Will the FCA pull its ‘name and shame’ plan?

The Financial Conduct Authority (FCA) is in hot water over its controversial proposal to publicly name firms under investigation before those investigations are even concluded. The House of Lords Financial Services Regulation Committee has told the regulator, in no uncertain terms, to withdraw the plan unless it can prove that it has adequately addressed stakeholder concerns.

The plan to name and shame

In a bid to increase transparency, the FCA announced plans in February 2024 to publicly disclose enforcement investigations at an earlier stage, including the identity of the entity under investigation, if it is deemed to be in the public interest to do so. Under its existing powers, the FCA can release early information about an investigation in exceptional circumstances.

The proposals were met with widespread backlash, with critics contending that the poorly defined public interest framework risked undue reputational damage to firms and individuals. The framework also granted the FCA excessive discretionary powers, while the proposed 24-hour notice period for firms under investigation was decried as insufficient. In response to criticism, the FCA watered down its proposals in November 2024, extending the 24-hour notice period to 10 days and expanding its public interest test to include potential impacts of disclosure on the investigated firms and public confidence. However, opposition remains fierce.

How not to regulate?

In its latest report, Naming and Shaming: How Not to Regulate, the Lords Committee concluded that the watchdog had failed to make a convincing case for shifting away from its current policy. Despite acknowledging that the FCA’s modifications were a “welcome development,” the report maintains that the proposals remain an “abject failure.”

The Committee questioned why investigations posing an immediate risk of consumer harm would not already be covered under the FCA’s current exceptional circumstances disclosure rules. Instead of overhauling the framework, the report suggests that a broader interpretation of the existing rules should have been considered. Furthermore, the regulator’s failure to adequately engage industry stakeholders was deemed “unacceptable,” with the Committee criticizing the FCA’s surprise at the backlash as indicative of a “worrying disconnect with industry on the part of senior FCA leadership.”

Concerns were also raised that, despite the FCA’s assertion that the proposed policy aligns with international regulatory practices, it could undermine the UK’s international competitiveness. The Committee warned that announcing investigations at the outset could damage the UK’s standing as a global financial hub and risk positioning it as an outlier among financial regulators.

Imogen Makin, counsel at WilmerHale, commented: “The regulator should take heed of the Committee’s conclusions and give more weight to its secondary international competitiveness and growth objective, rather than acting in the hope that quick publicity demonstrating its actions will repair the damage done to its reputation in the wake of high-profile failures and criticism in recent years.”

Is the FCA really addressing stakeholder’s concerns?

The Committee has now called on the FCA to prove that it has “adequately addressed” stakeholders’ concerns raised in the second consultation, which closes next week, on February 17, and to make any necessary amendments before a final decision is made on implementation. If the watchdog cannot demonstrate a balance that is acceptable between consumer protection benefits and the risks to market stability, individuals, and firms, the Committee recommends that the FCA scrap the proposal.

Additionally, the report requests that the FCA publish additional guidance on how the public interest framework will work in practice, ensuring that a “robust, fair, and proportionate process” governs disclosure decisions. Among other recommendations, the Committee has urged the regulator to publish a “lessons learned” document to prevent similar regulatory missteps in the future.

Jill Lorimer, a partner in Kingsley Napley’s financial services regulatory team, remarked: “The report does not make easy reading for the regulator.” She continued: “It is difficult to see how the FCA will proceed in light of this report. The Committee’s criticisms are not limited to technical issues of implementation but go to the heart of the FCA’s approach to this issue and its credibility as a regulator. Its conclusions, and the excoriating terms in which they are expressed, must add to the current pressure on CEO Nikhil Rathi.”

The FCA has made some tweaks to the original proposal, but skepticism remains high. Critics argue that the move could undermine market stability, disrupt firms that ultimately prove to have done nothing wrong, and even clash with the government’s broader push for competition in financial services.

In a pile-on to the FCA’s troubles, this past November it was the subject of another critical parliamentary report published by the All-Party Parliamentary Group (APPG) which condemned the regulator as “incompetent at best, dishonest at worst.” This mounting pressure raises serious questions about the FCA’s regulatory approach and its ability to effectively balance consumer protection with market stability.

The  question now is will the FCA push forward despite some strong opposition or rethink its approach entirely. Either way, the outcome has implications for financial firms, investors and consumers. We will keep you updated as this story continues to unfold.

Let Vinciworks help you manage your FCA compliance. 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.