Attestation letters – in other words the requirement by the FCA that senior managers and boards vouch for regulatory compliance of specific business areas, also known as "Dear CEO letters" – were initially circulated to the asset management sector late last year. Since then, the FCA has been increasingly making use of such letters across all sectors of the financial services industry.
Although not explicitly required by statute or regulation, the FCA nonetheless requires that senior management attest that a) the FCA's circular has been considered at board level; b) the internal procedures in place have been assessed; and c) those internal measures have been found to be adequate and in compliance with the FCA (then the FSA) rules. The FCA has since conducted follow up visits at firms in the asset management sector –including, notably, even those firms that have replied positively and in a timely fashion.
Although we have not yet seen enforcement action taken against a senior manager on the back of a "faulty" attestation, recent enforcement actions demonstrate, generally, the FCA's willingness to take matters further. In October this year, the FCA fined Coöperatieve Centrale Raiffeisen–Boerenleenbank B.A. (Rabobank) £105 million for, amongst other things, inaccurately attesting that their LIBOR systems in place were "fit for purpose".
Bird & Bird comment: much has been written as to how to respond to such attestation requests, but what should be done if on receipt of a "Dear CEO letter" senior management investigates its firm's procedures and discovers that they are not adequate? The FCA has offered no policy guidance on how to respond in such circumstance. However, Tracey McDermott when speaking at an Autumn 2013 conference offered some clarification in stating that the FCA would work with management who had discovered a problem with their policies but who subsequently took steps to rectify the shortcoming. It is far better to recognise such shortcomings than to provide an inaccurate or misleading attestation. Refusing to respond is not an option.