The UK Prudential Regulation Authority (PRA) Fines HSBC £57,417,500 For Failures In Deposit Protection Identification And Notification

The PRA has fined HSBC Bank plc (HBEU) and HSBC UK Bank plc (HBUK) (together, the Firms) £57,417,500 for historic depositor protection failings arising from the Firms’ failures over many years to properly implement the requirements set out in the Depositor Protection Rules. These included the failure to accurately identify deposits that were eligible for Financial Services Compensation Scheme (FSCS) protection. The failings occurred for HBEU between 2015 and 2022, and for HBUK between 2018 and 2021. This fine, the second highest imposed by the PRA, reflects the seriousness of the failings.

HSBC Fine

The Depositor Protection Rules require firms to put in place adequate systems and controls, and governance, to ensure the integrity of critical information which the FSCS relies upon to make prompt payments to depositors in the event of a firm failure. HBEU’s depositor protection failings were so significant the PRA determined that it had materially undermined the firm’s readiness for resolution.

HBEU also failed to be duly open and cooperative with the PRA in not alerting the PRA over an approximately 15-month period about problems identified in the incorrect marking of accounts as “eligible” for FSCS protection. This was clearly information which the PRA would expect firms to share fully and in a timely way.

This meant the Firms breached Fundamental Rules 2 and 6, as well as Depositor Protection Rules 11, 12 and 14. HBEU was also found to have breached Depositor Protection Rule 50, and Fundamental Rules 7 and 8. This is the first PRA enforcement action in relation to Fundamental Rule 8, which states that firm must prepare for resolution so, if the need arises, it can be resolved in an orderly manner with a minimum disruption of critical services.

Sam Woods, Deputy Governor for Prudential Regulation and Chief Executive Officer of the PRA, said:

“The serious failings in this case go to the heart of the PRA’s safety and soundness objective. It is vital that all banks comply fully with our requirements around preparedness for resolution. HBEU fell far short of its obligations in this area, and failed to disclose its failings to us in a timely manner. These failures led to today’s action, including the significant fine.”

The Firms’ failings included:

• The failure to assign clear ownership for the processes required under the Depositor Protection Rules; and
• The failure to ensure that a senior manager, under the Senior Managers and Certification Regime, was allocated responsibility for these processes and the integrity of the information required under the Depositor Protection Rules.

HBEU’s failings further included:

• Incorrectly marking 99% of its eligible beneficiary deposits as ‘ineligible’ for FSCS protection;
• Providing an incorrect attestation to the PRA confirming its systems satisfied certain requirements of the Depositor Protection Rules; and
• Failing to produce finalised versions of annual reports required to be signed by its board of directors that confirmed compliance with the requirements of the Depositor Protection Rules for multiple years.

The Firms’ cooperation throughout the investigation, including the early admission of certain rule breaches, resulted in a 15% reduction to the penalty. The Firms agreed to resolve the matter and therefore qualified for a further 30% reduction in the fine. Without these reductions, the fine imposed by the PRA would have been £96.5m. The PRA does not consider that the Firms’ breaches were deliberate or reckless.

The Bank of England publishes new enforcement policies

Following a period of consultation, the Bank of England (Bank) and the PRA today have also published Policy Statement PS1/24, which sets out the revised approach to enforcement for both PRA firms and financial market infrastructure firms. This includes revisions to the procedures of the Bank’s Enforcement Decision Making Committee (EDMC). The revised policies set out a new path for early cooperation and greater incentives for early admissions with the aim of speeding up investigations in appropriate cases. PS1/24 further sets out the PRA’s policies and procedures for making supervisory and non-enforcement statutory notice decisions. Today’s fine imposed by the PRA on HBEU and HBUK was under the PRA’s pre-existing penalty policy.

The Bank expects to consult on further amendments to its enforcement policies in 2024, reflecting the additional powers granted under the Financial Services and Markets Act 2023.

Background

1. HSBC Final Notice 
2. Policy Statement PS1/24
3. Both HBUK and HBEU are wholly owned subsidiaries of HSBC Holdings plc. HBUK began trading on 1 July 2018 in advance of the introduction of ‘ring-fencing’ in the UK. Prior to this point, HBEU alone was subject to the UK regulatory framework in relation to deposit protection. Since July 2018, HSBC’s UK operations have been split between its ring-fenced (i.e. retail) (HBUK) and non-ring-fenced (HBEU) entities. Both are Category 1 PRA-authorised firms, meaning they have the capacity to cause significant disruption to the UK financial system if they were to fail.
4. This is the second largest fine the PRA has imposed to date. The highest fine was £87m imposed on Credit Suisse in July 2023.
5. The PRA’s approach to enforcement: statutory statements of policy and procedure 
6. Supervisory statement SS 18/15: Depositor and dormant account protection
7. The Firms breached Fundamental Rules 2 and 6, as well as Depositor Protection Rules 11, 12 and 14. HBEU was found to have breached Depositor Protection Rule 50, and Fundamental Rules 7 and 8.
8. Fundamental Rules: Fundamental Rule 2 - A firm must conduct its business with due skill, care and diligence; Fundamental Rule 6 - A firm must organise and control its affairs responsibly and effectively; Fundamental Rule 7 - A firm must deal with its regulators in an open and co-operative way, and must disclose to the PRA appropriately anything relating to the firm of which the PRA would reasonably expect notice; and Fundamental Rule 8 - A firm must prepare for resolution so, if the need arises, it can be resolved in an orderly manner with a minimum disruption of critical services;
9. Depositor Protection Rules: Depositor Protection Rule 11 - Marking and information requirements; Depositor Protection Rule 12 - Single customer view requirements; Depositor Protection Rule 14 - Single customer view and exclusions view reporting; and Depositor Protection Rule 50 - Transitional provisions: single customer view.