NatWest Markets Plc

On 19 November 2014, the PRA issued a Final Notice to the Royal Bank of Scotland Plc, National Westminster Bank Plc and Ulster Bank Ltd (together the “Banks”), which imposed on the Banks, pursuant to section 206 of the Financial Services and Markets Act 2000, a financial penalty of £14,000,000 for breach of Principle 3 of the FSA’s (and after 1 April 2013, the PRA’s) Principles for Businesses (now the PRA’s Fundamental Rule 6).  The financial penalty was imposed on the basis that, during the period between 1 August 2010 and 10 July 2012, the Banks’ failed to meet their obligation to have adequate systems and controls to identify and manage their exposure to IT risks, in particular:  i) the RBS Group’s Technology Services function (the centralised Group IT function which provides services to the Banks) did not manage and plan changes to the RBS Group’s IT systems adequately; ii) the Technology Services Risk, Business Services Risk and Group Internal Audit (together the “The Three Lines of Defence specific to IT for the Banks through the RBS Group), did not take sufficient care to control IT risks responsibly and effectively; and  iii) the RBS Group had a limited understanding of IT operational risk. A copy of the Final Notice for RBS can be found on the Bank of England website and can be accessed using the following link: http://www.bankofengland.co.uk/pra/Documents/supervision/enforcementnotices/en201114.pdf.

The Financial Conduct Authority (FCA) imposed a fine on the Royal Bank of Scotland Plc, (RBS) National Westminster Bank Plc (NatWest) and Ulster Bank Ltd (Ulster Bank) (together the Banks) £42 million for IT failures which occurred in June 2012 and meant that the Banks' customers could not access banking services. The Banks breached Principle 3 of the FCA Principles for Business in that they failed to take reasonable care to organise and control their affairs responsibly and effectively, with adequate risk management systems. The Banks agreed to settle at an early stage of the Authority's investigation and therefore qualified for a 30% (Stage 1) discount under the FCA's executive settlement procedures. Were it not for this discount the FCA would have imposed a financial penalty of £60,000,000 on the Banks. The actual cause of the IT incident was a software compatibility problem with the underlying cause being the Banks' failure to put in place adequate systems and controls to identify and manage their exposure to IT risks. The IT failure affected over 6.5 million customers in the United Kingdom for several weeks. Over the course of that period customers could not use online banking facilities to access their accounts or obtain accurate account balances from ATMs; customers were unable to make timely mortgage payments; customers were left without cash in foreign countries; the Banks applied incorrect credit and debit interest to customers' accounts and produced inaccurate bank statements; and some organisations were unable to meet their payroll commitments or finalise their audited accounts.

The Financial Conduct Authority (the FCA) imposed a financial penalty of £217,000,000 on The Royal Bank of Scotland plc (RBS) of 26 St. Andrew Square, Edinburgh, EH2 2YB. The FCA's action took effect on 11 November 2014 and a copy of the Final Notice, which sets out the reasons for the action is displayed on the FCA's website and can be accessed via the following link: http://www.fca.org.uk/static/documents/final-notices/final-notice-rbs.pdf The foreign exchange market (FX market) is one of the largest and most liquid markets in the world. Its integrity is of central importance to the UK and global financial systems. Over a period of five years, RBS failed properly to control its London voice trading operations in the G10 spot FX market, with the result that traders in this part of its business were able to behave in a manner that put RBS's interests ahead of the interests of its clients, other market participants and the wider UK financial system. The FCA expects firms to identify, assess and manage appropriately the risks that their business poses to the markets in which they operate and to preserve market integrity, irrespective of whether or not those markets are regulated. The FCA also expects firms to promote a culture which requires their staff to have regard to the impact of their behaviour on clients, other participants in those markets and the financial markets as a whole. RBS's failure adequately