The senior managers and certification regime in financial firms: an organisational culture analysis

ABSTRACT This article critically interrogates the experience of the implementation and enforcement of the Senior Managers and Certification Regime (SMCR) in light of interdisciplinary literature on organisational culture. We demonstrate that the SMCR brings the promise of enhancing effective regulatory supervision of firm culture, supporting the incipient professionalisation of senior manager functions in the financial sector and discerning tangible aspects of artefacts and behaviours that constitute the external layer of good culture. However, we argue that, apart from the more obvious risk of too little enforcement or enforcement targeted at misconduct in the private sphere, there is a risk that a perception of rigidity in enforcement may lead to the development of a counterproductive culture, especially if firms unduly rely upon tick-box quantitative measurement approaches to culture management, and that sound culture may be simplistically equated to compliance with the SMCR. This necessitates a careful and nuanced approach to supervision.


Introduction
In the aftermath of the 2007-09 global financial crisis and the ensuing indictment of bank corporate governance and culture, 2 the Senior Managers and Certification Regime (SMCR) was introduced by the Financial Services (Banking Reform) Act 2013 to replace the Approved Persons Regime with effect from 6 April 2016. 3 Initially, the regime applied only to CRD IV firms (including banks and building societies). In December 2018, however, it was extended to insurance firms, 4 and, in December 2020, to benchmark administrators. 5 The SMCR originated from the influential report of the Parliamentary Commission on Banking Standards (PCBS) which drew a bleak picture of the Approved Persons Regime, and advocated the introduction of a new more rigorous approval regime for systemically important financial institutions. 6 The report echoed broad public indignation against bank senior managers 7 who were perceived as responsible for the crisis but in most cases escaped regulatory sanctions, 8 and reflected the loss of trust in the financial sector subsequent to the LIBOR scandal. 9 This article critically interrogates the experience of the implementation of the SMCR in light of interdisciplinary literature on organisational culture. This enquiry is crucial in view of the expanding scope of the SMCR and its pervasive ramifications on firms' culture, governance, conduct of business, and safety and soundness. Adopting the analytical framework provided by organisational studies is appropriate, as financial firms are large organisations with complex cultures, and the SMCR is both one of the primary regulatory tools to influence firms' culture and a regulatory initiative the effectiveness of which can be materially affected by preexisting firm culture. Our chosen socio-legal method enables us to theorise on the interplay between the SMCR and firm culture and gain a rich tification Regime to Insurers' (July 2018) PS15/18, available at https://www.bankofengland.co.uk/ prudential-regulation/publication/2018/strengthening-individual-accountability-in-insurance-extensio n-of-the-smcr-to-insurers. 5 This refers to benchmark administrators that do not undertake any other regulated activities. FCA 'Extending the Senior Managers Regime to Benchmark Administrators: Final Rules' (June 2020) PS20/ 5, available at https://www.fca.org.uk/publications/policy-statements/ps20-5-extending-senior-man agers-regime-benchmark-administrators-final-rules. 6  understanding of its ramifications. In this context, we examine PRA and FCA SMCR enforcement practice to date to shed light on risks of unintended consequences, gaps and challenges. Although enforcement cases remain few in number, hence not lending themselves to formal empirical research methods, they still provide valuable evidence on the reality of the implementation of the SMCR.
Methodologically, our study of the SMCR is conducted from an 'outside of the law' perspective which enables normative interrogation of the economic and social impact of this regulatory regime by drawing on research findings from the disciplines of sociology and organisational studies that are external to law. 10 Thus, research methods encompass doctrinal legal analysis, in-depth examination of SMCR enforcement practice, and normative analysis drawing both from more general work on organisational culture and from more specific work on bank culture. The ultimate objective of our interdisciplinary exercise is to secure a deeper understanding of the SMCR by placing it in its appropriate context of organisational culture. Accordingly, this paper is situated at the intersection of scholarship that examines the effectiveness and shortcomings of the SMCR and similar individual accountability regimes from a legal perspective 11 and the rich scholarship on firm culture and ethics. 12 The latter encompasses both theoretical and empirical literature as well as more targeted literature on culture (e.g., in the Irish banking sector) 13 and public reviews on bank culture in the UK. 14 Our paper contributes to the existing literature by conducting a normative legal analysis of the SMCR that is based on both theoretical and empirical research in sociology and organisational studies, and on the experience of the implementation of the SMCR since its introduction in 2013. As such, it highlights challenges in light of established understandings of the way in which organisational culture evolves and responds to external pressures.
As a legal framework, the SMCR brings the promise of enhancing effective regulatory supervision of firm culture and of supporting the incipient professionalisation of senior manager functions in the financial sector, and hence we do not advocate legislative changes. However, we argue that, apart from the more obvious risk of too little enforcement, there is a risk that a perception of rigidity in enforcement may lead to the development of a counterproductive culture, especially if firms unduly rely upon tick-box quantitative measurement approaches to culture management, and that sound culture may be simplistically equated to compliance with the SMCR. This necessitates a careful and nuanced approach to supervision which should be theoretically informed by sociological research and should recognise the limitations of external regulatory intervention and any form of deliberate design in the context of firm culture. Granted, SMCR is an integral part of the broader UK financial regulatory framework which, despite consecutive waves of reform, is still for the greatest part 'industry-facing' rather than 'socially facing 15 and faces challenges of regulatory capture by the industry and insufficient resources. This casts doubts on the feasibility of our envisaged nuanced approach to SMCR enforcement and on our faith in the SMCR as a possible lever for positive change. However, recent trends towards a greater emphasis on firms' duties to customers and a wider rebalancing of focus from a stance that has been clearly titled towards prudential concerns to one that equally addresses prudential and conduct of business concerns indicate that there is realistic scope for the SMCR to perform the enhanced role that is canvassed herein.
To this effect, Section I provides a concise legal analysis of the principal aspects of the SMCR. Section II reviews organisational literature to ascertain the concept and properties of firm culture. Section III analyses the regulatory vision of a sound purposeful culture for financial firms and distils the core substantive content of purposeful culture while acknowledging the need to avoid a one-size-fits-all approach. Section IV brings to light the interplay and intersections between the SMCR and firm culture, and argues that framing SMCR as part of the broader policy to improve firm culture can be beneficial. Section V examines the FCA and PRA SMCR enforcement practice to date and identifies three main challenges: that equating SMCR compliance and broader compliance with the law to sound culture can narrow down the scope of culture and its connection to ethics; that either too scant or excessively harsh enforcement of the SMCR can lead to the development of inappropriate culture that defeats regulatory objectives; and that the effectiveness of the SMCR can be diminished due to adverse pre-existing culture in certain firms. Section VI provides a roadmap for regulators to fine-tune the implementation of the SMCR to optimise its benefits and mitigate any adverse unintended consequences, while acknowledging the limitations of regulatory action in this area and the ensuing potential role of professional bodies in cultivating purposeful cultures in finance. Section VII provides concluding thoughts. 15

I. A brief overview of the SMCR
This section provides a concise doctrinal legal analysis of the SMCR. The SMCR applies to senior management functions, which satisfy two conditions. First, that the relevant person will be managing one or more aspects of the affairs of a relevant authorised firm. Second, that the activities of the relevant person involve a risk of serious consequences for the authorised firm or for business interests in the UK. 16 Each authority, the FCA and PRA, has prescribed a separate list of senior management functions. The PRA's list of senior management functions includes six executive functions (CEO, CFO, chief risk officer, head of internal audit, head of key business area, and group entity senior manager), and five non-executive functions (board chairman, chairmen of the audit, remuneration and risk committees, and senior independent director). 17 The FCA's list is distinct and more extensive (e.g. it includes a compliance and money laundering oversight function as well as the chair of the board's nominations committee). 18 When CRD IV firms appoint non-executive directors who do not perform a senior management function they are required to provide the PRA/FCA with sufficient information to allow them to assess whether the appointees are fit and proper, an assessment which entails honesty, competence and capability, and financial soundness. 19 A firm must not make an approval application unless it is satisfied that the relevant person is fit and proper to perform the senior management function, 20 and in doing so it has to consider the person's good repute, integrity, knowledge, experience, qualifications, and training. 21 Institutions are also required to review annually the fitness of senior managers and to notify the regulator if they believe that there are any grounds on which the latter could withdraw approval. 22 In addition, the PRA and the FCA can approve a candidate for a senior management function subject to conditions or for a limited period of time, and impose or vary such conditions at any time after approval is given. 23 A crucial element of SMCR is the requirement that firms draw up and keep up-to-date a statement of responsibilities for each senior manager role, detailing the particular aspects of their affairs that the 16  role encompasses, 24 and an overall map of responsibilities. 25 These rules aim to facilitate the apportionment of individual responsibility to senior managers in case of regulatory failures and enhance their personal accountability, thus responding to the problem of diffusion of responsibility and the hitherto scarcity of enforcement action against senior individuals.
