Final notice: michael john allin

FINAL NOTICE
Michael John Allin
MXA01272
1.1. For the reasons given in this notice, the Authority hereby imposes on Michael John Allin ("Mr Allin") a financial penalty of £9,900. 1.2. Mr Allin agreed to settle at an early stage of the Authority's investigation and therefore qualified for a 30% (stage 1) discount under the Authority's executive settlement procedures. Were it not for this discount, the Authority would have imposed on Mr Allin a financial penalty of £14,100. SUMMARY OF REASONS
2.1. Between 1 June 2012 and 20 March 2013 (the "Relevant Period") Mr Allin, in his capacity as Internal Auditor at Bank of Beirut, failed to deal with the Authority in an open and cooperative way and failed to disclose appropriately to the Authority information of which it would reasonably expect notice. Mr Allin's conduct breached Principle 4 of the Authority's Statement of Principles for Approved Persons ("Statement of Principle 4"). 2.2. The Authority visited Bank of Beirut in 2010 and 2011 and observed that whilst the size and complexity of the business model gave rise to comparatively few operational risks, it was concerned that the culture at Bank of Beirut was one of insufficient consideration of risk or regulation, despite the high risk that its business might be exploited to facilitate financial crime. These visits took place prior to Mr Allin's arrival as sole internal auditor at the Bank on 9 January 2012, a position he held on a part time basis. The Authority required Bank of Beirut to take specific actions to address the Authority's concerns and to counter the risk that it could be used to facilitate financial crime. The Authority had required that the Bank implement these actions at deadlines between May 2011 and September 2011, before Mr Allin's arrival at the Bank. 2.3. The Authority specifically required Mr Allin, as the firm's Internal Auditor, to review whether Bank of Beirut had taken all these required actions and to provide the Authority with assurance that the necessary improvements had been embedded in the firm's processes by 1 June 2012. 2.4. Mr Allin breached Principle 4 because: on 26 June 2012 he provided an assurance to be given to the Authority that all of the action points had been implemented even though he had failed to review the Bank's implementation of the action points as required by the Authority by 1 June 2012. Mr Allin was aware that the Bank had still not completed two of the required actions by this date. Following discussions with senior management about the response that the Authority required, he did not provide the Authority with this information, which the Authority would reasonably expect notice of. on 30 November 2012, Mr Allin prepared a report for the Authority which gave a misleading impression about the Bank's completion of a specific action point. Mr Allin omitted information from this report even though this was information of which the Authority would reasonably expect notice. In omitting this information, the Authority recognises that Mr Allin was influenced by comments made by senior management. 2.5. On 20 March 2013, Mr Allin was interviewed by the Authority. On this date, Mr Allin shared his concerns with the Authority about Bank of Beirut's completion of this specific action point and corrected the misleading impression he had given on 30 November 2012. 2.6. The Authority specifically requires Internal Auditors to evaluate the effectiveness of firms' internal controls and risk management processes, and are reliant on Internal Auditors to maintain an open, constructive and cooperative relationship Page 2 of 16
with the Authority. The Authority is particularly reliant on the internal audit function in supporting a culture of effective controls and governance at small sized firms that are not subject to frequent supervision by the Authority. In this case, Mr Allin's failings did not result in direct consumer detriment. However, the Authority relied on Mr Allin as the Bank's Internal Auditor to report back to the Authority on whether or not Bank of Beirut had addressed the Authority's concerns regarding its compliance with regulatory requirements that it had observed during its visits in 2010 and 2011. The Authority's concerns in relation to Bank of Beirut were particularly serious because of the heightened risk that the Bank might be used to facilitate financial crime, including money laundering, which could in turn endanger the integrity of the UK financial system. 2.7. Whilst the Authority recognises that Mr Allin's actions were influenced by senior management and that he has no previous disciplinary record with the Authority, this does not excuse his misconduct. Mr Allin was in a position to understand the true position with respect to Bank of Beirut's completion of the action points required by the Authority and as such should have resisted senior management in this regard. Internal auditors must maintain their independence, and as an approved person holding a significant influence function, Mr Allin was personally bound by his own regulatory responsibilities. 2.8. Mr Allin failed to deal with the Authority in an open and cooperative way in breach of Statement of Principle 4. The Authority therefore imposes on Mr Allin a financial penalty of £9,900. DEFINITIONS