to control its London voice trading operations in the G10 spot FX market is extremely serious. The importance of this market and its widespread use by market participants throughout the financial system means that misconduct relating to it has potentially damaging and far-reaching consequences for the G10 spot FX market and financial markets generally. The failings described in the Final Notice undermine confidence in the UK financial system and put its integrity at risk. RBS breached Principle 3 of the FCA's Principles for Businesses in the period from 1 January 2008 to 15 October 2013 (the Relevant Period) by failing to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems in relation to G10 spot FX voice trading in London. References in the Final Notice to RBS's G10 spot FX trading business refer to its relevant voice trading desk based in London. During the Relevant Period, RBS did not exercise adequate and effective control over its G10 spot FX trading business. RBS relied primarily upon its front office FX business to identify, assess and manage risks arising in that business. The front office failed adequately to discharge these responsibilities with regard to obvious risks associated with confidentiality, conflicts of interest and trading conduct. The right values and culture were not sufficiently embedded in RBS's G10 spot FX trading business, which resulted in it acting in RBS's own interests as described in the Final Notice without proper regard for the interests of its clients, other market participants or the wider UK financial system. The lack of proper control by RBS over the activities of its G10 spot FX traders in London undermined market integrity and meant that misconduct went undetected for a number of years. RBS's control and risk functions failed to challenge effectively the management of these risks in the G10 spot FX trading business. RBS's failings in this regard allowed the following behaviours to occur in its G10 spot FX trading business: (1) Attempts to manipulate the WMR and the ECB fix rates, alone or in collusion with traders at other firms, for RBS's own benefit and to the potential detriment of certain of its clients and/or other market participants; (2) Attempts to trigger clients' stop loss orders for RBS's own benefit and to the potential detriment of those clients and/or other market participants; and (3) Inappropriate sharing of confidential information with traders at oter firms, including specific client identities and, as part of (1) and (2) above, information about clients' orders. These failings occurred in circumstances where certain of those responsible for managing front office matters were aware of and/or at times involved in behaviours described above. They also occurred despite the fact that risks around confidentiality were highlighted when RBS received client complaints in October 2010 and January 2012, and, in November 2011, a trader questioned whether it was inappropriate to share information with traders at other firms or with clients. RBS was on notice about misconduct associated with LIBOR / EURIBOR during the Relevant Period. The FCA issued a Final Notice and a financial penalty against RBS on 6 February 2013 in relation to benchmark setting for LIBOR. Against this background, RBS engaged in an extensive remediation programme across its businesses in response to LIBOR / EURIBOR, including taking important steps to promote changes to culture and values. Despite these improvements, the steps taken during the Relevant Period in its G10 spot FX trading business did not adequately address the root causes that gave rise to failings described in the Final Notice. The FCA has considered the nature and extent of co-operation provided by RBS during the course of its investigation. The FCA acknowledges that RBS acted promptly in bringing the behaviours referred to in the Final Notice to the FCA's attention. RBS has also provided extremely good co-operation and taken significant steps to assist the FCA in its investigation. RBS is continuing to undertake remedial action and has committed significant resources to improving the business practices and associated controls relating to its FX operations. The FCA recognises the work already undertaken by RBS in this regard. The Final Notice relates solely to RBS's conduct in its G10 spot FX trading business in London. It makes no criticism of any entities other than the firms engaged in misconduct as described in the Final Notice.