The regulatory control of appointments in senior management functions is part of a broader framework of regulatory reforms that emphasise individual accountability. The other two components of the SMCR framework are conduct rules that apply to all staff, 26 and the certification regime. In particular, for employees who do not perform senior management functions, but only perform a significant-harm function, FSMA sets out a simplified regime whereby firms are required to assess whether these employees are fit and proper persons to discharge significantharm functions and issue a certificate. 27 A 'significant-harm function' is one that involves performing such duties that may cause significant harm to the bank or its customers. 28 Certificates have to specify the aspects of the affairs of the bank that the employee will be involved with, and are valid for a period of 12 months. 29 The changes implemented by SMCR reflect the trajectory of regulatory oversight of senior appointments in financial institutions since the global financial crisis. Post-crisis, competence became a major regulatory concern of the then FSA, and relevant financial experience was normally seen as essential. 30 More broadly, in 2009 the FSA announced a change in its regulatory approach towards a more outcomes-based and proactive stance within the implementation of principles-based regulation. 31 This entailed judging the business models and product features of regulated firms on their substantive merits. Outcomes-based regulation focuses on determining specific outcomes that firms must provide, usually regarding the treatment of their customers, while leaving discretion to firms on how best to achieve the said outcomes. Therefore, what a focus on outcomes can add to principlesbased regulation is that, in situations where the regulator can determine ex ante which specific outcomes are desirable, it can specify these as part of 24  the general principles of conduct. 32 It follows that principles-based regulation, in the absence of reference to specific outcomes, only supports reactive interventions once the effects of damaging conduct have become apparent, whereas outcomes-infused principle-based regulation can also be conducive to proactive interventions into markets and firms if specified outcomes are not delivered, at a time before a major scandal or failure has occurred. In the context of the Approved Persons Regime, the FSA had clarified that it was prepared to scrutinise meticulously the competence of proposed individuals rather than merely rubber-stamping banks' decisions, and conducted a high number of prospective senior manager interviews between 2009 and 2011, 33 thus paving the way for the introduction of the SMCR. The heightened element of individual accountability and liability risk for financial firm managers has several advantages. From the perspective of the public, the SMCR goes some way towards restoring trust in the financial services sector, which is essential to maintain the social license of financial firms. 34 From the perspective of individuals performing senior management functions, the SMCR provides a clear incentive to avoid excessive risk taking, exercise due diligence and develop their ability to understand and manage risk and retain effective oversight of their area of responsibility. This is due to the increased risk of successful regulatory enforcement against individual senior managers in the form of a fine, prohibition from acting as manager within the regulated sector, or both. 35 From the perspective of supervisors, the regime makes it easier and less costly to bring enforcement cases against individuals and can potentially reduce the information asymmetry between regulators and firms as it forces firms to become more transparent with regard to their internal management structures and hierarchies. It also empowers supervisors to conduct more extensive and granular ex ante scrutiny of appointees thus facilitating a pre-emptive regulatory approach that can prevent breaches from happening. At the same time, the regime is subject to the general limitations of regulatory enforcement that can affect financial regulators including insufficient expertise and resources and an unduly close relationship with the industry that can cause ostensibly hard rules to function as de facto self-regulation. 36 II. The concept of organisational culture as a locus for regulation and supervision A culture of excessive risk-taking and short-termism was identified as a key culprit of the 2007-2009 global financial crisis. 37 Calls to integrate culture as a key regulatory objective were, therefore, an organic development. As such, the Parliamentary Committee on Banking Standards stressed the importance of improving culture in financial institutions, 38 while the Salz Review criticised Barclays' lack of a group-wide culture of shared values. 39 Culture took a prominent place in financial regulation at the global level and to a similar extent, in the FCA's agenda. 40 The FCA has stated that 'firms' culture shapes the conduct outcomes for consumers and market. So, we aim to assess and address the drivers of culture … ' 41 The concept of culture, however, remains somewhat vague in the regulatory discourse which calls for conceptual clarification and elucidation. This section engages with established scholarship in sociology and organisational studies to elucidate the concept and nature of organisational culture which will form the foundation of the arguments brought regarding the impact of the SMCR in subsequent sections. There is little agreement across management scholars about what culture is. 42 The often-cited definition of Schein refers to the culture of a group as 'the accumulated shared learning of that group as it solves its problems of external adaptation and internal integration; which has worked well enough to be considered valid and, therefore, to be taught to new members as the correct way to perceive, think, feel, and behave in relation to those problems … ' 43 Schein identifies three distinct layers of culture, known as the onion model: a (deepest) layer of basic underlying assumptions, a middle layer of espoused values and ideology, and a surface layer of more observable factors such as artefacts and behaviours of members of the organisation that reflect those assumptions and shared meanings. 44 These layers differ in their observability and in their susceptibility to transformation. As we shall see below, the multi-layered nature of culture will inevitably dictate supervisory focus on the more visible aspects of culture that can be deciphered, assessed, and managed.
The main area of contestation in the literature concerns whether culture should primarily be viewed as a constraint to human behaviour that shapes agency and relationships 45 or rather as a flexible toolkit of cognitive and symbolic resources (e.g. arguments, generalisations, tropes, catchphrases) that individuals utilise to support their chosen strategies of action. 46 The first view resonates with situations in which values are fully internalised by individuals and unconsciously acted upon. On that view, culture can explain apparently irrational dimensions of organisational behaviour, as fully institutionalised members are likely to conform with tacit norms even when it is not in their self-interest to do so. 47 The second view emphasises the deliberate and conscious use of symbols and other cultural artefacts by individuals who have not fully internalised the underlying values and are taking advantage of shared symbols to suit their own ends. Evidently, the two perspectives are not mutually exclusive 48 and both functions of culture, as a constraint and a toolkit, are likely to coexist in large and complex organisations such as financial firms, across different business divisions and levels of managerial hierarchy.
