Legal and Regulatory Obligations in Practice
What this domain tests
This domain tests the day-to-day legal obligations that sit alongside the policy: financial crime, data protection, sanctions and fair treatment of customers. IF2 favours practical scenarios where the wrong action is plausible, so know who to report to and when.
Core obligations in practice
- AML: MLR 2017 require a risk-based approach, customer due diligence, enhanced due diligence for PEPs and high-risk cases, and suspicious activity reports to the National Crime Agency (not the FCA). Tipping off is a criminal offence. Records are kept for five years after the relationship ends.
- Sanctions: OFSI administers UK financial sanctions. Asset freezes apply regardless of intent; screen customers and beneficial owners and report matches.
- Bribery Act 2010: four offences, including failure to prevent bribery, with an adequate procedures defence.
- Data protection: UK GDPR and DPA 2018 require a lawful basis, protection of special category data, and breach notification to the ICO within 72 hours where risk is likely. Subject access requests are normally answered within one month.
- Vulnerable customers: FCA FG21/1 and the Consumer Duty require firms to recognise drivers (health, life events, resilience, capability) and adapt processes.
- Outsourcing: SYSC 8 requires due diligence, contracts and regulator notification for material outsourcing.
Worked example
A broker suspects a client's premium is funded by fraud. The broker must not tip off the client, must submit a SAR to the NCA promptly, and should consider whether to proceed pending any NCA response. Internal escalation and record-keeping are required. Reporting to the FCA instead of the NCA is a common and serious error.
Traps
- Sending SARs to the FCA or PRA rather than the NCA.
- Assuming a sanctions breach needs intent: it is strict liability.
- Confusing the 72-hour ICO breach notification with the shorter incident reporting some regulators expect.
- Treating vulnerable-customer handling as optional good practice rather than a conduct requirement.