Working flexibly and flexible working-a new era for financial institutions

First published by Thomson Reuters Regulatory Intelligence, 07 April 2022.

The second anniversary of what amounted to an almost overnight transition to a flexible working environment as a result of COVID-19 has just passed. After a sigh of relief at surviving those COVID years, in 2022 many of us have flexible working arrangements that are clearly permanent. We are seeing some significant structural changes in the way in which we work across financial services, particularly in the retail banking sector.

But how does all of this work in a regulatory environment and what are regulators looking out for in these new ways of working? In this article we touch on some of the key considerations related to flexible working for regulated businesses.

What have we heard from the regulator and what are we seeing in the market?

On October 11, 2021 the Financial Conduct Authority (FCA) published a statement setting out its expectations on remote or hybrid working for firms. Since March 2020 when the global pandemic hit there was a stream of communication from the regulator as to what firms need to do, what their focus should be, and how a firms' systems and controls should adapt. But the October 2021 statement was one of the first real consolidated statements on the FCA's future view – post-pandemic - on hybrid working.

None of the FCA's fundamental expectations relating to flexible working should come as a shock. The FCA expects oversight of firms' functions including outsourced functions. Firms also need to have the right information to monitor activities and be able to communicate with the FCA as it would expect, and governance, supervision and control are key.

In particular, firms must consider whether any flexible working arrangements or any hybrid arrangements are detrimental to consumers, looking at where those interactions with customers arise, and making sure that they still have in place appropriate monitoring, recording and identification of vulnerable customers.

Monitoring is a common theme from the FCA and one which it expects firms to have considered effectively and have suitable systems in place.

During the pandemic there was a focus on governance and accountability, including issues arising from absence of senior managers and that continues in the FCA's statement. The FCA expects that any flexible arrangement or any hybrid working arrangement should not affect the accountability of firms' senior managers and there needs to be a clear oversight and clear governance structures that are fit for purpose and can be worked in this new arrangement.

The FCA has also made clear that it wants firms to have a plan about their working arrangements and to be told about that plan. Firms should notify the regulator first before putting in place any new arrangements, and we would certainly suggest engaging with the FCA before making public announcements about new arrangements.

Can the FCA really visit employees at home?

One particular point in the FCA's statement which garnered plenty of public attention was the reference to home visits by the FCA.

The FCA has the power to enter premises (including residential premises) if it has a warrant, but the suggestion that it might enter employee's homes for general supervisory visits was a new development.

Employees have the right to respect for their private and family lives, and visits by the FCA could place firms in a difficult position if employees resist entry.

At this stage it is hard to know in what circumstances the FCA really does intend to knock on employees' front doors.

Based on subsequent statements from the FCA we would be surprised if it undertook home visits on a frequent basis but it has clearly reserved its position. This will be an area to watch and we hope to have further guidance from FCA in the future.

In the meantime, the FCA has been clear that it expects firms to make their employee aware of its powers, and so firms' short-term task is to meet the FCA's expectations and act in a way that shows the regulator that they are taking steps to be cooperative and compliant, while also remaining sensitive to concerns about intrusion into employees' private lives.

Firms could also try to mitigate the risk of home visits by ensuring that they can show that they have in place adequate arrangements for supervision and controls and data security, and therefore that it is not reasonably necessary for the FCA to go visiting employees at home.

Can employees now work from anywhere in the world?

The FCA has made clear that its existing expectations around about UK presence and meeting those threshold conditions remain in the new word of flexible working – its statement mentions that firms are expected to consider any staff who are working from abroad and the related operational and "legal risks". This is a subtle nod to the UK regulatory perimeter and the need to consider who is doing what and where.

Hybrid working is not a mandate for the dispersal of staff across the world, firms still have to comply with the Financial Services and Markets Act (FSMA) and the Regulated Activities Order (RAO) and the threshold questions in terms of territoriality.

As well as the regulatory issues, other potential legal risks to think about with overseas working include immigration, tax and potential local employment law rights – firms should be careful to ensure that remote working is not causing a person to breach their conditions of stay in the place they are working, that remote working does not trigger tax and social security liabilities and whether the arrangement might cause the person to acquire local law rights in the place they are working from.

Should firms be more closely monitoring employees who work from home?