Yet, some common ground in the organisational culture literature can also be discerned. This is the crucial role that leadership plays in shaping culture, promulgating values and goals, setting incentives, and providing examples of appropriate behaviour. 49 However, the ability of leaders to force an abrupt change in culture is limited, as people tend to resist changetacitly or openlyand existing culture is likely to modify the implementation of externally imposed changes so as to minimise discrepancy with core beliefs and values. 50 These observations resonate with the FCA definition of culture which refers to 'habitual behaviours and mindsets that characterise an organisation'. 51 The FCA clarifies that it does 'not attempt to assess mindsets and behaviours directly' 52 and that the key drivers that can lead to harm include the competence and compliance of the firm's leadership. 53 The raft of UK bank failures in 2007-09 presents such examples of poor leadership leading to the development of unhealthy bank culture. Prior to the global financial crisis, many of these executives were idolised by the business community that admired fearless strategies. 54 For instance, Fred Goodwin, the former chief executive of the Royal Bank of Scotland was awarded the Forbes businessman of the year in 2002 and a knighthood and was referred to as the 'best banker in the world'not despite but perhaps due to his 'aggressive, macho management style'. 55 The City of London glorified 'insurgent modernisers' senior managers and counted their dubious tough reputation as 'capital'. 56 Indeed, Fred Goodwin, who was known as Fred the Shred, was not an outlier. There was evidence of a shift in the management style of senior managers replacing traditional 'old guards' who were cautious, avoided speculation and 'didn't bet the bank' with overconfident managers who often imposed overt 'economic violence' creating a culture of fear for staff 57 and stifling contrary opinions. 58 For instance, the House of Commons Treasury Committee criticised the high-risk, reckless business strategy of Northern Rock, 59 and attributed the failure of the strategy to the board of directors, concluding that they 'were the principal authors of the publication/corporate/our-approach-supervision.pdf. The other drivers are the firm's purpose (as it is understood by its employees), the attitude, behaviour, the firm's approach to managing and rewarding people (e.g., staff competence and incentives), and the firm's governance arrangements, controls and key processes (e.g., for whistleblowing or complaint handling). On the importance and nature of leadership see also difficulties that the company has faced'. 60 In particular, the Committee was concerned that the Chief Executive of Northern Rock at the time, Adam Applegarth, was not a qualified banker and called for an urgent review of the qualifications of senior directors in financial within the Approved Persons Regime. 61 The Committee also laid the blame for Northern Rock collapse at the door of its non-executive directors who failed to check on the 'executive folly'. 62 It is therefore no surprise that culture has become a major focal point for financial regulators in recent years.

III. The regulatory vision for a purposeful culture
This section engages with the regulatory discourse on purposeful culture to interrogate the regulatory vision for culture in financial firms and makes use of the theoretical insights generated in the previous section to dissect and critique regulatory discourse on culture.
The FCA encourages firms to develop a healthy purposeful culture. 63 The common elements of such culture, to be differentiated from a prescriptive definition, include a meaningful purpose, an inclusive environment where it is safe to speak up, effective leadership and governance, and a workforce with the necessary capabilities and motivated by appropriate incentives. 64 In general terms, a purposeful culture means 'putting a clear, meaningful purpose, at the centre of a firm's business model, strategy and culture'. 65 Purpose is 'the gravitational force that draws in and aligns teamwork, engagement, inspiration and creativity'. 66 This is a rather circular explanation as these elements are also the key components and drivers of culture itself. A more nuanced approach is needed to guide financial firms along the lines provided in the British Academy's Principles for Purposeful Businesses. 67 Arguably, the FCA and PRA should explicitly draw the connection between culture and known instances of misconduct and signpost cultural drivers and indicators that can lead to misconduct. This approach has been recently adopted in guidance issued by the Monetary Authority of Singapore. 68 In doing so, supervisors must be wary of undue generalisations since drivers of poor culture in one type of firm or industry sector may not have the same effect in different firms. 69 Supervisors must also consider the importance of avoiding excessive uniformity of practices amongst firms, as excess uniformity can ultimately undermine the resilience of the financial system and its stability by making all firms vulnerable to the same types of risks or shocks. 70 To achieve a purposeful culture, the focus on purpose should begin at the top. This approach reflects organisational culture literature that views culture as being learned rather than delivered or inherited. 71 Therefore, 'managers much act and be perceived as acting in ways that are consistent with the values they want employees to share', 72 and the board and senior management must demonstrate adherence 'to sound risk management and the highest standards on integrity (walking the talk), as, over time, their behaviour will be emulated by the rest of the institution'. 73 Supervisors also need to be cognisant of sub-cultures within institutions that may originate from their cross-border operations and cultural differences of parent companies and subsidiaries or branches. This is particularly important for large financial institutions in which there is often no cohesive group-wide culture at all, but rather each business or geographic division may develop an insular culture, and employee loyalty may be primarily to their immediate superiors and to employees with similar positions in other institutions rather than to the firm as an organisation. 74 Identifying 'core elements' of sub-cultures across industries 75 and various parts of an industry (such as investment banking) would be a useful supervisory tool to prevent systematic misconduct. 76 The FCA acknowledges that culture is far from being monolithic and expects firms to identify essential elements in their purpose which are tailored to the type of business and sector. For instance, it views operational resilience as a core and essential ingredient of the culture in exchanges and custody banks. 77 While tone from the top 78 is an essential element of a purposeful culture it is not a sufficient one. The FCA reiterates that it should be complemented by tone from the middle 79 where middle management assists in transmitting and diffusing culture within the firm on all levels. 80 In large organisations, this is no easy feat and requires a well-functioning board and senior management team that retain effective oversight of mid-level management across the whole organisation. Forging a pervasive group-wide culture and a set of core values is thus the necessary first step towards creating a healthy purposeful culture.
In addition, the FCA highlights the importance of psychological safety to speak up and challenge accepted norms 81 and the role of diversity and inclusion in providing effective challenge and promoting a truly safe culture. 82 But how far does the reach of a healthy, purposeful culture go? Does it require firms to demonstrate a broader social purpose, for instance, (2020) available at https://www.fca.org.uk/news/speeches/regulatory-perspective-drivers-culture-androle-purpose-and-governance 78 By 'tone from above' we mean the signals being sent by an employee's manager or supervisor. with consideration of environmental, social and governance factors? 83 The FCA's vision of purpose is, for the time being, modestly designed to fit within its operational objective of consumer protection. It, accordingly, recognises the inherent social value of firms in providing financial services and achieving positive outcomes for customers and markets. 84 Finally, a healthy purposeful culture is characterised by effective governance at the board and senior management levels as well as at the broader set of processes, systems and controls according to which decisions are being made and assessed. 85 Performance-based remuneration that rewards purely financial performance can lead to a misalignment of incentives between senior management and regulators, as excessive focus on financial performance risks undermining healthy internal culture. Motivation through remuneration design which goes beyond financial performance, such as, moving recognition programmes away from purely financial metrics to customer satisfaction metrics, and incorporating team incentives in addition to individual incentives, 86 can be powerful drivers of a healthy purposeful culture. As far as bank senior executives are concerned, regulatory rules require that variable remuneration is determined by reference to a balanced set of financial and non-financial performance criteria, the latter including capital strength, liquidity, bad loans, customer satisfaction, compliance, risk management, corporate reputation, and strategy development. 87 Having canvassed regulatory discourse on the concept of purposeful culture, it is evident that regulatory guidance focuses on the contours of culture and on locating responsibility for its development rather than on the substantive content of purposeful culture. This is not necessarily a defect, as a one-size-fits-all approach can be counterproductive in view of the great diversity of financial firms and the value of heterogeneity as a contributor to resilience and systemic stability. 88 In other words, excessive granularity in the regulatory conceptualisation of purposeful culture would risk driving a uniform approach to culture being adopted by firms. This would reduce the resilience of the financial ecosystem due to increased vulnerabilities flowing from universal susceptibility to the same risk factors and would 83 It may be argued that a stakeholder conception of purpose would improve the ability of financial firms to deliver beneficial outcomes for society both in terms of treating customers fairly and financial stability. 84  efficiently prevent firms from adopting the right approach that fits their idiosyncratic characteristics such as size, type(s) of business, geographical scope, stage of maturity of the firm, public listed company status or not and personal dynamics of leadership. Indeed, a variety of different internal cultures may satisfy the vision of a purposeful culture from a regulatory viewpoint and the choice between them should be taken at firm level. Such cultures may differ along one or more of the following axes: hierarchical vs egalitarian, formal vs informal, innovative/dynamic vs conservative/cautious. Further, it is worth noting that firm culture is not something that can be deliberately designed by leadership to a full extent. Although leadership plays the greatest role in shaping culture, organisational culture constitutes a type of an organic spontaneous order in the Hayekian sense. 