3.1. The definitions below are used in this Final Notice. "the Act" means the Financial Services and Markets Act 2000 "ARROW" means the Advanced Risk Responsive Operative Framework. "the Authority" means the body corporate previously known as the Financial Services Authority and renamed on 1 April 2013 as the Financial Conduct Authority "Bank of Beirut" or "the Bank" means Bank of Beirut (UK) Ltd. "FSF" means Firm Systematic Framework. Page 3 of 16
"Remediation Plan" means the risk mitigation programme the Authority provided to the Bank of Beirut on 8 March 2011. "Remediation Plan action points" means the specific actions set out in the Remediation Plan that the Authority required Bank of Beirut to take. FACTS AND MATTERS
Background
4.1. Mr Allin has been employed on a part time basis as the sole Internal Auditor at Bank of Beirut, the UK subsidiary of Lebanon domiciled Bank of Beirut S.A.L, since 9 January 2012. As Internal Auditor of the UK subsidiary, Mr Allin's responsibilities include planning and performing all internal audits and investigations at the Bank of Beirut in order to advise all levels of management and the Board, through its Audit Committee, on the quality of the Bank's operations with particular emphasis on systems and controls. Mr Allin's role also includes assisting "regulatory authorities providing them with copies of audit reports if so requested". 4.2. Bank of Beirut's principal activities are the provision of trade finance, correspondent banking, commercial and retail banking services. Bank of Beirut has fewer than 1000 customers, who are predominantly from countries that are regarded as being high risk from a financial crime perspective. As at 31 December 2011, Bank of Beirut's total assets were £321 million. The Remediation Plan
4.3. In December 2010, the Authority conducted a risk assessment at Bank of Beirut (then known as an ARROW assessment, and now referred to as the FSF). On 8 March 2011, the Authority wrote to Bank of Beirut, setting out its findings from the risk assessment, and attaching the Remediation Plan. This took place before Mr Allin's arrival at the Bank. 4.4. The Authority observed that the culture of Bank of Beirut was one of inadequate consideration of risk and regulatory requirements with insufficient focus on governance and controls. 4.5. The Authority had particular concerns around the effectiveness of Bank of Beirut's internal audit function, which was hampered by a failure to resolve outstanding audit issues. The Authority emphasised to Bank of Beirut's senior management Page 4 of 16
the Authority's reliance on the internal audit function in supporting a culture of effective controls and governance at small sized firms that are not subject to frequent supervision by the Authority. The Authority required the Bank's senior management to resolve all outstanding issues of internal audit reports. The Authority also had concerns about Bank of Beirut's lack of a compliance monitoring plan, designed to help Bank of Beirut monitor its compliance with its regulatory obligations and to counter the risk of financial crime. 4.6. In the Remediation Plan, among six other action points, the Authority set out three action points that it expected Bank of Beirut to complete to address its most serious concerns: By 1 June 2011, "to resolve all outstanding issues of internal audit reports and to report to the FSA what actions were taken and to ensure the setting of deadlines for the resolution of all audit issues". By 1 September 2011, to "develop, implement and conduct an adequate compliance monitoring program and to evidence this action with a completion report to the FSA". By 1 June 2012, "the internal auditor to review the implementation of the [Remediation Plan] action points in the annual internal audit cycle in order to provide assurance the improvements are embedded in the firm's processes and have become a matter of course for the firm". Provision of misleading information to the Authority
