. In our view, that was a relevant factor to be considered, but we do not consider that had the Authority done so it would have, or should have, made any difference to its decision, bearing in mind the seriousness of the matters referred to at [100] above.

102.

It is to be noted that in all the other disciplinary cases relating to the Solo Trading that we were referred to the penalty assessment was made at Level 4 at Step 2. The case advanced by Mr Mansell for treating the Applicant’s case at Level 3 appears to be based on two factors:

(1)

the fact that the breach was committed negligently rather than deliberately or recklessly; and

(2)

the fact that the Applicant did make serious efforts to comply with the relevant regulatory obligations, as demonstrated by its engagement of expert assistance from compliance consultants, notwithstanding the fact that, as the Applicant freely admitted, those efforts were ineffective and inadequate.

103.

As far as the first of these two factors is concerned, in disagreement with Mr Mansell, we do regard the Applicant’s negligence as being at the top end of culpability. In particular, we would expect any reasonably competent brokerage firm to appreciate that it needed to know much more about the Solo Clients. Any reasonably competent brokerage firm, even without the advice of external compliance consultants, would have appreciated that reliance on Introduction Certificates in the circumstances of this trading, particularly after the sheer volume of trading by those clients became apparent, was inappropriate. During the Relevant Period, the Applicant did not have (i) any understanding of the Solo Clients’ source of funds (ii) any understanding of the reasons why each of the Solo Clients wanted to engage in the Solo Trading or (iii) undertake risk assessments for the Solo Clients prior to onboarding and the commencement of trading. Consequently, the Applicant was never in a position effectively to monitor its transactions with the Solo Clients.

104.

Accordingly, in our view, the Authority was right to assess that the fact that the breach was only committed negligently did not in this case detract from the seriousness of the breach to the extent that the breach should be considered at Level 3 rather than Level 4.

105.

As far as the second of these two factors is concerned, we agree with the submissions of Mr Hinks on this point. As he submitted, given that the Applicant did not have a dedicated compliance function, it is an expectation that it would engage external consultants in the matter. Further, the engagement of those consultants was inadequate in the face of the significant and ongoing risks presented by the Solo Group business:

(1)

As regards CPA Audit’s engagement in respect of the onboarding of Solo Clients, that consultant was not instructed to provide any substantive assistance with regard to EDD prior to onboarding.

(2)

As regards the Applicant’s decision to rely upon the Solo Group’s purported CDD it appears that the Applicant made this decision simply because CPA Audit informed the firm that this was a possibility without itself carrying out a risk-based assessment as to whether it was appropriate to do so.

(3)

It appears that the Applicant declined to follow CPA Audit’s advice as to the need to understand the Solo Clients’ reasons for trading.

(4)

Although the Applicant engaged Compliance Asset to carry out transaction monitoring, that firm was only instructed to monitor such activity from a market abuse perspective and on a sampled basis. The fact that no one at the firm (or any external consultant) monitored the Solo Clients’ trading activity from an Anti-Money Laundering perspective for the duration of the trading was a serious matter.

106.

Whilst the Applicant criticises the quality of the advice given by its compliance consultants, that advice can only be as good as the instructions that are given, which are entirely the responsibility of the instructing firm. As is apparent from our findings of fact and Mr Hinks’s submissions, as set out at [105] above, the instructions given were of a limited nature and were inadequate in the circumstances.

107.

As support for the view that the Applicant was seeking to do its best to ensure regulatory compliance, Mr Mansell drew our attention to the fact that, unlike other brokers involved in the Solo Business, the Applicant made a suspicious activity report in relation to a matter connected with the trading. At the end of the Relevant Period, the Applicant was owed commissions from Solo Clients for whom it had executed business. It was contacted by Elysium Global (Dubai) Limited offering to pay the debt with a factoring discount. Arian agreed to this and received from Elysium approximately £125,000. Following discussion with the retained compliance consultants, although not ultimately advised to do so, the Applicant decided to place these monies into a segregated account while it submitted a suspicious activity report (“SAR”) to the National Crime Agency and awaited their clearance to process these monies. No response was received within the 7-day period and consent was deemed given. In this way Mr Mansell says, the Applicant showed at that point that it was alive to Anti-Money Laundering concerns related to the Solo Clients and acted appropriately of its own volition to inform the authorities of a payment it believed might be suspicious. In so doing it risked depriving itself of a substantial amount of the commission owed for the Solo Clients’ trading.

108.

However, as the Authority submitted, in the circumstances of the Elysium payment, it was incumbent on the Applicant to make a SAR. The fact that it complied in this instance with Anti-Money Laundering requirements does not make the serious instances of failure to do as found by the Authority, any less serious.

109.

We therefore conclude that the Step 2 figure should be £67,296, the same figure as was set out in the Decision Notice.