Global Securities Operations (Level 3, Unit 3)

Correct: The UK’s ‘Twin Peaks’ model divides responsibilities between the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA). The PRA focuses on the safety and soundness of firms. The FCA focuses on market conduct and consumer protection. Internal audit must ensure that the firm’s reporting controls handle the distinct data requirements of both regulators.

Correct: Under the new UK Listing Rules (UKLR) introduced by the FCA, the requirement for prior shareholder approval for significant transactions (formerly Class 1 transactions) has been removed for companies in the ‘Commercial Companies’ category. The regime now relies on a disclosure-based approach, meaning internal audit must ensure that controls are robust enough to facilitate immediate and accurate announcements to the market via a Regulatory Information Service (RIS) when the 25% threshold is triggered.

Incorrect: The strategy of requiring a mandatory fairness opinion from an external auditor for all 25% transactions is not a requirement under the UKLR, as the role of the sponsor has been modified and the focus is on disclosure rather than third-party validation of price. Focusing only on a three-year look-back for related party transactions misinterprets the ongoing disclosure obligations and the specific thresholds set by the FCA for immediate notification. Choosing to believe there is a five-year listing requirement for significant transactions is incorrect, as the UKLR does not impose such duration-based prohibitions on corporate actions for listed entities.

Takeaway: The UK Listing Rules have shifted from a shareholder-vote model to a disclosure-based model for significant transactions to increase market competitiveness.

Correct: Under the UK Money Laundering Regulations 2017, firms are required to identify the beneficial owner and take reasonable measures to verify their identity. For a body corporate, a beneficial owner is any individual who exercises ultimate control or holds more than 25% of the shares or voting rights, whether held directly or indirectly.

Correct: Under the UK Market Abuse Regulation and the FCA Disclosure Guidance and Transparency Rules, an issuer must inform the public as soon as possible of inside information via a Regulatory Information Service. Delaying disclosure is only permitted if it is not likely to mislead the public, the issuer can ensure confidentiality, and the delay protects a legitimate interest of the issuer.

Correct: The Bank of England is the UK’s resolution authority, responsible for managing the failure of banks to protect financial stability and public funds.

Incorrect: Focusing on the Financial Conduct Authority is incorrect because its role is to regulate market conduct and protect consumers rather than managing systemic bank failures. The strategy of involving the Financial Ombudsman Service is misplaced as that body handles individual consumer complaints against financial firms. Opting for the Financial Services Compensation Scheme is a mistake because it serves as a deposit insurance fund rather than a resolution authority.

Takeaway: The Bank of England acts as the UK’s resolution authority to ensure the orderly failure of financial institutions without systemic disruption.

Correct: Under the PRA Rulebook, banks are required to maintain an Internal Capital Adequacy Assessment Process (ICAAP) that is commensurate with their risk profile. When a bank undergoes significant changes, such as expanding a lending portfolio, it must reassess its capital needs to ensure it continues to meet the Threshold Conditions for safety and soundness required to maintain its banking authorization.

Incorrect: Focusing only on the FCA notification for Part 4A permissions is insufficient because capital adequacy and prudential risks are primarily the remit of the PRA rather than the conduct-focused FCA. The strategy of applying for a new banking license for a specific division is incorrect as licenses are granted to legal entities, and structural changes like ring-fencing involve organizational separation rather than redundant licensing. Relying on a static 4.5% Tier 1 ratio is a regulatory failure because UK banks must also maintain various capital buffers, such as the Capital Conservation Buffer, to remain compliant with the overall capital framework.

Takeaway: Internal auditors must ensure the ICAAP is updated following significant risk profile changes to maintain compliance with PRA Threshold Conditions.

Correct: Under the FCA’s COLL sourcebook for UK UCITS, a fund may invest up to 10% of its assets in transferable securities from a single issuer, provided that the total value of holdings that exceed 5% does not collectively surpass 40% of the fund’s net asset value.

Correct: In the UK regulatory framework, internal audit’s role is to provide independent assurance on the bank’s risk management and governance processes. For capital requirements, this specifically involves auditing the ICAAP to ensure it is robust, reflects the bank’s actual risk profile, uses plausible stress scenarios, and complies with PRA expectations for capital adequacy assessment.

Incorrect: The strategy of calculating specific capital add-ons is a management responsibility within the risk or finance functions, and auditors performing this would compromise their independence. Choosing to approve capital allocation strategies or internal models oversteps the audit mandate, as these are executive management and board-level decisions. Focusing on the primary submission of regulatory reports like COREP misidentifies the auditor’s role, as regulatory reporting is a functional management task rather than an independent assurance activity.