1. On 6 February 2013, the FSA imposed a financial penalty of £87.5 million on The Royal Bank of Scotland plc (RBS) of 36 St. Andrew Square, Edinburgh, EH2 2YB. 2. The FSA's action took effect on 6 February 2013 and a copy of the Final Notice, which sets out the reason for the action, is displayed on the FSA's website and can be accessed via the following link: http://www.fsa.gov.uk/static/pubs/final/rbs.pdf 3. The London Interbank Offered Rate (LIBOR) is a benchmark reference rate fundamental to the operation of both the UK and international financial markets, including markets in interest rate derivatives contracts. 4. The integrity of benchmark reference rates such as LIBOR is therefore of fundamental importance to both the UK and international financial markets. 5. Between January 2006 and March 2012 (the Relevant Period), RBS breached Principle 3 of the FSA's Principles for Businesses and, between October 2006 and November 2010, RBS breached Principle 5. 6. With respect to the Principle 5 breaches, RBS, in order to benefit its derivatives trading books, sought to manipulate LIBOR in connection with its own submission of rates that formed part of the calculation of Japanese yen (JPY) and Swiss franc (CHF) LIBOR and also sought to influence other banks' JPY LIBOR submissions. RBS also on occasion inappropriately considered the impact of LIBOR and RBS's LIBOR submissions on the profitability of transactions in its money market trading books as a factor when making (or directing other to make) JPY, CHF and USD LIBOR submissions. 7. With respect to the Principle 3 breaches, RBS failed to have adequate risk management systems and controls in place in relation to its LIBOR submissions process. RBS did not begin to put such systems and controls in place until March 2011 and its initial measures were inadequate because they did not address the risk that RBS derivatives traders would make requests to RBS's LIBOR submitters. The duration and extent of RBS's misconduct was exacerbated by its inadequate systems and controls. 8. RBS's misconduct undermined the integrity of LIBOR.

On 11 January 2011 the FSA imposed a financial penalty of £2,800,000 on Royal Bank of Scotland Plc and National Westminster Bank Plc (together, the Firms) for breaches of Principle 3 (management and control) and Principle 6 (customers' interests) of the FSA's Principles for Businesses and Rules in the Dispute Resolution: Complaints Sourcebook (DISP) which occurred between 1 December 2008 and 25 March 2010 (the Relevant Period). The Firms agreed to settle at an early stage of the FSA's investigation. They therefore qualified for a 30% (stage 1) reduction in penalty, pursuant to the FSA's executive settlement procedures. Were it not for this discount, the FSA would have imposed a financial penalty of £4,000,000 on the Firms. During the Relevant Period, the Firms' complaint handling arrangements for their UK Retail bank branch network (RBS UK Retail) and for dealing with escalated complaints arising from the branch network breached the FSA's Principles and Rules. In particular, the FSA has identified the following failings: 1) the monitoring undertaken at branch level and the resulting management information produced was ineffective in assessing whether customers were being treated fairly. It focused on whether complaint handlers adhered to process and did not assess the quality of customer outcomes. For example, the controls focused on measuring whether complaint handlers dealt with complaints within target timeframes and did not assess the quality of the investigation performed, the correspondence produced or the overall outcome for the complainant; 2) RBS UK Retail failed to ensure that complaint handlers properly reviewed complaints taking account of all relevant factors. For example, the FSA's review of complaint handling arrangements within RBS UK Retail (the Thematic Review) found: a) the quality of the investigation undertaken was inadequate with complaint handlers failing to obtain all relevant and reasonably available information when investigating a complaint; b) the guidance provided to staff on how to investigate properly a complaint was limited. It provided a high level overview of complaint handling with an emphasis on resolving complaints within target timeframes; c) there was no formal requirement to consider and feed back the results from FOS decisions to complaint handlers and/or teams outside of the dedicated FOS team. As a result, complaint handlers, with the exception of the specialist FOS Team, were not always aware of and did not always take account of FOS decisions when deciding complaints; and d) the complaint handling process applied led to delays in sending out responses to customers, multiple attempts to resolve the complaints with customers and led to delays in customers receiving details of their FOS referral rights. 