Do not panic
Do not rush
Form your response team Identify what has happened Assess exposure
(compliance and beyond)
Control internal communications
Preserve evidence & understand the likely extent of disclosure
•
Regulatory scrutiny (or issues that could lead to such scrutiny) can arise without warning.
•
Serious consequences can arise from such issues, but more often than not the most serious consequences arise from a failure to manage adequately the responsive action(s), rather than the initial issue.
•
Conduct during the first 24-48hrs can materially affect outcomes.
•
Whilst the early stages are critical, do not rush to respond.
•
You should carefully consider what requests the regulator is actually entitled to make.
•
Consider whether extensions, clarification or staging responses are appropriate.
•
Identify the individual(s) who will be responsible for handling the issue, and define roles and responsibilities. That should include a single internal lead.
•
Brief staff, e.g. to avoid informal explanations, speculations or commentary.
•
It is important to properly understand the nature of the event. Misclassification is common and can be prejudicial.
•
Identify whether individuals are personally exposed and manage possible conflicts of interests.
•
Could the issue trigger parallel action (e.g. overseas regulators, customers, partners etc.)?
•
Limit discussion to a small, defined response group.
•
Avoid informal explanations, speculation or commentary, e.g. in emails or informal messaging (messages between key individuals, even on personal devices, frequently become disclosable and are often misinterpreted when taken out of context).
•
Take appropriate steps to preserve all potentially relevant and disclosable documents and electronic data.
•
Whilst corrective action may be appropriate, do not amend, complete or ‘tidy’ records retrospectively (document metadata is also disclosable).
•
Involving lawyers early has distinct advantages, e.g., to:
Take legal advice early
Check insurance
Keep a clear decisionmaking record
•
protect sensitive communications through appropriate use of legal privilege,
•
define a legally coherent, long-term strategy that can be deployed consistently, through effective engagement with the regulatory, but without making inadvertent admissions,
•
managing the engagement of external consultants in a way that mitigates regulatory and legal risk.
•
Review insurance coverage and check whether notification is required.
•
Be careful to avoid admissions that may prejudice cover.
•
With the benefit of advice, and assuming decisions may be reviewed, keep contemporaneous records, e.g. of meetings and decisions, to ensure governance and oversight can be demonstrated.
Important note: this checklist provides general guidance only and does not constitute legal advice. Each matter is fact-specific and the best response will depend on the particular circumstances.