26 June 2012 email 4.7. On 14 May 2012, the Authority reminded the Bank of the Remediation Plan action point due on 1 June 2012 requiring the Internal Auditor to review the implementation of all the other Remediation Plan action points. The Authority required that all the other Remediation Plan action points were implemented at deadlines between May 2011 and September 2011, before Mr Allin's arrival at the Bank. It appears that Mr Allin only became aware of this Remediation Plan action point (or indeed any of the Remediation Plan action points) at around this time, despite arriving at the Bank some five months earlier in January 2012. 4.8. By the deadline of 1 June 2012, Mr Allin had not conducted an internal audit to review the implementation of the Remediation Plan action points, and had not Page 5 of 16
provided any confirmation to the Authority that the improvements had been embedded in the firm's processes. 4.9. On 12 June 2012, the Authority sent an email to the Bank of Beirut chasing the Firm for a response to this overdue Remediation Plan action point. 4.10. On 25 June 2012, Mr Allin sent an internal email addressing the implementation of the Remediation Plan action points as required by the Authority. His email indicated that the Remediation Plan action points had not all been implemented and embedded. Specifically, Mr Allin referred to two Remediation Plan action points "which are currently being addressed": Mr Allin noted that the Remediation Plan action point to resolve all outstanding internal audit issues by 1 June 2011 had not been completed, and commented that he expected to close all outstanding internal audit issues "during 2012". Mr Allin identified that the requirement to develop, implement and conduct an adequate compliance monitoring program by 1 September 2011 had not yet been completed, stating that the "Bank has developed a Compliance Monitoring Program which has not been fully implemented". 4.11. However, the next day (26 June 2012), following discussions with senior management over the response that the Authority required, Mr Allin revised his response. He provided reassurance in an internal email that "I can confirm that the [Remediation Plan] action points have been implemented and are embedded in Bank policy and procedures" with no detail about the outstanding Remediation Plan action points. This was despite the fact that: Mr Allin had no reason to believe that the two outstanding Remediation Plan action points which he referred to in his email the previous day had been resolved; and Mr Allin had still not conducted an internal audit to assess the implementation of the Remediation Plan action points. 4.12. Mr Allin gave this assurance knowing that it was for the purpose of providing it to the Authority. However, in light of the two outstanding Remediation Plan action points, this assurance was misleading and failed to provide information of which the Authority would reasonably expect notice. Page 6 of 16
4.13. Shortly after Mr Allin sent that email, the Bank of Beirut emailed the Authority on 26 June 2012 stating "our Internal Auditor confirms that the [Remediation Plan] action points have been implemented and are embedded in the Bank's policies and procedures". No information was provided regarding the unresolved internal audit points which the Bank had been required to resolve by 1 June 2011. Further, no information was provided regarding the Bank's failure to implement fully and conduct the compliance monitoring plan, which should have been completed by 1 September 2011. This was information of which the Authority would reasonably expect notice. 30 November 2012 completion report 4.14. The Authority wrote to Bank of Beirut on 16 August 2012 setting out its concerns that certain Remediation Plan action points remained outstanding. The Authority requested further information from the Bank on these issues. In particular, the Authority required Mr Allin, as Bank of Beirut's Internal Auditor, to provide a "completion report" to confirm that the Remediation Plan action point relating to the compliance monitoring plan had been completed. Given the lack of progress at Bank of Beirut, the Authority had to extend the original Remediation Plan deadline for this completion report from 1 September 2011 to 30 November 2012. 4.15. The relevant Remediation Plan action point required the Bank of Beirut to "develop, implement and conduct an adequate compliance monitoring program"
and to evidence this with a completion report. The Authority's expectation was
that this report would confirm that Bank of Beirut had completed a full cycle of an
appropriate compliance monitoring plan. It appears that Mr Allin may have
initially misunderstood what the Authority required, although he later understood
the correct position. He noted in an internal email on 29 August 2012 to senior
management: "A completion report sounds like they expect the whole
[compliance monitoring plan] to have been performed by the end of November?