3) RBS UK Retail failed to ensure that correspondence sent to complainants addressed fully all concerns raised by the customer and set out the outcome of the investigation in a way that was fair, clear and not misleading. RBS UK Retail's breaches are viewed as serious because: 1) RBS UK Retail is the second largest provider of retail banking products and services in the United Kingdom with approximately 2,200 bank branches and 15 million customers during the Relevant Period. The majority of consumers make complaints through the branch network, which, as the first point of contact, in most cases retained responsibility for resolving any complaint received. Therefore, given the nature of the failings there is an unacceptably high risk that customers may not have been treated fairly; and 2) the ability of RBS UK Retail to effectively monitor and assess its complaint handling arrangements was impacted for around two and a half years. RBS UK Retail was aware from Quarter 2 2007 that complaint handlers were failing to attach on the complaint handling management system the mandatory acknowledgment and resolution letters. This was not ful resolved until November 2009. RBS UK Retail's failures therefore merit the imposition of a significant financial penalty. In deciding the level of disciplinary sanction, the FSA recognises that RBS UK Retail has co-operated fully with the FSA throughout its investigation, accepting the findings of the Thematic Review at an early stage. The FSA also acknowledges that these issues were assessed during the Firms' Cross Divisional Review in Quarter 4 2009. RBS UK Retail has agreed to make significant changes to its complaint handling arrangements as a result of the findings from this review and the FSA's Thematic Review, and has already started to implement such changes. This has included: 1) proactively seeking to address and agree the issues identified by the FSA's thematic review at an early stage; 2) working with a skilled person to undertake an extensive review of all parts of its complaint handling arrangements; 3) increasing the types of complaints which are required to be handled by specialist complaint handlers so more complaints are now owned by specialist areas; and 4) undertaking a re-assessment of a number of complaint files. The FSA expects that these changes will lead to improved outcomes for customers.

On 2 August 2010 the FSA imposed a financial penalty of £5,600,000 on four members of the Royal Bank of Scotland Group (RBSG) for breaches of the Money Laundering Regulations 2007 (the Regulations) which occurred between 15 December 2007 and 31 December 2008. The breaches related to the systems and controls put in place by RBSG to prevent breaches of UK financial sanctions. RBSG agreed to settle at an early stage of the FSA's investigation. It therefore qualified for a 30% (Stage 1) discount under the FSA's executive settlement procedures. Were it not for this discount, the FSA would have imposed a financial penalty of £8,000,000 on RBSG. RBSG failed to consider properly what policies and procedures were required to comply with their obligations under the Regulations and the UK financial sanctions regime. Consequently, RBSG failed, for an extended period of time, to put in place adequate systems and controls to screen both its customers and the payments they received against the list of sanctioned entities maintained by HM Treasury (the Treasury list). In particular, RBSG failed to establish and maintain appropriate and risk-sensitive policies and procedures relating to the following matters: (1) RBSG failed properly to implement and oversee the systems used to screen relevant customers and payments against the Treasury list. As a result, notwithstanding that RBSG were one of the largest processors of foreign payments among UK banks, they did not screen the following cross-border payments: (a) any incoming payments to customers; (b) Sterling payments made by customers (except those going to US based institutions); and (c) Euro payments made by customers (until 9 June 2008). Whilst these issues were identified by RBS Group Security & Fraud (GS&F) within RBS Group's Manufacturing Division, and GS&F had put in place a plan to address them, such actions were not taken in a sufficiently timely manner. (2) RBSG's automated screening failed to screen the majority of trade finance SWIFT messages generated in the international trade transactions that it carried out. (3) RBSG did not consistently record sufficient information relating to the directors and beneficial owners of its corporate customers. Where information relating to directors and beneficial owners was recorded, RBSG failed to ensure that such individuals were screened against the Treasury list on an ongoing basis. (4) After the screening systems used to check customers and payments against the Treasury list had initially been set up, RBSG failed to ensure that the design and implementation of the 'fuzzy matching' capabilities in the screening software - used to identify close matches to the Treasury list - continued to operate satisfactorily. After the initial set up, the results produced by the screening filters were not routinely reviewed or monitored by RBSG to ensure that they were appropriate. This meant that over time the 'fuzzy matching' parameters initially set by RBSG became significantly less effective at