Monitoring is clearly important to the FCA and an important tool in a firm's compliance arsenal, but it gives rise to some considerations under data protection and employment law.

Monitoring of remote working may require new or different tools, and a blurring of the lines between home and work may mean that monitoring captures more and different types of personal data.

Firms should therefore ensure that they have set up their monitoring systems and processes in a way that is compliant with their obligations under data protection law – for example, it is important for firms to ensure that they have a lawful basis for processing data, that they have carried out any necessary assessments, balanced the competing interests at play and determined that the monitoring to be undertaken is targeted and proportionate, and that they are transparent with employees about what kind of monitoring is undertaken and why.

These considerations are not only important from a data protection perspective, but also to mitigate the risk of monitoring breaching an employer's duty of trust and confidence towards employees or unduly interfering with their right to privacy. It is also important to ensure that information gathered via monitoring is only used for the purpose for which it was gathered, and that it is not used in a way that is unlawfully discriminatory.

What if employees are more enthusiastic about flexible working than the firm is?

Employees do not have the right to dictate their arrangements, but there is a right to request flexible working and we have certainly observed an increase in these requests over the last two years and expect that trend to continue or even accelerate as employers try to establish the "new normal" and employees try to reconcile that with the degree of flexibility to which they have become accustomed over the past two years.

The statutory scheme for requesting flexible working accommodates requests for lots of different types of flexible working and an employee does not have to have a particular reason for requesting the change. However, it is a right to request, not to have, and employers can they refuse the request so long as they have considered it reasonably and the refusal is for one of the prescribed reasons.

At present this right is only available to employees with 26 weeks' continuous service, and can only be exercised once in every 12 month period, although the government has recently consulted on "Making flexible working the default", canvassing changes to the statutory scheme which, if accepted, would make the right more accessible to more employees.

The broader point regarding flexible working is that employees also have further rights which arise from protections against discrimination. These rights should also inform firms' assessment of flexible working requests under the statutory scheme. Even if a firm is confident in refusing a statutory request on one of the prescribed grounds, it should pause to consider whether the refusal could be challenged as unlawful discrimination.

There is no minimum length of service required to be protected against discrimination and the law protects employees against discrimination on the basis of a range of protected characteristics.

Discrimination can be a particularly powerful angle from which to challenge an employer's refusal to allow flexible working if (for example) the employer's refusal is based on a requirement that a particular job can only be done full time or from the office, and that has the effect of putting women at a particular disadvantage due to women (generally) bearing more responsibility for childcare.

It is possible to defend such a claim if the requirement is objectively justified, but this can be a difficult test to meet and may be particularly difficult if an employee wants a pattern of work which had worked effectively during the pandemic, or is an incremental further amount of flexibility from a firm's general policy.

In a regulated environment there might well be reasons why a role genuinely does have to be done in a particular way, but the key point is the analysis of what is required for a particular role in order to defend a discrimination claim needs to be well developed.

Where to from here?

If the last two years have taught us one thing it is that predicting the future is a fool's game, but we will nonetheless venture to suggest a few things which we see on the horizon.

• We start with a fairly safe bet - flexible working is here to stay.
• Flowing from that, we think there will be continued focus on senior managers and their role in any flexible working arrangements. That focus will not only be on the compliance issues we have covered above, but also on how flexible working relates to diversity. The FCA has made very clear that it is interested in culture in a broad sense, by which it means purpose, people, leadership and governance. Diversity feeds into each of those elements of culture, and we expect the FCA to be thinking about how flexible working relates to each of these issues, and to be attuned to potentially unforeseen consequences of flexible working such as proximity bias, looking at how work is distributed depending on who is in the office.
• We also expect that data will be key to both firms' and the FCA's management of flexible working, so the task for firms will be to ensure that arrangements are appropriately monitored and there is that appropriate oversight.
• And finally, a mention of operational risks and cyber resilience – these have always been important, but now more so than ever given the fact that firms may have more laptops, data or systems off site as a result of that hybrid arrangement. So having appropriate systems and controls in place to manage these risks will be fundamental to the sustainability and defensibility of ongoing flexible working arrangements.

Authors: Lorraine Johnston, Jake Green, Crowley Woodford and Hannah Martin