Operational Ability, Governance and Outsourcing: What an FSP Must Have in Place

An FSP can be honest and competent and still fail its clients because the office does not work: files go missing, nobody answers the phone, the only person who knows the system is on leave. Operational ability is the fit and proper requirement aimed at that risk.

The minimum every FSP needs

At all times an FSP must have:

• a fixed physical business address from where the business is operated or controlled;
• adequate access to communication facilities: at least a telephone or cell phone, and typically email and internet;
• adequate storage and filing systems for the safe-keeping of records and documentation;
• a bank account with a registered bank, and a separate account for client funds where the law requires one;
• adequate and appropriate key individuals to manage or oversee its financial services.

It does not need an office in every province, a website or two key individuals. Those are common wrong answers.

Governance

An FSP must have a governance framework proportionate to the nature, scale, risks and complexity of its business. A sole proprietor's framework can be a few pages. A national brokerage needs considerably more. In either case it should cover:

• a clear organisational structure with defined roles and reporting lines;
• risk management and internal controls;
• the compliance function;
• how conflicts of interest are managed;
• how representatives are recruited, trained, supervised and remunerated;
• a business continuity policy;
• a recovery plan and a viable resolution plan for when things go wrong;
• accounting procedures and controls over client assets and information.

"Proportionate" does not mean optional. A one-person FSP still needs to answer the question: if I am in hospital tomorrow, what happens to my clients?

Outsourcing

Many FSPs outsource functions: IT hosting, claims administration, compliance, record storage. The rule is simple to state. You can outsource the work. You cannot outsource the responsibility.

When an FSP outsources a function, it must:

• exercise due skill, care and diligence in choosing the provider;
• make sure the provider has the ability, capacity and any authorisation required by law;
• have a written agreement setting out each party's duties;
• retain the expertise needed to supervise the outsourced function;
• monitor performance and take appropriate action if the provider is not performing;
• be able to terminate the arrangement without detriment to the continuity and quality of service to clients;
• make sure the FSP and the Authority have access to the provider's information about the function;
• protect confidential client information;
• maintain a contingency plan for disaster recovery.

One detail for the exam: a provider of a function that is not a financial service, such as IT hosting, does not have to be an authorised FSP. It must simply hold whatever authorisation the law requires for what it does.

If an outsourced claims administrator starts losing documents, the FSP may not wait for the contract to run out or send clients to the administrator directly. It must act, and it must have kept the ability to walk away.

Representatives and juristic representatives

Operational ability extends to the people an FSP appoints. Before appointing a juristic representative, an FSP must be satisfied that it has sufficient operational ability and financial resources to perform the activities it is appointed for. A juristic representative must also have at least one key individual at all times.

A representative may not sub-delegate financial services activities to someone else.

Serving several FSPs

A key individual approved for more than one FSP must be able to show the Authority that they have the operational ability to oversee all of them effectively. The exam likes this point because the tempting wrong answers are a fixed maximum number of FSPs, or automatic approval across FSPs in the same category. Neither exists.

How a key individual checks operational ability

Walk through your own business and ask:

1. If the Authority asked for ten client files today, could we produce them within seven days?
2. If our systems went down, how long until we were working again, and has that been tested?
3. For each outsourced function, who here understands it well enough to judge the provider?
4. Is there a current organogram, and does it match reality?
5. When did we last review our risk register?

Each "I am not sure" is a finding. Fix it before a compliance officer, or the Authority, finds it for you.