identifying potential matches. The lack of adequate policies and procedures in respect of these matters gave rise to an unacceptable risk that RBSG could have breached the UK financial sanctions regime. The FSA considers these failings to be particularly serious because: (1) The involvement of UK financial institutions in providing funds, economic resources or financial services to designated persons on the Treasury list undermines the integrity of the UK financial services sector. Unless they have in place robust systems and controls, UK financial institutions risk being used to facilitate transactions involving sanctions targets, including terrorist financing. As the Joint Money Laundering Steering Group (JMLSG) guidance advises, small amounts of funding could be sufficient to finance terrorist activities and hence the sanctions-related systems and controls implemented by firms need to be robust enough to capture sucpyments. The FSA's financial crime and market confidence statutory objectives are both endangered by firms' failures in this area. Adequate systems and controls relating to financial sanctions is an integral part of complying with the FSA's requirements on financial crime. (2) The systems and control failings at RBSG presented a serious risk to the FSA's financial crime and market confidence statutory objectives. During 2007, the London division responsible for processing payments for RBSG dealt with the largest volume of foreign payments of any financial institution in the UK. For example, it processed £7.6 trillion of inward Euro payments and £8.6 trillion of outward Euro payments, across a total volume of 1.8 million payment transactions. (3) RBSG, through GS&F, were aware of deficiencies in the screening systems used during the Relevant Period but did not act on these deficiencies in a timely manner. This contributed to the above failings in systems and controls remaining in existence for one year and not being remedied earlier. For example, GS&F raised issues relating to their sanctions screening software with the software provider but failed to ensure that these issues were resolved promptly. Further, after GS&F instructed a leading firm of accountants in early 2008 to carry out an independent review to benchmark RBSG's screening software against a peer group, the key issues identified in the review were not appropriately escalated and as a result were not considered by the relevant committees within RBSG who would have overseen remedial action. The required remedial action was not taken until a number of months later. RBSG's failings therefore merit the imposition of a significant financial penalty. In deciding the level of disciplinary sanction, the FSA recognises that RBSG have taken action to mitigate the seriousness of their failings, including: (1) once the failings came to the attention of the current management within RBSG, they promptly reported them to the FSA; and (2) RBSG took expedient and appropriate remedial action in respect of screening payments, improving the effectiveness of the software and improving governance and oversight of UK sanctions compliance. This included implementing screening of all inbound payments, outbound domestic Sterling payments, various Trade Finance messages and payments entered directly into the gateway application for SWIFT messages. Since the discovery of its failings in December 2008, RBSG and its current senior management have fully cooperated with the FSA's investigation.

Final Notice Issued on 12 December 2002 on the Royal Bank of Scotland plc ('RBS') THE PENALTY 1.1 On 12 December 2002 the FSA imposed a financial penalty on RBS of £750,000 for breaches of Rule 3.1.3 and 7.3.2 of its Money Laundering Rules ('ML Rules'). REASONS FOR THE PROPOSED ACTION Summary 2.1 Following information provided by RBS suggesting that RBS may have contravened the ML Rules, the FSA on 30 May 2002 appointed investigators under section 168 of the Financial Services and Markets Act 2000. 2.2 As a result of that investigation, which was based on a sample of accounts opened between January 2002 and May 2002, the FSA concluded that RBS contravened both Rule 3.1.3 and Rule 7.3.2 of the ML Rules. 2.3 In so doing RBS demonstrated failings which demand a significant financial penalty. These failings are viewed by the FSA as particularly serious in the light of the following factors: · they occurred against a background where statutory requirements for firms to have in place anti-money laundering procedures, including procedures to identify their clients, had been in place for over eight years and where, in anticipation of the FSA's new powers to make Rules relating to the prevention of money laundering with effect from 1 December 2001, there had been a greatly increased emphasis on preventing the use of the financial system for financial crime; · a high level of breaches between January and March 2002; · notwithstanding the systems which RBS had in place, there was a failure adequately to monitor compliance with regulatory requirements; · the FSA believes that the size of RBS and the retail banking market in which it operates presents a serious risk to the FSA's statutory objective to reduce financial crime. 