The original Action Point did state that the [compliance monitoring plan] was to
have been developed, implemented and conducted!"
4.16. Mr Allin circulated a draft completion report internally within Bank of Beirut on 27 November 2012, which set out his findings following his audit of the compliance monitoring plan. The draft contained the following wording in the "Detailed Findings" section: Page 7 of 16
"Detailed Findings
The Compliance department has not fully completed all of the Compliance Monitoring Program tests and in some instances monitoring has not been conducted in accordance with the prescribed frequency." 4.17. Senior management queried the inclusion of the "Detailed Findings" section in the completion report, and commented that they would not expect the report to "highlight areas not yet covered which is sure to lead to the FSA providing yet another deadline date and report to complete." 4.18. Mr Allin amended his response to the Authority and subsequently deleted the "Detailed Findings" section from the report, which was provided to the Authority on 30 November. The final completion report confirmed that "…the specific [Remediation Plan] point in respect of the compliance monitoring program has been fully implemented." It no longer included the statement that the compliance department had not fully completed all of the tests under the compliance monitoring plan. 4.19. Whilst Mr Allin's final report still referred to the fact that "the [compliance monitoring plan] is a continuing cycle of regulatory tests and reviews [and] it is inevitable that the work being performed is ongoing", it failed to provide the Authority with a clear picture of the true status of the compliance monitoring plan, namely that it had not in fact been fully conducted as required by the Remediation Plan. 4.20. In March 2013, Mr Allin was required to attend an interview with the Authority as part of the Authority's follow-up visit to Bank of Beirut. In that interview, Mr Allin corrected the misleading impression contained in his 30 November 2012 completion report by sharing with the Authority his ongoing concerns about the adequacy of the compliance monitoring plan for the Bank, and about the quality of the monitoring work performed under it. Mr Allin did not include any of this information within his November 2012 completion report, despite the fact that this is information of which the Authority would reasonably expect notice. FAILINGS
5.1. The regulatory provisions relevant to this Final Notice are referred to in Annex A. Page 8 of 16
5.1. By reason of the facts and matters referred to above, Mr Allin breached Statement of Principle 4 because he failed to deal with the Authority in an open and cooperative way and to disclose appropriately any information of which the Authority would reasonably expect notice, in that: He failed to review Bank of Beirut's implementation of the Remediation Plan action points in the annual internal audit cycle in order to provide assurance the improvements were embedded in the processes and have become a matter of course for the firm as required by the Authority by 1 June 2012. Mr Allin then provided this assurance to be passed on to the Authority, on 26 June 2012, even though he had not yet conducted an internal audit of the Remediation Plan action points and was aware that two of the Remediation Plan action points had not yet been completed. Mr Allin failed to inform the Authority about the two outstanding Remediation Plan action points, which was information of which the Authority would reasonably expect notice. On 30 November 2012, Mr Allin provided the Authority with a completion report in respect of the compliance monitoring plan which gave a misleading impression regarding the progress of the compliance monitoring plan and also omitted information of which the Authority would reasonably expect notice. SANCTION
6.1. The Authority has considered the disciplinary and other options available to it and has concluded that a financial penalty is the appropriate sanction in the circumstances of this particular case. Financial Penalty
6.2. The Authority's policy for imposing a financial penalty is set out in Chapter 6 of DEPP. For this period the Authority applies a five-step framework, as set out in DEPP 6.5B, to determine the appropriate level of financial penalty imposed on individuals in non-market abuse cases. Page 9 of 16
Step 1: disgorgement
6.3. Pursuant to DEPP 6.5B.1G, at Step 1 the Authority seeks to deprive an individual of the financial benefit derived directly from the breach where it is practicable to quantify this. 6.4. The Authority has not identified any financial benefit that Mr Allin derived directly from the breach. 6.5. Step 1 is therefore £0. Step 2: the seriousness of the breach