89 No single person in a firm can ever be fully aware of all aspects of its culture neither fully control its development. However, despite the value of fostering diversity in financial firms' culture, the concept of purposeful culture needs to acquire some minimum substantive content to avoid being relegated to a vacuous buzzword. The preceding analysis suggests that to achieve purposeful culture firms must ensure that the values that form the core of their culture are compatible with the core regulatory objectives of consumer protection (FCA) and financial stability (PRA). From the perspective of firms, these objectives imply that fair treatment of customers and prudential management must constitute core values, although not necessarily their only core values. It goes without saying that prudential management is not equally applicable to all firms but primarily to those supervised by the PRA and depending on their systemic significance, while fair treatment of customers is applicable to all financial firms. Apart from values, purposeful culture seems to necessitate a minimum of fair processes in firms' governance and day to day management. Such procedural fairness encompasses transparency, two-way feedback, respect of equality and diversity, and accountability mechanisms, many of which (for instance, internal audit and compliance function) are in any case mandated under other parts of the regulatory framework. Fair processes and open channels of communication can also foster a relationship of trust and mutual respect between firm leadership and personnel thus preventing excessive worker turnover and enhancing the motivation of workers and their integration into the firm's culture. Beyond core value compatibility and internal procedural fairness, purposeful culture is a broad concept that can accommodate a plethora of approaches and should not inadvertently lead to formalisation of culture or demonisation of hierarchies, risks to which we will return in Section V. IV. Links and intersections between the SMCR and firm culture Even a cursory view of the FCA and PRA policy documents reveals that the complex relationship between the SMCR and culture is not fully explored. In this section, we dissect the key aspects of the relationship between the implementation of SMCR as a regulatory regime and the evolution of firm culture in financial services. In particular, drawing from both general literature on firm culture and specific literature on bank culture, we shed light on the potential positive impact that this interplay may have on organisational culture in finance and its contribution to achieving the consumer protection objective of the FCA, and the financial stability objective of the PRA. 90 The most visible connection between the SMCR and culture is that the former can act as a catalyst for driving cultural change and, in turn, healthier conduct and risk management within financial firms. The Financial Stability Board lists 'senior leadership of the firm who articulate a clear cultural vision' as a tool to mitigating cultural drivers of misconduct. 91 In the UK, the FCA views the SMCR as a mechanism that will create 'a sense of shared values and empower individuals at all levels in the organisation to speak up and challenge issues that arise in their firms'. 92 To achieve that, the SMCR includes a prescribed responsibility for overseeing the implementation of values consistent with the firm's culture in day-to-day management, and a prescribed responsibility for leading the development of the firm's culture by the governing body as a whole. 93 Most importantly, in this sphere, theory and practice seem to largely converge. There is already evidence to suggest that the SMCR has had a meaningful and tangible positive impact on ' … the level of detail, clarity and quality of conversations on culture and expected behaviours'. However, the most significant shortcoming of good culture as a distinct regulatory outcome is that it is not amenable to measurement or even to reliable qualitative assessment by those external to the organisation. It has been suggested that 'culture is difficult to assess because it is not a single, point-in-time metric, but a multi-dimensional concept with different implications for different parts of an organisation'. 95 The FCA acknowledges this difficulty in measuring culture and rather than attempting to assess mindsets and behaviours directly, its focus is shifted to assessing the main cultural drivers: 'a firm's purpose, leadership, approach to rewarding and managing people, and governance arrangements'. 96 The SMCR can, therefore, act as a mechanism for observing the most exposed layer in Schein's model that relates to behaviours within a firm 97 and provide a benchmark for measuring a proxy for good organisational culture.
More specifically, the FCA and PRA can draw inferences from tangible indicators of misconduct (for instance, the number and severity of regulatory misconduct cases and disciplinary actions) on failures in culture within firms. 98 Once an incident of misconduct has taken place, detailed investigation of the organisational culture of the relevant firm can elucidate the characteristics that were conducive to the failure and perhaps provide valuable insights for the industry more generally. Nonetheless, this approach may not assist supervisors in identifying firms with poor culture before a regulatory failure has occurred. From an ex-ante perspective, supervisors can assess various internal documents created by regulated firms, such as, value statements and compliance manuals, conduct staff surveys and other innovative unobtrusive analysis tools. 99  crisis and that both inherently unique and universal drivers of good culture are identified. 100 Furthermore, conceptually framing the SMCR as an integral part of the framework of organisational culture can have a desirable effect on the manner in which the FCA and PRA implement the regime by enabling them to move away 'from basic rules-based compliance towards embedding the regime in the organisation'. 101 It may also encourage a pre-emptive regulatory focus that promotes transparency, exchange of information and collaboration between authorities and firms. Most importantly, moving away from deterrence towards a deliberative process can enable an organic transformation towards a healthier culture. Indeed, this supervisory direction is reflected in the FCA's preventive approach to compliance and enforcement of the SMCR. 102 In this sense, conceptualising the SMCR as part of the broader drivers of organisational culture is consistent with a reflexive, processoriented, meta-regulatory approach. Such an approach is likely to be more effective than both 'command and control' and outcomes-oriented regulation in circumstances where the desired outcome of processes is not visible to the regulator ex-ante. 103 Meta-regulatory elements of the SMCR include the requirement that firms draw up a statement of responsibilities, and conduct annual assessments, as these rules require firms to adopt and develop their own policies and monitor their implementation in accordance with general principles laid down by the legislation. 104 A further benefit of the SMCR is that it has the potential to accelerate the emerging trend of professionalisation of senior management functions in the financial services and to the ensuing generation of distinct professional cultures for each of the emerging professions, such as of a banker, compliance officer, and risk manager. 105 In the strictest possible sense, a profession is an occupation that requires special knowledge and skills, has a public interest orientation and is trusted by society as suchand may be regulated by a distinct professional body. 106 The professional body, qualifying membership of which may be obligatory for any person to practise the profession, provides formal training and accreditation, articulates ethical standards, and disciplines its members. 107 Thus, a common professional culture develops over time on the basis of shared values. 108 The SMCR emphasises the special knowledge and skill required by individuals who perform senior management functions and indirectly encourages the development of professional bodies and training programmes for executives in financial services. Indeed, interviews held as part of supervisory scrutiny of new appointees tend to focus on knowledge of the firm, the legal and regulatory framework, and the role the appointee will be performing, 109 thus highlighting the importance of specialist knowledge. This trend is supported by the renewed vigour of the Chartered Banker Institute, which since 2010 encompasses the Chartered Banker Professional Standards Board, that promulgates ethical guidelines for bankers. The Charter Banker Institute currently offers a range of awards and diplomas both general (e.g. the Chartered Banker qualification) and specialist (e.g. on digital leadership, sustainable finance, risk management, commercial lending). 110  services is unlikely to take place in the foreseeable future, but control functions such as compliance, risk management and internal audit are witnessing the greater degree of professionalisation, which is likely to enhance their operational independence from business units within firms. 111 Moreover, acknowledging the interdependence between organisational culture and the SMCR can facilitate the expansion of the ambit of supervision beyond the conventional domain of conduct of business and prudential management. For instance, triggered by serious allegations of a sexual harassment culture in Lloyds of London, the FCA has expanded, in recent years, the scope of its misconduct supervision to issues concerning lack of diversity and inclusion, and other types of non-financial misconduct, including discrimination, harassment, victimisation and bullying. 112 As a result, in assessing whether individuals are 'fit and proper' for the purposes of the SMCR, the FCA now considers 'a broader, cultural set of values'. 113 Values such as equality and diversity are crucial elements of organisational culture and can play a vital role in the prevention of malpractice, as firms with diverse workforces and management teams where every member feels safe to raise concerns are considerably less prone to groupthink 114 and more likely to engage openly with regulators. Culture can, therefore, be used as a supervisory tool for expanding the scope of supervision to encompass non-financial areas and thus, remove substantive obstacles to healthy cultures in firms. Still, such an approach can also engender perils as will be explained in the following section.