Takeaway: Internal audit must provide independent assurance on the ICAAP’s governance, methodology, and effectiveness rather than performing management’s capital calculation or submission tasks.

Correct: The internal audit function provides independent assurance on the risk management and control environment. In the United Kingdom, this includes verifying that the firm effectively implements the Shariah Supervisory Board’s religious directives.

Correct: Under the Financial Conduct Authority (FCA) Disclosure Guidance and Transparency Rules and the Prospectus Regulation, issuers of Sukuk (classified as Alternative Finance Investment Bonds) must provide transparency regarding Shariah governance. While the FCA does not adjudicate on Shariah law, it requires that the prospectus contains sufficient information about the Shariah advisors and the governance process to allow investors to make an informed assessment of the instrument.

Incorrect: Relying on the Prudential Regulation Authority to issue Shariah-compliance certificates is incorrect as the PRA is a secular regulator and does not provide religious endorsements or certifications. The strategy of registering Shariah Supervisory Board members as Senior Management Functions is a misunderstanding of the Senior Managers and Certification Regime, which applies to individuals performing specific regulated roles rather than external religious advisors. Opting to classify profit payments as interest in the prospectus is inaccurate because the legal definition of Alternative Finance Investment Bonds specifically relies on the payments being derived from asset performance rather than interest.

Takeaway: UK Sukuk regulation emphasizes transparency by requiring issuers to disclose their Shariah governance and advisory framework within the listing prospectus.

Correct: According to the FCA’s COLL sourcebook, if a UK UCITS fund exceeds investment limits for reasons beyond its control, the manager must prioritize the reduction of that exposure. Because the manager is intentionally maintaining the breach for profit, it becomes a deliberate and persistent breach that must be reported to the FCA and corrected immediately to protect unitholders.

Incorrect: Simply disclosing the breach in semi-annual reports is inadequate as the COLL sourcebook requires active rectification as a priority objective. The strategy of increasing leverage to dilute the concentration is a violation of risk management principles and does not resolve the breach of the underlying investment limit. Opting to re-categorize the fund structure is a significant regulatory change that requires prior FCA approval and cannot be used as a retrospective fix for a compliance failure.

Takeaway: UK UCITS managers must prioritize rectifying investment breaches and report persistent or material non-compliance to the FCA.

Correct: Under the Money Laundering Regulations 2017, firms are required to apply Enhanced Due Diligence (EDD) for any business relationship with a person established in a high-risk third country. This process must include obtaining senior management approval for the relationship and conducting thorough checks on the source of wealth and source of funds to mitigate the risk of financial crime.

Correct: Under the UK regulatory framework, specifically the COLL sourcebook and the Financial Services and Markets Act 2000, an authorized retail fund like an OEIC must have an independent depositary. This entity is responsible for the safekeeping of the fund’s assets and provides an essential layer of oversight to protect investors, ensuring the fund is managed in accordance with its instrument of incorporation and regulatory rules.

Incorrect: Focusing on the Prudential Regulation Authority is incorrect because the PRA focuses on the systemic stability of large financial institutions rather than the specific conduct-led authorization of retail investment funds. The strategy of requiring a ten-year tenure for a Senior Management Function holder is not a specific regulatory mandate for fund licensing, as the FCA assesses fitness and propriety on a broader, qualitative basis. Opting to register the prospectus with the London Stock Exchange as a prerequisite for FCA authorization is a misunderstanding of the process, as the FCA is the primary body for fund authorization regardless of whether the fund is eventually listed.

Takeaway: UK retail fund authorization requires the appointment of an independent, FCA-authorized depositary to ensure asset protection and regulatory oversight.

Correct: Performing a root cause analysis allows the auditor to identify why the existing controls failed to trigger a notification, enabling the organization to implement systemic improvements to its governance framework. This approach aligns with the internal auditor’s role in evaluating and improving the effectiveness of risk management and control processes as required by professional standards and UK corporate governance expectations.

Correct: Under the UK Market Abuse Regulation (UK MAR) and the FCA’s Disclosure Guidance and Transparency Rules (DTR), an issuer must inform the public as soon as possible of inside information that directly concerns them. Inside information is specific, non-public information that, if made public, would likely have a significant effect on the price of the company’s securities. Delaying an announcement for marketing alignment does not meet the strict criteria for a legitimate delay of disclosure.

