Chapter 8 · Regulation & Ethics

1. Consumer protection — protect retail investors from unfair practices
2. Market integrity — fair, orderly, transparent markets
3. Financial stability — avoid systemic failures, protect payment systems

The UK FCA explicitly names three operational objectives that map directly to these.

A model where two separate authorities handle different concerns:

• Prudential regulator — focused on firm safety, capital, systemic risk
• Conduct regulator — focused on consumer protection, market abuse, treating customers fairly

Used by the UK (PRA + FCA) and Australia (APRA + ASIC). Avoids the "single agency owning both prudential + conduct" conflict.

An industry body delegated supervisory / rule-making authority over its own members. Examples: FINRA (US broker-dealers), various stock exchanges.

Pros: industry expertise + faster rule-making. Cons: potential conflicts of interest, regulator-of-last-resort risk.

FCA (Financial Conduct Authority): conduct supervision + prudential for firms outside PRA's remit. ~50,000 firms. Three operational objectives — protect consumers, market integrity, effective competition.

PRA (Prudential Regulation Authority): part of the Bank of England. Prudential supervision of banks, building societies, insurers, major investment firms (~1,500 firms). Focus = safety and soundness.

SEC (Securities and Exchange Commission): US securities markets regulator. Established 1934 after the 1929 crash. Enforces disclosure, anti-fraud, market-manipulation rules under the Securities Act 1933 + Securities Exchange Act 1934.

Banking is supervised separately by OCC, Federal Reserve, FDIC.

ESMA (European Securities and Markets Authority): EU-level regulator coordinating national supervisors (NCAs). Directly supervises credit rating agencies, trade repositories, benchmarks. Based in Paris.

Part of the ESAs alongside EBA (banking) and EIOPA (insurance).

UAE SCA (Securities and Commodities Authority): federal UAE securities regulator. Covers onshore activity — ADX and DFM. Financial free zones (DIFC, ADGM) are separately regulated by DFSA and FSRA respectively. Three-tier UAE regulation.

Saudi CMA (Capital Market Authority): Saudi securities regulator. Oversees Tadawul, listed companies, brokers, asset managers. Banking is separately supervised by SAMA (Saudi Central Bank).

IOSCO (International Organization of Securities Commissions): promotes cooperation among national securities regulators. Sets International Standards (IOSCO Principles). Members include US SEC, UK FCA, ESMA, UAE SCA, Saudi CMA, MAS (Singapore), HKMA (Hong Kong).

Universal AML model. Each stage offers detection opportunities.

1. PLACEMENT — introducing dirty cash into the financial system. Most exposed / detectable stage.
2. LAYERING — a series of complex transactions to obscure the source (cross-border transfers, shell companies, trusts, layered ownership).
3. INTEGRATION — the funds re-enter the legitimate economy as ostensibly clean wealth (real estate, businesses, securities, luxury goods).

Getting cash INTO the system:

• Structuring / smurfing — multiple sub-threshold cash deposits below reporting limits
• Cash-intensive business fronts (car washes, restaurants, laundromats)
• Bureau de change / money service business
• Buying high-value goods with cash (jewellery, art)
• Gambling

Different flow, similar controls:

• Money laundering: DIRTY funds → made to appear CLEAN
• Terrorist financing: often CLEAN funds (salaries, donations) → directed to ILLEGITIMATE purposes

TF is often LOWER value (small operational costs can fund attacks) — harder to detect by transaction size alone. Same suspicious-activity reporting regime applies.

Financial Action Task Force: inter-governmental body based at the OECD in Paris. Publishes the 40 Recommendations covering the risk-based approach, CDD, STR reporting, sanctions, and proliferation finance. Countries assessed via mutual evaluations. Non-compliant jurisdictions can be greylisted or blacklisted.

Firms must IDENTIFY + VERIFY customer identity, understand the nature of the relationship and source of funds, and MONITOR ongoing activity for unusual patterns.

EDD (Enhanced Due Diligence) is required for higher-risk customers — PEPs, high-risk jurisdictions, unusual transaction patterns.

A person entrusted with a PROMINENT PUBLIC FUNCTION — heads of state, senior politicians, military, judicial or central bank officials, senior executives of state-owned enterprises. Definition extends to CLOSE FAMILY and KNOWN CLOSE ASSOCIATES.

PEPs are higher-risk because their position offers corruption / bribery opportunities. Requires senior-management approval, source-of-wealth verification, enhanced ongoing monitoring.

Confidential report filed with the national Financial Intelligence Unit (FIU) — NOT the police directly.

Volume dwarfs successful prosecutions — but the data feeds intelligence + operations.

It is a CRIMINAL offence to tell a customer (or any unauthorised person) that a SAR has been filed about them, or that a money-laundering investigation is being (or may be) carried out.

