Regulatory Framework, Legislation and Regulator Rules
How the rule hierarchy works
Regulation is layered. Primary legislation (statutes and statutory instruments) creates the offences and the mandate for the regulator. The regulator's rulebook turns that mandate into binding obligations - authorisation and permitted activities, conduct of business rules, prudential requirements, reporting. Guidance, circulars and Q&A explain how the regulator reads its rules: they are not themselves rules, but departures from them attract scrutiny and must be justified.
Candidates must know the concepts of authorisation and scope of permission (a firm may only carry on the activities for which it is authorised), individual accountability regimes (approved persons, certification, senior managers), client categorisation, market-abuse prohibitions, and the regulator's supervisory and enforcement toolkit (information requests, investigations, fines, censure, prohibition).
Traps that appear in questions
- Treating guidance as a defence. "The FAQ said we could" is not a safe harbour if the rule is breached.
- Assuming a permission covers a related activity. Dealing as principal is not the same permission as dealing as agent.
- Confusing the regulator with the exchange, the central bank or the ombudsman; each has a different remit.
- Forgetting that conduct rules can apply to individuals personally, not just to the firm.
Rule of thumb
Read the verb: if the source says must, shall or is required to, you are in rule territory and the obligation is binding; if it says should, may wish to consider or for example, it is guidance. When two sources conflict, the statute beats the rulebook, and the rulebook beats guidance.
Worked example: A firm holds a permission to arrange deals but its desk starts executing client orders directly. Even with client consent and no loss, the activity sits outside the firm's permission and is a breach - consent cannot expand a regulatory permission.