V. Potential challenges and unintended consequences
Building on the understanding of organisational culture in general, bank culture in particular, and the regulatory vision for purposeful culture that has been achieved in the previous sections, this section reviews the experience of SMCR regulatory enforcement practice to shed light on potential challenges. The use of theoretical insights drawn from the disciplines of sociology and organisational studies enables us to frame and interpret tentative findings on enforcement practice which is particularly crucial in view of the limited number of enforcement actions and of the key objective of the present study which is a normative assessment of SMCR.
Despite the several benefits that the SMCR is likely to give rise to, we argue that the SMCR could lead to unintended (and unwarranted) consequences and hinder the effective fulfilment of the FCA's consumer protection objective and the PRA's financial stability objective, in line with the broader limitations of the UK financial regulatory regime. In particular, there is a risk that the SMCR will fail to achieve meaningful change in firm culture, and that the incompatible pre-existing culture will limit the regime's effectiveness. It is striking that there has been very little enforcement activity by the FCA and PRA under the SMCR. Between March 2016 and September 2020 there were only 34 investigations, 23 of which led to enforcement action. Enforcement action has been, in most cases, in the form of prohibition from acting as senior manager in the regulated sectors, with only one case having led to the imposition of a financial penalty upon a senior manager (James Staley, the CEO of Barclays) in 2018. 115 The scarcity of enforcement has prompted commentators to doubt the efficacy of the SMCR, 116 especially as one of the main objectives of replacing the Approved Persons Regime with SMCR was to increase enforcement which was relatively rare under the Approved Persons Regime. 117 A. The SMCR can potentially narrow down the scope of culture and its connection to business ethics A common feature of enforcement cases to date is that they have been grounded upon direct personal misconduct on behalf the senior managers, either in their professional capacity or in their personal capacity, and not upon failure to manage others and prevent misconduct of others which is the key element of the SMCR. For instance, James Staley was fined because of his own failure to comply with Barclay's whistleblowing processes upon receipt of a letter which raised issues implicating himself. 118 Further, and in connection to the regulatory initiative to improve culture in financial firms, cases of enforcement against non-financial misconduct permit no more optimism. In theory, regulatory enforcement under the SMCR for non-financial misconduct could provide a powerful tool to intervene and sanction managerial failure to contribute towards a healthy internal culture, for instance, where there is evidence of a culture of harassment, excessive risk-taking or malpractice towards customers. 119 In reality, however, the very few nonfinancial misconduct enforcement cases to date 120 revolve around criminal conduct outside the workplace that bears to direct relevance to the successful or not performance by senior managers of their function as influencers of internal culture. For instance, Jon Frensham was deemed to be unfit to perform regulated functions due to his conviction for attempting to meet a child following sexual grooming, 121 while Mark Horsey was deemed unfit subsequent to a conviction for voyeurism against his tenant. 122 It is not within the scope of our study to address the proper meaning of terms such as honesty and integrity and the extent to which behaviour in one's private life should be taken into account when making such assessments in a professional context. 123 However, exclusive regulatory focus on cases of misconduct that are based on specific breaches of regulatory rules or criminal conduct in senior mangers' personal life risks impoverishing the conception of senior managers' role in fostering a purposeful culture and limiting to the absence of direct misconduct. The Banking Standards Board's CEO, Alison Cottrell, succinctly observed that 'good culture means more than ensuring that good people don't do bad thingsit is about enabling good people to do even better things'. 124 Equating good culture with compliance with the SMCR could, in turn, lead to a narrow regulatory regime that focuses on a low rate of conduct breaches as the main evidentiary tool. Therefore, while the interlinks between culture and (mis)conduct are a useful supervisory tool, it is vital to clarify the differentiation between SMCR compliance and building a purposeful culture framework to ensure that, although the former is seen as part of the latter, they are not conceptually merged, and sound culture is not perceived merely as compliance. This approach would promote a higher benchmark of culture for firms to aspire to, 125 and mitigate the tendency for defensive or excessive compliance, including exaggerated focus on recording evidence of decisions and actions. 126 Maintaining the crucial differentiation between regulatory compliance and aspirational internal governance arrangements is a hard task that requires delicate calibration of regulatory discourse as well as active engagement of financial firm stakeholders, such as investors interested in ESG performance, workers and customers. 127

B. The SMCR may encourage an inappropriate culture
At the same time, a possible future turn to excessive enforcement could also be counterproductive and the scarcity of enforcement action so far is not incompatible with fear of rigid enforcement on behalf of firms and senior management and consequent attempts to pre-empt enforcement action. Culture is dynamic 128 and is likely to be shifting incrementally in response to the implementation and enforcement of the SMCR. Supervisors must, therefore, be cognisant of the risk that the SMCR may be instilling a 'fearbased' culture, 129 where employees fear to raise concerns, or admit mistakes. The emphasis that the regime places on individual accountability and liability for senior managers is likely to motivate senior managers to take steps to minimise their liability risk. Such steps may include senior managers signalling to their subordinates that mistakes will not be tolerated and that any problems arising should be concealed rather than reported. Although such behaviour, if eventually caught, would lead to harsher consequences for the relevant senior managers, they would still be incentivised to pursue it in circumstances where the chances of effectively concealing the wrongdoing are high. It follows that if the SMCR is perceived by senior managers as a draconian measure, which will lead to the practical obliteration of a manager's career in every case that there is a failure in their area of responsibility, they will do everything in their power to conceal failures. At the same time, they may still not do everything in their power to prevent failures if the risk of such failures occurring and being detected is low compared to the benefit of the relevant risk-taking (e.g. in terms of higher remuneration and career advancement) and, in any case, they will often be unable to prevent failures entirely, as they do not command full control of the necessary resources. If this account is realistic, one would expect to see a continuation of risky but lucrative behaviour combined with heavy-handed attempts to hide problems and failures when they arise. Such an approach could exacerbate the risk of serious misconduct, as it would prevent firms from learning from their own mistakes and experimenting with different models. This is far from being a theoretical concern. Recent evidence suggests that fear of the negative consequences of raising concerns is prevalent and impedes speaking up, 130 and that the SMCR is contributing to a risk-averse working environment that may stifle innovation? 131 While the legislators' intention may not have been aimed at changing firms' risk appetite per se evidence is already emerging that 'processes and controls on approvals of new products and businesses have been tightened'. 132 We will suggest in Section VI that to avoid a culture of fear the FCA and PRA should establish constant channels of dialogue and collaboration with the industry.