Incorrect: The strategy of aligning regulatory disclosures with marketing events is not a valid legal ground for delaying the release of inside information. Relying on a revenue threshold like 20% to justify withholding information is incorrect, as the test for inside information is whether a reasonable investor would use it to make an investment decision. Opting to notify the Prudential Regulation Authority instead of the public is a procedural error, as the PRA focuses on prudential stability while the FCA oversees market conduct and disclosure via a Regulatory Information Service.

Takeaway: UK-listed entities must disclose price-sensitive inside information to the public as soon as possible to ensure market integrity and transparency.

Correct: Under the UK’s SM&CR framework, specifically the FCA Handbook (SUP 10C.14), the 12-week rule allows a firm to appoint an unapproved individual to cover a Senior Management Function (SMF) in the event of an unforeseen vacancy. This temporary cover is permitted for up to 12 weeks in any consecutive 12-month period without requiring a formal application for approval, provided the individual is fit and proper to perform the role.

Incorrect: The strategy of claiming an immediate breach is incorrect because it ignores the specific regulatory flexibility provided by the FCA for short-term, emergency vacancies. Opting for the reclassification of the role as a ‘Certified Person’ is a misunderstanding of the regime, as SMF roles are distinct and cannot be downgraded to the Certification Regime simply because the appointment is temporary. Choosing to wait until the annual submission of Directory Persons data is inappropriate because significant changes to management responsibilities and Statements of Responsibilities generally require more timely updates to the regulator than an annual cycle.

Takeaway: The UK SM&CR 12-week rule provides temporary flexibility for firms to manage unforeseen Senior Management Function vacancies without immediate regulatory approval.

Correct: Under the FCA’s SYSC rules, firms must have robust governance and risk management frameworks. While firms are free to offer Shariah-compliant products, they must ensure that religious rulings do not lead to a breach of UK statutory law or regulatory requirements. A lack of a conflict-resolution process suggests that the firm might prioritize religious advice over legal obligations, which poses a significant regulatory and conduct risk.

Incorrect: The strategy of seeking PRA approval for Shariah scholars as Senior Management Functions is incorrect because these scholars typically act in an advisory capacity and do not exercise executive control. Choosing to look for a specialized Islamic Finance Oversight Committee at the Bank of England is a mistake as no such regulatory body exists for product-level religious approval in the UK. Focusing on the absence of a Shariah scholar within the internal audit team is not a regulatory requirement, as the auditor’s role is to evaluate the effectiveness of the firm’s control framework rather than performing religious adjudication.

Takeaway: UK firms must ensure Shariah governance is integrated into existing regulatory frameworks and that statutory obligations always take precedence over religious rulings.

Correct: Under the Financial Services and Markets Act 2000 (FSMA), firms are granted Part 4A permissions to carry out specific regulated activities. Discretionary investment management is a distinct regulated activity from providing investment advice. Therefore, a firm must apply for and receive a Variation of Permission (VoP) from the FCA before it can legally perform the new activity. Commencing such activities without the appropriate permission would be a breach of the general prohibition in Section 19 of FSMA.

Incorrect: Simply updating internal documents and waiting for the next RegData return is insufficient because regulatory reporting is a disclosure mechanism rather than a substitute for the formal pre-authorization process. The strategy of relying on turnover thresholds or existing client relationships is legally flawed as FSMA does not provide a de minimis exemption for discretionary management activities. Focusing only on the appointment of a Senior Management Function holder is an incomplete approach because the entity itself must first be authorized for the specific class of business before individuals can be assigned to manage it.

Takeaway: UK firms must obtain a formal Variation of Permission from the FCA before commencing any new regulated activity under FSMA.

Correct: Under the UK Market Abuse Regulation (UK MAR), an issuer may delay the public disclosure of inside information only if immediate disclosure is likely to prejudice its legitimate interests, the delay is not likely to mislead the public, and the issuer can ensure the confidentiality of that information. The internal auditor must verify that these specific conditions were met and that the company maintained a robust internal record of the decision-making process at the time the delay was initiated.

Incorrect: Relying on the Prudential Regulation Authority for disclosure waivers is incorrect because the FCA is the primary regulator for listing and market conduct rules for commercial entities. The strategy of issuing a holding statement within a fixed 24-hour window is not a regulatory requirement under UK MAR, which instead demands disclosure as soon as possible unless specific delay conditions are satisfied. Focusing only on a formal guarantee from legal counsel to the FCA is inappropriate as the regulator does not accept guarantees of ‘no market impact’ as a substitute for timely disclosure or the strict application of delay criteria.

Takeaway: UK-listed firms must disclose inside information immediately unless they can demonstrate and document that specific UK MAR conditions for delay are meted out properly.