Why customers should NEVER be told why a transaction has been refused or delayed. Use neutral phrasing. Significant prison-time penalties.

Firms must SCREEN customers + transactions against sanctions lists (UN, US OFAC, UK OFSI, EU consolidated list) and BLOCK / REPORT matches. Screening must be live on onboarding AND ongoing — designated lists change frequently.

Breach penalties are enormous: BNP Paribas $8.9bn (2014) for sanctions violations.

Offering, giving, receiving, or soliciting something of value to influence an official / business decision. Illegal virtually everywhere.

Key statutes: UK Bribery Act 2010, US FCPA (Foreign Corrupt Practices Act). Both have broad extraterritorial reach. Facilitation payments — small payments to speed routine services — are ILLEGAL under UK law but historically tolerated under US FCPA (now tightening).

Information that is:

1. Precise
2. Not publicly available
3. Relates to issuers / financial instruments
4. Would have a significant effect on price if made public

All four tests must be met. Examples: M&A talks, profit warnings, regulatory decisions, large contracts, leadership departures.

1. DEALING on inside information
2. ENCOURAGING / inducing another to deal
3. DISCLOSING inside information improperly

Criminal offence under UK Criminal Justice Act 1993 + civil offence under MAR. Significant prison time + unlimited fines.

EU/UK Market Abuse Regulation (MAR) covers:

1. Insider dealing
2. Unlawful disclosure of inside information
3. Market manipulation — wash trades, spoofing, layering, pump-and-dump, rumour spreading

Placing orders with the INTENTION to cancel before execution — to create a false impression of demand / supply and move the market in the direction of a separately-placed real trade.

Illegal under Dodd-Frank (US, 2010) + MAR (EU/UK). Notable prosecutions: Navinder Sarao (Flash Crash 2010), various JP Morgan precious-metals traders.

SAME beneficial owner on both sides of a trade — creates the APPEARANCE of activity / liquidity without any change in beneficial ownership. Inflates apparent volume, misleads other participants. A major problem in less-regulated cryptocurrency exchanges.

Disseminating false / misleading information to ARTIFICIALLY INFLATE the price of a security (often a thinly-traded small-cap), then SELLING the manipulator's holding at the inflated price before the price collapses.

Crypto era brought a new wave of pump-and-dumps via Telegram / Discord channels.

A broker / trader PERSONALLY trades on advance knowledge of a CLIENT's pending large order — profiting from the price impact the client order is expected to cause. Breach of fiduciary duty + market abuse.

Regulation sets the LEGAL FLOOR. Ethics asks what is RIGHT — including in situations not covered by specific rules. A behaviour can be legal but unethical.

Three-step response:

1. Identify the conflict
2. Disclose to affected parties
3. Manage via appropriate controls (information barriers, segregation of duties, mandatory recusal)

Where the conflict CANNOT be adequately managed, decline the engagement.

Organisational, physical, or systems-based controls that PREVENT the flow of confidential / market-sensitive information between business units with potential conflicts (e.g. corporate finance advice vs trading vs research).

Implemented via system access controls, physical separation, segregated email, wall-crossing procedures.

Broadly summarised:

1. Act with integrity
2. Put client interests first
3. Exercise reasonable care, diligence and competence
4. Maintain confidentiality
5. Manage conflicts of interest
6. Comply with rules and regulatory standards
7. Treat people fairly
8. Support and respect colleagues

Default: lock it down. Do NOT disclose confidential client information without consent.

Lawful exceptions where disclosure IS required: regulatory demands (SARs, regulator information requests), court orders, fraud prevention. Modern data-protection laws (GDPR + equivalents) add layered rules on personal data.

Employees / others who raise genuine concerns about misconduct can do so via PROTECTED channels — regulator hotlines, internal mechanisms. LEGAL PROTECTION against retaliation.

Key regimes: UK Public Interest Disclosure Act 1998, US Dodd-Frank § 922 (with bounty awards), EU Whistleblower Directive 2019.

Treating Customers Fairly (TCF): FCA principles requiring firms to embed fair treatment throughout the customer lifecycle. Six outcomes covering suitable products, clear information, appropriate advice, fair complaint handling.

Consumer Duty (2023): replaced/elevated TCF. Firms must "act to deliver good outcomes" for retail customers — four outcomes pillars: products & services, price & value, consumer understanding, consumer support. Higher bar than TCF: proactive, evidence-based, outcomes-focused.

FCA defines vulnerability across four drivers: health, life events, capability, resilience. ~50% of UK adults show characteristics of vulnerability. Consumer Duty requires firms to monitor outcomes for vulnerable customers + prevent foreseeable harm.

Ongoing structured learning to keep knowledge current in a fast-changing industry. CISI members: minimum ~35 hours per year, portion of which must be structured. Recorded and reportable. Failure to comply can lead to membership lapse.