More broadly, external rules and regulations can shift firms' focus away from inculcating healthy organisational cultures via strengthening moral commitment and ethical behaviour and instead, encourage a box-ticking approach of perfunctory compliance. 133 Advice given from accounting and consultancy firms, such as Grant Thornton to financial firms confirms the risk of defensive compliance activity that is likely to be costly for firms while having little to no effect on the quality of their culture. 134 Excessive reliance on information collection processes and quantification of data which permits the use of analytics and visualisation runs the risk of developing elaborate processes that result in seemingly sophisticated figures and graphs while bearing little relation to actual changes in internal culture. This is not to deny the importance for senior management of having access to crucial information to permit them monitor and assess the evolution of certain aspects of culture in their firms. Such data may include statistics on employee turnover, employee and customer satisfaction surveys, statistics on complaints raised internally and externally, and metrics relevant to the external reputation of the firm. However, ultimately, strategic leadership on matters of culture must remain based on the making of qualitative assessments and the exercise of judgement and discretion must not be avoided through the use of metrics, the detrimental consequences of which in the years leading up to the 2007-09 global financial crisis 135 hardly needing reminding.
In parallel, the SMCR may result in unwarranted changes in decisionmaking processes that shape firm culture. A heightened expectation of personal accountability, if not balanced, may result in adverse selection. If the SMCR is perceived by potential candidates for senior management roles as imposing a (too) high risk of liability it might deter prudent and risk-averse individuals from assuming certain senior management functions within the financial services sector. At the same time, less prudent and more riskseeking individuals will not be deterred, and the outcome may be that these individuals will eventually dominate senior management functions contrary to the objectives of the SMCR. Similarly, the SMCR may foster an approach of undue conservativism by firms that may seek to appoint to senior management functions individuals that look good on paper and are highly likely to be approved by the PRA/FCA rather than the individuals that the firm believes will be the best at the job. Taking a 'better be safe than sorry' approach can reduce the substantive quality of senior personnel, and perhaps make it harder to appoint senior managers with diverse career tracks and experiences, thus reinforcing existing conscious and unconscious biases, reducing diversity, and compounding the problems of homogeneity and groupthink. 136 It follows that the unintended consequence of adverse selection risks disrupting the ongoing beneficial evolution of bank corporate culture towards greater diversity and inclusion. A further concern with the type of culture that the SMCR is prone to give rise to is the risk that it will obfuscate the collective responsibility of the board of directors and exacerbate the already existing culture of viewing individual senior managers as charismatic heroic figures that drive value creation through exceptional talent and genius, and should thus remain unchallenged by colleagues and regulators alike. Collective responsibility of the board for strategic management and oversight is an essential feature of good corporate governance 137 that emphasises the role of independent directors, and of the board as a locus of effective strategic leadership and not merely as an advisory forum or monitoring mechanism. 138 Unbridled charismatic CEOs are generally connected with excessive risktaking and sharp business strategies that are prone to lead to misconduct. 139 This is exactly the reason why the SMCR expanded senior managers' ex-post external accountability and liability risk. However, in highlighting individual responsibility and leadership, the regime risks undermining the culture of collective board decision-making and the role of independent directors thus, inadvertently, weakening the ex-ante internal accountability of CEOs and disrupting the inculcation of a sound culture of robust scrutiny and constructive criticism at board level.
Furthermore, an unbalanced shift from collective accountability to individual accountability may also create a problem of individuals as scapegoats, which may lead to an individual taking the full blame in case of misconduct thus absolving board members of their monitoring role. Such risks should not be underestimated, as they could be driven by a supervisory approach to enforcement that puts individual accountability on the pinnacle of its 136 Though the FCA supervisory approach will affect the severity of this risk. See Treasury Committee, Oral evidence: Appointment of Nikhil Rathi as Chief Executive of the FCA, HC 622, 22 July 2020 available at https://committees.parliament.uk/oralevidence/746/pdf/, Q25: 'The FCA has a role to support a more diverse financial services sector, … if we are not seeing that progress happening, then at some point it becomes a supervisory matter, and it may even become a matter that we would need to deal with in how we decide whether to approve an appointment or not'. 137 Financial Reporting Council, 'The UK Corporate Governance Code' (2018) Introduction: 'The principle of collective responsibility within a unitary board has been a success andalongside the stewardship activities of investorsplayed a vital role in delivering high standards of governance and encouraging long-term investment'. See also PRA, 'Corporate Governance: Board Responsibilities' (July 2018) available at https://www.bankofengland.co.uk/prudential-regulation/publication/2016/corporate-gover nance-board-responsibilities-ss. 138 It has been suggested that there is a perceived risk 'that the line between a non-executive and executive could become blurred as Board members become more involved in operations of the business'. See FCA, 'SMCR Stocktake Report'. In addition, the SMCR may upset the internal management hierarchy in large financial firms that operate complex group structures across multiple jurisdictions and business lines. priorities. 140 Indeed, evidence suggests that the FCA is steadily increasing enforcement against individuals rather than firms, 141 which will prompt firms to adapt their governance processes accordingly, with ensuing longterm negative effects on organisational culture.
C. Firm pre-existing culture may undermine the effectiveness of the SMCR The SMCR is not only one of the current drivers of transformation of culture within financial firms, but also an externally imposed regulatory regime the implementation of which is inevitably affected by pre-existing cultures within financial firms. As discussed above, organisational culture literature reveals that when faced with externally imposed changes members of organisations tend to resist and find ways to implement changes in manners that are consistent with their core values. 142 In large financial firms, pre-existing culture is likely to be fragmented and underlying core values in the financial sector are likely to be in line with rewarding individual financial success on a short-term basis. 143 Therefore, the typical large financial firm could be described as having a decentralised culture where each business division has considerable autonomy with short-term profit-seeking and business expansion being the common features across divisions.