6.6. Pursuant to DEPP 6.5B.2G, at Step 2 the Authority determines a figure that reflects the seriousness of the breach. That figure is based on a percentage of the individual's relevant income. The individual's relevant income is the gross amount of all benefits received by the individual from the employment in connection with which the breach occurred. 6.7. Mr Allin's breach occurred between 1 June 2012 and 20 March 2013. As stated in DEPP 6.5B.2G(2), where the period of a breach lasts less than 12 months, the relevant income will be the amount earned by the individual in the 12 months preceding the end of the breach. In this case, Mr Allin's breaches ended on 20 March 2013, and therefore the relevant period for calculating Mr Allin's income is 21 March 2012 to 20 March 2013. Mr Allin's relevant income in this period was £47,256. 6.8. In deciding on the percentage of the relevant income that forms the basis of the Step 2 figure, the Authority considers the seriousness of the breach and chooses a percentage between 0% and 40%. The range is divided into five fixed levels which represent, on a sliding scale, the seriousness of the breach; the more serious the breach, the higher the level. For penalties imposed on individuals in non-market abuse cases there are the following five levels: Page 10 of 16
6.9. A non-exhaustive list of factors which are likely to be considered level 4 factors or level 5 factors is set out at DEPP 6.5B.2G(12). In the circumstances of this case, the Authority considers the following factor to be relevant: The breach was committed recklessly: Mr Allin appreciated that there was a risk that the assurance he provided on 26 June 2012 that all Remediation Plan action points had been implemented consisted of a failure to be open with the Authority and that it would not be aware of relevant matters (which he initially included in his response). He also appreciated that his decision to remove certain information from the 30 November 2012 completion report could result in the Authority not being in receipt of full information. Mr Allin failed adequately to mitigate that risk. 6.10. The Authority also considers that the following factors are relevant: The scope for any potential financial crime to be facilitated, occasioned or otherwise occur as a result of the breach: Mr Allin's failure to provide the Authority with accurate information regarding the status of the Remediation Plan action points (despite being asked for specific assurances) might have left the firm open to the risk that it be used to further financial crime. The nature of the breach: The Authority is particularly reliant on the internal audit function in supporting a culture of effective controls and governance at small sized firms that are not subject to frequent supervision by the Authority. In particular, the Authority must be able to rely upon assurances provided by Internal Auditors that actions have been completed and risks mitigated or resolved. The frequency of the breach: Mr Allin provided misleading information in relation to the Remediation Plan to be submitted to the Authority on two separate occasions during the Relevant Period. The impact of the breach: Mr Allin made no gain from the breach. 6.11. Taking all these factors into account, the Authority has concluded the seriousness of the breach to be Level 4. As such, the Step 2 figure is 30% of £47,256. Page 11 of 16
6.12. Step 2 is therefore £14,177. Step 3: mitigating and aggravating factors
6.13. Pursuant to DEPP 6.5B.3G, at Step 3 the Authority may increase or decrease the amount of the financial penalty arrived at after Step 2, but not including any amount to be disgorged as set out in Step 1, to take into account factors which aggravate or mitigate the breach. 6.14. The Authority does not consider there are any relevant factors which aggravate or mitigate the breach; therefore the Step 2 figure should not be changed. 6.15. Step 3 is therefore £14,177. Step 4: adjustment for deterrence
6.16. Pursuant to DEPP 6.5B.4G, if the Authority considers the figure arrived at after Step 3 is insufficient to deter the individual who committed the breach, or others, from committing further or similar breaches, then the Authority may increase the penalty. 6.17. The Authority considers that the Step 3 figure of £14,177 represents a sufficient deterrent to Mr Allin and others, and so has not increased the penalty at Step 4. Step 5: settlement discount
