Guidance Note: Remediation Action Plans

Summary

This JFSC guidance note explains what the Commission expects to see in a remediation action plan prepared by a registered person after an Examination (or other regulatory finding) identifies deficiencies. It is not itself a binding rule but sets out good practice for resourcing, structuring, and monitoring remediation, and for demonstrating to the JFSC that the underlying problems have been fixed sustainably.

• Who it covers: Persons registered or holding a permit under the Collective Investment Funds (Jersey) Law 1988, the Banking Business (Jersey) Law 1991, the Insurance Business (Jersey) Law 1996, the Financial Services (Jersey) Law 1998, and persons supervised by the JFSC for AML/CFT/CPF Codes of Practice compliance under the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008.
• Resourcing: Registered persons should assess dependencies on key staff, potential conflicts with existing duties, need for additional or external resource, and budget impact before starting remediation.
• Plan preparation: Plans should be built on a project framework, include root cause analysis, assess whether findings indicate wider systemic issues, and be disclosed to the JFSC if systemic issues are found.
• Plan format and content: Good plans use a structured format (e.g. spreadsheet), link each action clearly to a finding and root cause, segregate and reference actions individually, assign realistic timeframes and a risk based order, name an accountable lead for each action, and define expected evidence of completion.
• Recommended data fields: Finding reference, finding description, action reference number, action details, action lead, start date, due date, action status, evidence, and date approved.
• Post remediation monitoring: Senior management should confirm actions are operating as intended, have the remediation lead provide an attestation to the JFSC on completion, and allow a period of business as usual before assessing effectiveness and sustainability.

The JFSC will assess whether proposed timeframes are reasonable given the seriousness of findings and has a low tolerance for plans running beyond 12 months, though it acknowledges some plans may need longer. If post remediation testing shows remediation was ineffective or unsustainable, the JFSC may escalate to Enforcement or impose safeguarding directions.

Key obligations

• Submit the remediation action plan to the JFSC for its consideration of whether proposed timeframes are reasonable
• Ensure senior management, particularly the board of directors, is responsible for designing, implementing and completing the plan
• Commence remediation and implement measures to address serious control weaknesses as soon as practicable, with a low tolerance for plans extending beyond 12 months
• Disclose to the JFSC where deficiencies are found to be indicative of wider systemic issues
• Ensure the plan links each action clearly to a finding and its root cause, with individual references, timeframes, assigned leads and expected evidence
• Arrange for the appointed remediation lead to provide an attestation to the JFSC confirming remediation has been implemented and is operating sustainably
• Allow a minimum of six months of business as usual post remediation before assessing effectiveness and sustainability of the measures implemented
• Determine and apply a method (e.g. reporting professional review, internal audit, or compliance monitoring programme testing) to monitor ongoing effectiveness of remediation

Applies to

registered persons under the Collective Investment Funds (Jersey) Law 1988, registered persons under the Banking Business (Jersey) Law 1991, registered persons under the Insurance Business (Jersey) Law 1996, registered persons under the Financial Services (Jersey) Law 1998, persons supervised by the JFSC under the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008 for AML/CFT/CPF compliance

Deadlines

• 12 months: JFSC guide tolerance limit for the duration of a remediation plan, though longer plans may be accepted in some cases
• six months: Minimum period of business as usual after remediation completion before the JFSC or registered person can assess whether remediation has been effective and sustainable