In summary, the policy statement requires the following.

• The regulator will require hiring entities to ask for references for all staff certified under the new regime (people who perform ‘senior management functions’ and ‘senior harm functions’ alike) from all previous employers over the last six years.
• It will require each firm to provide a detailed reference when someone leaves for another job and also to update that reference should new evidence be uncovered that has a bearing on his ‘fitness and propriety’ up to six years from the date of the original reference.
• Firms must mention “breaches of individual conduct on a regulatory reference response where disciplinary action has been taken.”
• Each firm must provide this reference using a template, irrespective of the circumstances of the individual’s departure or of any agreement it has made with him prior to termination – as far back as six years.
• The firm is only required to keep a current employer informed of evidence of further misconduct if that employer is a firm that is authorised to operate under the Financial Services and Markets Act. The principle here is to avoid ‘data protection’ concerns about sharing information when there is no legitimate need to do so. The onus is on the previous employer to establish whether the firms to which it has provided references in the previous six years still ought to employ the individual.

All of this shifts the onus of responsibility regarding such references onto all parties in the most profound way and, of course, this is the intention. It also creates a number of areas of concern and ambiguity. It places employees who (for whatever reason) have been the subject of ‘breach investigations’ or disciplinary action in a difficult situation, perhaps tarnishing their reputations forever and hindering them in applying for significant and/or certified jobs.

The average former employee is unlikely to benefit from any ‘due process’ in the event of an investigation at his old firm that happens after he has left, and this might lead him to lodge a complaint. How can an employer, he might argue, find someone responsible for misconduct after he has left the job and in the absence of a full and fair disciplinary process? How can it be fair if the employee is no longer there? It is possible, moreover, that the FCA's rules in this area will conflict with the UK's employment law. Certified employees might find themselves caught between a rock and a hard place as a result.

Some ambiguity surrounds the word 'breach' and/or the phrase 'disciplinary action.' The FCA has tried to remedy this by referring to s64C FSMA, which defines disciplinary action as the issuance of a formal written warning, the suspension or dismissal of the person and/or the reduction or recovery of some of that person's remuneration.

There are, however, plenty of circumstances in which disciplinary action has nothing to do with breaches of the new code of conduct in the COCON part of the FCA's rulebook. If firms make misjudgements, who is to say that their former employees cannot take legal action, blaming their ex-employers for releasing wrongful or damaging information that contravenes the Data Protection Act and infringes on their rights as employees?

These are just a few issues. Firms must maintain scrupulous records of all breaches of the FCA's rules and subsequent disciplinary action or remediation and every employee should surely have the right (at the time or at any time afterwards) to see all of his employing firm's disciplinary records about him if that disciplinary action or remediation might endanger his future career. Every firm would do well to lay out its disciplinary processes and policies in a clear and open manner.