To be sure, this portrayal is inevitably a generalisation, but it is interesting to examine how such culture is likely to affect the implementation of the SMCR. Compared to the previous status quo, the SMCR seeks to change culture towards a centralised model and shift attitude to risk from positive to cautious. As such changes are sharp, they are likely to be resisted by those who perceive them as leading to a reduction in their power, such as divisional senior managers in highly risky and highly autonomous units. Investment banking would be a prominent example. Whether this resistance will be successful in neutralising the intended effect of the regime, or will eventually cede to continuing external pressure by the regulators, remains to be seen. The Covid-19 crisis may provide an opportunity to tip the balance towards the latter. The pandemic has created a dispersed working environment, impeding the ability of staff to maintain informal interaction. In such an environment, an organisational culture which is 'moulded and handed down through generations' may dissolve, opening the door to a new healthier culture. 144 VI. How a judicious implementation of the SMCR can improve firm culture and the importance of professionalisation This section provides a set of balanced and workable proposals addressed to the FCA and PRA regarding the optimal regulatory approach to SMCR implementation, and possible ways for regulators to contribute to the inculcation of a healthy culture in the financial services sector. We argue that even though there are localised challenges in the implementation of the SMCR, 145 it is, broadly speaking, a proportionate and balanced statutory framework. It is proportionatesince it is comprised of a tailored framework which is suited to the size of the firms (consisting of three layers including limited scope, core and enhanced), 146 and it is balancedgiven the eventual rejection of the initially proposed reversed burden of proof in the key individual liability provision in section 66A(5) of FSMA. 147 Our recommendations, therefore, largely fall within the realm of the supervisory approach and the tools used to monitor and enforce the regime rather than in relation to the statutory framework. The recommendations run through all the supervisory phases beginning with providing guidance on supervisory expectations, through ongoing supervision and the two-way dialogue between the FCA/PRA and the industry, and ending with enforcement. In all stages, the FCA and PRA should cooperate closely where jointly supervised firms are concerned. The two authorities should be ready to share information and take a holistic view of prospective senior managers' suitability and of the severity of any breaches. It emerges from our analysis that it is vital for the FCA and PRA to clarify the differentiation between mere compliance and development of sound culture and provide more concrete and detailed guidance on the drivers of purposeful culture. This will ensure that the scope of the SMCR is, on the one hand, sufficiently broad to include misconduct in non-financial issues and, on the other hand, not too granular to result in a compliance-driven exercise by individuals and firms. While it is acknowledged that there is merit in maintaining a certain degree of constructive ambiguity as a deterrence tool to ensure a good degree of accountability, the guidance should also include risk-based guiding criteria, for instance, on the conduct of fit and proper interviews and on the composition of interview panels. 148 Our argument regarding the necessity of more detailed guidance on the SMCR is supported by the fact that elements of a move towards this direction are already clearly discernible in the recent FCA consultation for a new consumer duty, as the approach of the FCA is sensitive to firm culture and provides concrete examples of desirable and undesirable approaches to customer management. 149 The tools used to assess and monitor compliance are crucial in enhancing the effectiveness of the SMCR. In line with their overall supervisory approach, the FCA and PRA should stir away from taking an objective knowledge testing approach in interviews and focus on a substantive, judgment-based approach. Evidence from publicly available guidance prepared by law firms to assist senior managers succeed in their interviews suggests that the current approach taken by the authorities consists of asking questions that test the objective knowledge of the interviewee on matters including the business strategy of the firm and the risks it faces, the specific duties attached to the role they will undertake, the regulatory framework applicable to the firm and to Senior Management Function, and general knowledge of the relevant market, as well as competence in risk management, financial analysis and internal controls. 150 We acknowledge that assessing these types of fundamental knowledge is necessary but we argue that testing knowledge is not sufficient to enable the authority make its assessment of the fitness and propriety of candidates and therefore that interviews should go beyond that. To economise on scarce regulatory resources, assessing knowledge can be achieved through objective close-ended questions e.g. on the prospective 148 Currently, there are very broad-brush indicators on the FCA website that: 'The composition of the interview panel will be determined by the firm type and role, and will usually include representatives from Authorisations and Supervisions, as well as a senior adviser'. And that: 'If we and the PRA request an interview, we will try to coordinate a single, joint interviewhowever both organisations can hold interviews on their own, as long as the other party is informed and satisfied'. 149  senior managers' role, the business, and the applicable legal and regulatory framework, which can be part of a written examination to be completed before the interview process, as a pre-condition for approval. This approach would enable interviews to focus on the values, leadership style and ethics of candidates, features that will determine the quality of their contribution to the organisational culture of the firm, and would permit the authorities to assess their ability to speak up and challenge firm processes and decisions and assess risks in a holistic manner. To achieve this, a range of techniques can be used beyond simple questions, including for instance, practical scenarios and group exercises. Such a substantive approach to interviews requiring regulators to make subjective judgments would ensure that interviews do not become a predictable exercise and that candidates' leadership style and modus operandi as part of collective decision-making processes is meaningfully assessed. A judgment-based approach in interviews would prevent an unwarranted light-touch approach but it would also inevitably broaden the discretion of the FCA and PRA. Accordingly, three key observations can be drawn. First, the interview process, which is rather an intrusive type of supervision, must be supported by solid accountability mechanisms. Indeed, where an application is refused, the issue can be referred to the Regulatory Transactions Committee and there is a right to make representations to the Regulatory Decisions Committee and, ultimately, the matter can be escalated to the Upper Tribunal. 151 However, certain interpretative difficulties, such as what constitutes reasonable steps that were evident in the previous Approved Persons Regime 152 may still arise under the SMCR. It is, therefore, imperative that the FCA and PRA demonstrably adhere, in the interview process, to standards of fairness and reasonableness. Recent cases that were decided in the Upper Tribunal, concerning enforcement, show that, in practice, this may not always be the case. 153 Second, broad supervisory discretion in the interview stage may necessitate an increased use of external expert input. The approach to interviews and the criteria to conducting them, including external experts' selection and participation, should be consistent across the FCA and the PRA and guided by transparent principles. Transparency could also mitigate the problem of 'revolving doors' between industry and regulators in a non-diverse environment. 154 Furthermore, interviews should form part of a wider set of ongoing supervision tools such as surveys and internal investigations conducted by firms.
Internal investigations, however, should be treated with caution. Firms may be eager to provide regulators findings from internal investigations but the motivation behind these investigations may not coincide with the authorities' objectives. It is likely that firms may be trying to persuade regulators against opening an investigation or attempting to limit its scope. 155 Clearly, there is an inherent conflict of interest where a firm that might subject to liability is also the one that is conducting the investigation. A conflict of interest can also arise between firms and individual senior managers given that an FCA or PRA investigation may proceed against either or both. 156 It comes therefore as no surprise that often these internal reports are viewed by the FCA as 'having limited determinative value'. 157 Still, this statement perhaps goes against the iterative and collaborative supervisory approach that that the FCA should aim for. An integral part of 'purposeful culture' should be to conduct transparent and fair internal investigations and being able to share freely the findings with the regulator. Here, constructive ambiguity as to the supervisory priorities regarding investigative tools would be useful. The FCA/ PRA should welcome any 'inside' information from firms and avoid signals that may discourage firms from engaging in an open and cooperative dialogue with regulators. 158 In the final supervisory phase of enforcement, the FCA and PRA need to achieve a delicate balance. As discussed in Section V. (B.), they should avoid excessive deterrence that might encourage a counterproductive culture of fear and obfuscation by senior personnel, while at the same time should ensure that sufficient enforcement takes place to safeguard the effectiveness of the SMCR. Despite the current scarcity enforcement, the risk of excessive enforcement may rise in the foreseeable future in light of the increasing number of incidences of whistleblowing by mid-level personnel, which can make it impossible for supervisors adequately to investigate each case. 159 Much can be learnt in this context from the excessive production of suspicious activity reports under the anti-money laundering and counter-terrorism financing frameworks which comes at a high cost for firms and the public without necessarily improving the detection of criminal activity. 160 However, regulatory regimes which are underpinned by weak enforcement are likely to lead to endogeneity of standards, potentially making the SMCR resemble other de facto self-regulatory regimes which tend to be ineffective. 161 In that respect, the plan of the FCA to move responsibility for initiating civil and criminal proceedings from the inevitably slower Regulatory Decisions Committee (which includes external parties) to the authority's Authorisations, Supervision and Enforcement Divisions appears to be in the right direction of strengthening the enforcement capacity of the FCA without compromising due process and accountability. 162 This is because all matters relating to the enforcement of the FCA's Principles and Rules for Businesses, including the imposition of financial penalties, would continue to be decided by the Regulatory Decisions Committee and hence the removal of other responsibilities would enable the Committee to be more effective when making decisions in the context of the SMCR.
Furthermore, the internal processes of the FCA and PRA in handling enforcement cases must be adequate and relevant personnel must have the appropriate skills and training. A recent ruling of the Upper Tribunal found that both authorities lack adequate document management processes and concluded that 'the Regulators' conduct has fallen well below the standards which Mr Forsyth [the applicant], the regulated community and public at large, are entitled to expect'. 163 Such failings are not only important in relation to the risks they pose to the rights of regulated firms and individuals and to the effectiveness of enforcement processes but have broader ramifications, as they indicate deficiencies in the authorities' own internal cultures. Given the central role of the authorities as standard setters in the financial services, their own conduct and culture can set a (good or bad) example for regulated firms and, therefore, it is imperative that the FCA and PRA can demonstrate that they themselves have developed a purposeful culture. Beyond effective internal processes purposeful culture should encompass a sound relationship between the personnel and management of the authorities which, at least in the case of the FCA, appears to have been strained in recent times, leading to the resignation of the FCA's Chair, Charles Randell, in October 2021. 164 Moreover, robust enforcement goes beyond enhancing compliance. The industry often extracts from individual cases guidance on what appropriate behaviour and sound culture should look like, learning and adapting accordingly. Perhaps, the key in this context, as elsewhere, lies in taking a judgmentbased approach to deciding the strictness of enforcement measures against each firm or individual. Regulators must holistically assess firms' behaviour, culture and attitude towards regulators. Firms and individuals that take an open cooperative approach 165 of honest dialogue and genuinely strive to comply with the rules but have failed on one occasion due to mistaken judgments or failing to prevent and detect the intentional misconduct of others should prima facie be treated leniently unless gross negligence is involved. On the contrary, firms and individuals that display an embedded culture of superficial compliance with the regulatory framework and take a defensive uncooperative approach in their dealings with regulators, should face strict enforcement action upon any incidence of failure.
