Employment in Financial Services

Different notification procedures exist before employees may take up their roles.

Investment firms may only entrust employees to provide investment advice if they are knowledgeable and have demonstrated the required reliability – as evidenced, inter alia, by not having a relevant and unspent prior criminal record. Furthermore, such employees’ identities must be disclosed to BaFin before they commence their activities. The active registration of employees is intended to impart upon employers the significance of employee selection and responsibility for their decisions.

Representatives of regulated entities of the financial services sector (typically, members of management) must be approved by BaFin before they can take up their role (colloquially known as BaFin’s “driver’s licence”). To obtain approval, a request must be filed with BaFin, showing the experience and suitability of the candidate for the role. Depending on the financial services delivered by the company, information that must be filed include the following:

• a CV (including information on professional training, career, and references);
• information on reliability (a form or summary to be completed by the manager, including, for example, mandatory declarations on prior criminal or administrative offences);
• a "certificate of good conduct for submission to an authority", a "European certificate of good conduct for submission to an authority", or "corresponding documents" from abroad (depending on the countries of residence in the last 10 years);
• an extract from the central commercial register;
• an overview of other mandates as a managing director or in administrative and supervisory bodies; and
• information about the manager’s ability to dedicate sufficient time to the role.

Non-management employees responsible for specific key functions at an insurance provider are subject to a similar notification process. Further, financial services employers must perform a risk analysis under the Anti-Money Laundering Act and take internal security measures, which also includes assessing the reliability of employees.

RFSPs must satisfy themselves that all CF and PCF candidates or employees comply with the F&P Standards. Pre-employment due diligence must be performed, including asking the candidate to certify they will comply with the F&P Standards and notify the RFSP immediately of any change in circumstance that may mean they no longer comply. Employers must continue to ensure that in scope employees comply with the F&P Standards and must complete an annual declaration to this effect. This means that due diligence must continue throughout the employment relationship and not just at the recruitment stage.

Candidates for PCF roles must complete an online individual questionnaire, which is submitted to the CBI in advance of appointment to the role through the Central Bank portal. The CBI must grant its approval for the PCF appointment before a candidate can take up the role. Any PCF offer of employment must be conditional on that approval being obtained. The CBI may request applicants attend an interview as part of the approval process.

Employers should take all reasonable steps to secure references from previous employers in order to due diligence the candidate's compliance with the F&P Standards and their suitability for the role. However, an employer is not obliged to issue a reference in respect of a former employee which means that a prospective employer may not be able to secure a reference from a previous employer.  The CBI does not oblige employers to either issue or obtain a reference as part of screening checks, however employers must make good efforts to do so.

There are material obstacles from a data privacy and practical perspective to employers conducting criminal background checks in relation to prospective employees. Data relating to criminal convictions is special category data under the GDPR. Employers would need to satisfy both Article 6 and Article 9 requirements under the GDPR to justify the processing of this data. In terms of Article 9, this means employers would need to show reasons of substantial public interest or that they are carrying out their legal obligations in processing the data.  In terms of Article 6 the employer will need to show that the processing is necessary to comply with a legal obligation to which the employer is subject or the processing is necessary for the employer's legitimate interests for example to ensure the suitability and honesty of its employees and to protect its reputation. Employers are also prevented from asking candidates about "spent convictions" which are usually minor criminal offences dating back over seven years.

Pre-employment medical checks must also have a clear legal basis justifying the processing of an employee's medical and health information.

For employees subject to the SMR, anyone performing an SMF must be pre-approved by the relevant regulator before they can start their role. Generally, firms that wish to employ a senior manager must first carry out sufficient due diligence to satisfy themselves that the candidate is a fit and proper person to perform their proposed functions. In this regard, firms must consider the individual’s qualifications, training, competency and personal characteristics. The firm must also carry out a criminal records check. They may then apply to the relevant regulator for that candidate’s pre-approval. In the firm’s application, all matters relating to the candidate’s fitness and propriety must be disclosed. The firm must also enclose a statement of that individual’s proposed responsibilities and (depending on the firm) the latest version of the firm’s management responsibilities map.

For employees subject to the CR, before the appointment and annually thereafter, these employees must be certified by the employing SM&CR firm as being fit and proper. Certification does not involve pre-approval by the FCA or PRA.

Additionally, firms must comply with the regulatory reference rules for all candidates subject to either the SMR or CR before their employment. These rules require employing firms to request a regulatory reference from all previous employers covering the past six years of employment. Information must be shared between regulated firms using a particular template, which includes information relevant to assessing whether a candidate is fit and proper. Firms are also expected to retain records of disciplinary and fit and proper findings going back six years for their employees (or longer for findings of gross misconduct), and they must update regulatory references that they have previously given where new significant information comes to light that would impact the content of a previously given regulatory reference.