2.4 Were it not for the prompt and effective remedial action taken by RBS once it had identified its failings and for the full and pro-active co-operation demonstrated by RBS in relation to the FSA's investigation, the financial penalty proposed would have been very substantially higher. RBS Actions 2.5 RBS is an authorised deposit taking institution undertaking retail banking and a wide range of other permitted activities. RBS forms part of the Royal Bank of Scotland Group (RBS Group). 2.6 RBS Retail Banking (RBS Retail) uses a process called the New Account Sanctioner (NAS) when opening new accounts. NAS is intended to ensure that the 'Know Your Customer' (KYC) information necessary for verifying identity is in place prior to an account being opened. NAS has been in place for five years. 2.7 NAS procedures in RBS Retail were tested in December 2001. These tests identified a KYC failure rate of 11.2% i.e. either the customer's name or address (or both) had not been verified to the standards laid down in the NAS process within RBS Retail or the required records of identity had not been retained. 2.8 The results of these tests were made available to RBS Group management in January 2002 and a remedial action plan aimed at ensuring adherence to the NAS process was drawn up and implemented during the period January 2002 to March 2002. 2.9 In March 2002 testing was conducted on accounts opened in January 2002, following the implementation of the action plan. These tests indicated that the KYC failure rates had increased further. 2.10 The remedial action plan initiated in January 2002 resulted in KYC failure rates being significantly reduced from April 2002. The Investigation 2.11 The FSA examined account opening documentation in relation to 181 accounts opened between January and May 2002. Having regard to the identification criteria set out in the Joint Money Laundering Steering Group Guidance Notes, the FSA determined whether there was sufficient evidence to show that the client was who he had claimed to be. 2.12 Of the 181 account files examined, 89 were found to have insufficient evidence to show that the client was who he had claimed to be, in breach of Rule 3.1.3 of the MLRules. In respect of 7 account files, RBS was unable to supply copies or details of the documents it had used to verify identity, in breach of Rule 7.3.2. Two of these seven accounts were found to be in breach of both Rule 3.1.3 and 7.3.2, making a total of 94 accounts with one or more failings. The seriousness of the breaches 2.13 In determining that a financial penalty was appropriate and that the amount proposed was proportionate to RBS's contraventions the FSA considered the factors below to be particularly relevant. 2.14 The high level of breaches identified applied across the whole of the RBS Retail network and existed from at least December 2001 until March 2002, with particularly high failure rates in January 2002 and March 2002. 2.15 The breaches revealed weaknesses in the RBS anti-money laundering control system. The FSA considers the failure effectively to monitor the compliance of the RBS Retail network with the requirements of the Money Laundering Regulations 1993 and the FSA Money Laundering Rules to be a serious matter. The seriousness of the breaches is exacerbated by the fact that they took place against a background of increased regulatory emphasis on the importance of effective anti-money laundering controls. 2.16 The FSA noted, however, that RBS itself discovered the breaches through its own GIA/Compliance testing in December 2001. Additionally, in most cases some attempt had been made to identify the customers. The size, financial resources and other circumstances of the firm 2.17 The FSA expects that a bank such as RBS should ensure that its anti-money laundering controls operate effectively across the whole of its network. The FSA believes that a failure in anti-money laundering systems and controls in a large retail bank such as RBS is particularly serious in that it poses a greater risk that financial crime may be facilitated and therefore constitutes a greater risk to the FSA's statutory objective to reduce financial crime. Conduct following the contravention 2.18 RBS informed the FSA of its contraventions and co-operated fully and pro-actively with the FSA's investigation. 2.19 Once it had identified the problem, RBS took it seriously. It devoted considerable resources at an early stage to correct the problem and instituted a remedial action plan of its own accord. The FSA is satisfied that the remedial action plan has appropriately addressed the KYC non-compliance issue. CONCLUSION 3.1 Taking into account the seriousness of the contraventions and the risks they posed but also the prompt and effective remedial steps taken and the co-operation shown, the FSA has decided that a financial penalty of £750,000 be imposed. Without RBS's remedial actions and co-operation, the penalty would have been very substantially greater. 3.2 The full text of the Final Notice is available from the FSA.