In the long-term, the FCA and PRA should work towards fine-tuning the implementation of the SMCR within an evidence-based analytical framework that draws on socio-organisational studies. This will not be the first time in which supervisors call upon external bodies of knowledge to insert content into financial regulation and provide tools and clear benchmarks for its implementation. For instance, the FCA relies on behavioural economics in its conduct regulation in financial markets to understand consumer biases and identify ways to detect and correct market failures in retail financial markets. 166 On that view, the FCA and PRA should commission or at least actively support future academic empirical research investigating organisational culture in the financial sector. The elucidation of the concept of culture in financial firms in this article contributes to setting the agenda for such future research, and to the formulation of appropriate hypotheses and conceptual frameworks. In more practical terms, the FCA and PRA must ensure that when both authorities conduct overlapping investigations and enforcement action there is sufficient coordination to safeguard the fairness and effectiveness of the process and economisation of regulatory resources. This does not appear always to be reflected in current practice, as is evidenced by a recent ruling of the Upper Tribunal which recommended that '[w]here the conduct concerned falls equally within the scope of both Regulators consideration should be given as to whether there should be a single investigation by one of the Regulators and a single regulatory decision'. 167 165 Cooperative compliance which advocates openness and proportionality and close relationship between regulatory authorities and corporations has been adopted by many countries in tax administration. OECD, Beyond supervision and enforcement, to further enhance the current framework, the PRA could require large CRD IV firms to incorporate the inculcation of sound culture as one of the qualitative non-financial performance metrics for executive directors and senior managers, although it is doubtful whether remuneration committees would be able to make such assessments with reasonable accuracy. More broadly, effective supervision of incentives at both senior and middle manager levels can improve financial firm conduct and indirectly contribute towards the inculcation of healthy corporate cultures. This could be achieved by utilising the supervisory tool of 'incentive audits' that would entail scrutinising the pertinent structural, legal, regulatory, and organisational features of regulated firms that affect incentives, including corporate governance, risk management, culture, and the impact of financial innovation. 168 This approach dispenses with reliance on static and reactive regulation which merely tackles misconduct symptoms, thus opening the door for regulatory arbitrage and raising the need for frequent re-regulation. 169 Introducing incentive audits would address the underlying misalignment of incentives and strengthen the regulatory framework of the SMCR.
Finally, it is necessary to acknowledge the limitations of regulatory action in matters such as culture. Inevitably, regulators must chart a mid-way between excessive granularity and over-enforcement on the one hand and counterproductive ambiguity and weak enforcement on the other. If it is kept in mind that the internal culture of each firm represents a grown order which even the firm's senior management cannot fully understand let alone control, it becomes evident that regulators cannot realistically expect to fully understand or control firm culture either. Beyond the direct reach of regulators, the gradual professionalisation of certain key functions within the financial services industry 170 can lead to the growth of distinct professional cultures across different firms (e.g. of compliance officers, risk managers, internal auditors, retail customer managers etc.). Such cultures would intersect with firm culture and could mediate the gap between firm culture and regulatory expectations. In the best case, their development would instil values that are compatible with regulatory objectives and the public interest in the minds of the members of these professions thus increasing the chances that they would resist perverse pressures from management and temptations. A clear professional identity can lead to the achievement of greater professional autonomy of a certain individual thus insulating 168 170 On this, see Section IV. Evidently, solicitors and chartered accountants employed by financial firms already bring with them their own professional culture which intersects with firm culture.
them from pressures and enabling them to have an impactful role in shaping the culture of the organisation to which they belong. While such professional cultures can only grow organically, the FCA and PRA can nurture and accelerate their development by supporting the work of relevant professional bodies and, in the medium to long-term, considering requiring membership of an appropriate professional organisation as a necessary qualification for individuals to be appointed to certain management functions, at least in firms of certain size and complexity. Regulators should also develop and maintain a close dialogue with relevant professional bodies recognising their unique role as a key mediator between public authorities and individual personnel and the promise they bear with regard to contributing towards the growth of purposeful culture in financial services firms.

VII. Conclusions
Our analysis has demonstrated that organisational culture is a valuable lens though which to examine and assess the impact of the SMCR and its potential to contribute to the achievement of the customer protection and financial stability objectives of the FCA and PRA. While the SMCR can assist in discerning tangible aspects of artefacts and behaviours that constitute the external layer of good culture, there is a risk of undue focus on compliance and avoidance of enforcement action. This could lead to taking an unambitious tickbox approach to culture, reliant on quantitative metrics of doubtful value or, worse, to the development of a defensive culture of secrecy for senior staff, coupled with excessive whistleblowing by other staff. The tendency of regulatory enforcement to focus exclusively on senior managers' individual breach of laws and regulatory rules either on the job or in their private life does not bring to fruition the promise of the SMCR and neglects the key role of senior managers in contributing to a sound culture in their firms. This is perhaps unsurprising in light of broader limitations of financial regulatory capitalism in the UK.
To optimise the beneficial effects of the SMCR on culture and mitigate the aforementioned risks of adverse effects, we have highlighted the benefit of more direct alignment between inculcating a sound culture and variable remuneration for senior managers and have put forward a range of suggestions for the enhancement of the supervisory approach at the interview stage, during ongoing supervision, and in the context of enforcement. In particular, we have proposed a judgment-based approach to the conduct of regulatory interviews and a careful calibration of the approach the authorities take regarding the findings of internal investigations by firms as part of ongoing supervision. We have also stressed the importance of flexibility and taking a holistic approach to enforcement that differentiates between honest firms that have established a frank dialogue with the regulators, on the one hand, and firms that seek to minimise substantive compliance and take a defensive stance on the other. Further, and in view of the inevitable trade-offs between too much and too little enforcement and discretionary power on the part of regulators, we have emphasised the potential role of professional bodies to complement regulatory efforts in the endeavour of improving culture in the financial services as the latter could contribute toward the growth of distinct professional cultures amongst financial services personnel which could ultimately lead to a beneficial reconfiguration of firm culture. We submit that the renewed focus of the FCA on consumer protection, as evidenced by its new Consumer Duty initiativealongside the growing public opinion pressures for more socially facing financial regulationprovide an opportune moment for the consideration of the reform agenda put forward in this article. Dr Kokkinis joined Birmingham Law School in 2020. Before that, he was Associate Professor at Warwick Law School which he joined in 2013. He has also taught at UCL, the University of Kent and Buckingham University. He holds a PhD from University College London (2014), an LLM from the London School of Economics (2009) and an LLB from the National University of Athens (2008). He has published widely in the areas of corporate governance, bank corporate governance and financial regulation, and engages regularly with policymakers and the media. His work has been published in prestigious peer-reviewed journals, such as the Journal of Corporate Law Studies and the Journal of Financial Regulation. His research has attracted British Academy funding and has been impactful in terms of influencing a Greek Act of Parliament on the corporate governance of listed companies, a prominent US shareholder advocate, a UK ethical investment firm, and a leading independent proxy voting agency.