Correct: Under US liquidity rules established by the Federal Reserve, Level 2B assets like certain investment-grade corporate bonds are permitted in the HQLA buffer. However, they must be discounted by a 50 percent haircut and are capped at 15 percent of the total HQLA to ensure the buffer remains sufficiently liquid.

Correct: The Investment Company Act of 1940 requires registered funds to place their securities in the custody of a qualified bank, a member of a national securities exchange, or a central depository. This ensures that assets are properly segregated and protected from the operational risks or insolvency of the investment adviser.

Correct: The Dodd-Frank Act prohibits spoofing, which is defined as bidding or offering with the intent to cancel before execution. Internal auditors are responsible for assessing whether the firm’s internal controls and supervisory procedures are designed and operating effectively to prevent such manipulative market practices.

Correct: Under the Securities Exchange Act and the Dodd-Frank Act, spoofing is a prohibited form of market manipulation involving the placement of bids or offers with the intent to cancel them before execution. The internal auditor must investigate the intent behind the cancellations to determine if the activity was meant to deceive other market participants by creating a false impression of market liquidity or supply and demand.

Incorrect: Focusing on the Consolidated Audit Trail addresses reporting obligations but fails to investigate the underlying manipulative behavior of the trading activity itself. Checking capital adequacy ratios relates to prudential requirements under SEC Rule 15c3-1 rather than the specific market conduct risks associated with order placement patterns. Reviewing the Chief Technology Officer’s approval process evaluates internal IT governance but does not provide evidence regarding whether the actual market activity violated anti-manipulation provisions.

Takeaway: Internal auditors must evaluate the intent and impact of trading patterns to identify potential market manipulation like spoofing in US markets.

Correct: Integrating the HR platform with trading systems is a preventative control that uses automation to eliminate human error. This approach ensures that system access is programmatically contingent upon verified registration in the Central Registration Depository, directly addressing the regulatory risk.

Correct: The LCR is a short-term liquidity requirement designed to ensure that a financial institution has enough high-quality liquid assets to survive a significant stress scenario lasting 30 days. This regulation, implemented by US banking agencies, focuses on immediate cash availability rather than long-term solvency or capital levels.

Correct: Under Federal Reserve capital adequacy standards, internal models used to determine risk-weighted assets must be independently validated to ensure the integrity of the Common Equity Tier 1 ratio.

Correct: Internal auditors must evaluate the control framework, including how the firm identifies, monitors, and corrects reporting delays. Under United States regulations, specifically FINRA Rule 6730, complexity does not exempt a firm from the 15-minute reporting requirement. Therefore, assessing supervisory oversight and exception management is critical to ensuring regulatory compliance and identifying systemic operational weaknesses.

Correct: Under the Securities Exchange Act of 1934, entities effecting securities transactions for others must register as broker-dealers. This is mandatory when receiving transaction-based compensation like finders fees. Registration involves the U.S. Securities and Exchange Commission and the Financial Industry Regulatory Authority.

Correct: Under US federal regulations, specifically 12 CFR Part 32, national banks must aggregate loans to separate borrowers if they meet the common enterprise or direct benefit tests. The internal auditor must evaluate these criteria to ensure the bank does not exceed the 15% limit of capital and surplus for a single person or entity group. This ensures that the bank’s risk management framework captures the true economic exposure to a single source of repayment.

Incorrect: Focusing only on the capital adequacy ratio does not address the specific regulatory requirement to limit exposure to a single borrower or group of related borrowers. Relying on financial reporting disclosures under the Securities Exchange Act of 1934 is insufficient because those disclosures serve a different purpose than prudential lending limit compliance. Analyzing interest coverage ratios assesses credit quality but does not verify if the bank is adhering to the legal limits for concentrated exposures.

Takeaway: Internal auditors must verify that aggregation logic for lending limits correctly identifies related counterparties to prevent regulatory violations of OCC limits.

Correct: The CFO serves as a corporate finance contact for the startup entity, which is the actual client in the transaction. VC fund managers are typically classified as Institutional or Accredited Investors under the SFA, which reduces the burden of retail-specific conduct requirements. This distinction ensures that personal conduct of business rules do not apply to the representative of the corporate client.

Incorrect: Treating both the CFO and the VC manager as retail clients fails to recognize the exemptions available for sophisticated market participants under the SFA. The strategy of classifying the CFO as an elective professional client while treating the VC manager as a retail client is incorrect because it misidentifies both parties’ roles. Pursuing a model where the CFO is the primary client ignores the corporate nature of the transaction and the startup’s legal status.

Takeaway: Firms must distinguish between individual corporate representatives and the entities they represent to apply the correct SFA investor classifications.