6.18. Pursuant to DEPP 6.5B.5G, if the Authority and the individual on whom a penalty is to be imposed agree the amount of the financial penalty and other terms, DEPP 6.7 provides that the amount of the financial penalty which might otherwise have been payable will be reduced to reflect the stage at which the Authority and the individual reached agreement. 6.19. The Authority and Mr Allin reached agreement at Stage 1; therefore a 30% discount applies to the Step 4 figure (of £14,177). 6.20. Step 5 is therefore £9,900 rounded down to the nearest £100. 6.21. The Authority therefore imposes a total financial penalty of £9,900 on Mr Allin for breaching Statement of Principle 4. Page 12 of 16
PROCEDURAL MATTERS
Decision maker
7.1. The decision which gave rise to the obligation to give this Notice was made by the Settlement Decision Makers. 7.2. This Final Notice is given under, and in accordance with, section 390 of the Act. Manner of and time for Payment
7.3. The financial penalty must be paid in full by Mr Allin to the Authority by no later than 18 March 2015, 14 days from the date of the Final Notice. If the financial penalty is not paid
7.4. If all or any of the financial penalty is outstanding on 19 March 2015, the Authority may recover the outstanding amount as a debt owed by Mr Allin and due to the Authority. Publicity
7.5. Sections 391(4), 391(6) and 391(7) of the Act apply to the publication of information about the matter to which this notice relates. Under those provisions, the Authority must publish such information about the matter to which this notice relates as the Authority considers appropriate. The information may be published in such manner as the Authority considers appropriate. However, the Authority may not publish information if such publication would, in the opinion of the Authority, be unfair to you or prejudicial to the interests of consumers or detrimental to the stability of the UK financial system. 7.6. The Authority intends to publish such information about the matter to which this Final Notice relates as it considers appropriate. Page 13 of 16
Authority contacts
7.7. For more information concerning this matter generally, contact Allegra Bell (direct line: 020 7066 8110) or Matthew Finn (direct line: 020 7066 1276) of the Enforcement and Market Oversight Division of the Authority. Anthony Monaghan Project Sponsor Financial Conduct Authority, Enforcement and Market Oversight Division Page 14 of 16
RELEVANT STATUTORY AND REGULATORY PROVISIONS
RELEVANT STATUTORY PROVISIONS
1.1. The Authority's statutory objectives, set out in section 1B(3) of the Act, includes the integrity objective. 1.2. Section 1D of the Act is the integrity objective: "protecting and enhancing the integrity of the UK financial system." 1.3. Section 66 of the Act provides that the Authority may take action against a person if it appears to the Authority that he is guilty of misconduct and the Authority is satisfied that it is appropriate in all the circumstances to take action against him. A person is guilty of misconduct if, while an approved person, he has failed to comply with a statement of principle issued under section 64 of the Act, or has been knowingly concerned in a contravention by a relevant authorised person of a relevant requirement imposed on that authorised person. RELEVANT REGULATORY PROVISIONS
Statements of Principle and Code of Practice for Approved Persons
2.1. The Authority's Statements of Principle and Code of Practice for Approved Persons ("APER") have been issued under section 64 of the Act. 2.2. Statement of Principle 4 states: An approved person must deal with the FCA, the PRA and other regulators in an open and cooperative way and must disclose appropriately any information of which the FCA or the PRA would reasonably expect notice. 2.3. The Code of Practice for Approved Persons sets out descriptions of conduct which, in the opinion of the Authority, do not comply with a Statement of Principle. It also sets out factors which, in the Authority's opinion, are to be taken into account in determining whether an approved person's conduct complies with a Statement of Principle. Financial penalty
2.4. The Authority's policy for imposing a financial penalty is set out in Chapter 6 of DEPP. In respect of conduct occurring on or after 6 March 2010, the Authority applies a five-step framework to determine the appropriate level of financial Page 15 of 16
penalty. DEPP 6.5B sets out the details of the five-step framework that applies in respect of financial penalties imposed on individuals in non-market abuse cases. Page 16 of 16

Source: https://www.fca.org.uk/publication/final-notices/michael-john-allin.pdf