When is a director personally liable for being 'knowingly concerned' in a company's breaches?

Individuals who have been knowingly concerned in a company's breaches of the law can be subject to significant penalties, in addition to any penalties imposed on the company. Under the existing legislation and case law, what is currently required for a director to be personally liable as a result of being knowingly concerned in a company's breaches? And how has the Financial Conduct Authority (FCA) sought to fix directors with such liability? 

What is the legal position?

The Financial Services and Markets Act 2000 (FSMA) provides that financial penalties can be imposed on individuals who have been "knowingly concerned" in a company's breach. Case law has established that for a person to be knowingly concerned in a company's breach, they must: be actually involved in the breach and have knowledge of the facts on which the breach depends. 

It is, however, immaterial whether the person knows the legal effect of those facts (that is, they result in a breach); all they need to know is the facts themselves.

Last year, the Court of Appeal clarified in FCA v Ferreira that knowledge of the facts that make the act a breach (in the Ferreira case, the making of a financial promotion) must include knowledge of the factual circumstance that prevents a potentially relevant exemption from applying (in Ferreria, that it had not been approved by an authorised person). The FCA had sought to argue that all that was required was that the individual had knowledge that the financial promotion was being made by the company and nothing more.  

From the court's perspective, the addition of the word "knowingly" must mean that there is a difference between the test for liability of the primary infringer (in this case the company, for which liability is strict) and a secondary party (in this case a director of the company). 

How does the FCA apply the test for 'knowing concern'?

The FCA clearly did not like the Court of Appeal's decision in Ferreira and is concerned that that decision – if applied to the test for "knowing concern" more broadly – will undermine its ability to punish individuals who are in some way responsible for a firm's breach.  

In particular, when the FCA censured Carillion in July 2022 for breaching the Market Abuse Regulation and Listing Rules by publishing announcements that contained false or misleading information, it also sought to fine three former directors of Carillion for being knowingly concerned in Carillion's breaches. 

In the case of the former directors, once again there is a difference between the extent of knowledge the FCA considers is required to be "knowingly concerned" and the extent of knowledge the individuals are arguing is required. 

From the FCA's perspective, the former directors were knowingly concerned in Carillion's breaches because they knew, first, the information contained in the announcements and, secondly, that sufficient facts to support the conclusion that Carillion ought to have known that the announcements were false and misleading. They did not also need to have known that the announcements were actually false or misleading, which the FCA maintains is a legal conclusion rather than a primary fact. 

From the FCA's perspective, given that Carillion's liability can only be established by reference to the knowledge of the former directors (unlike in Ferreira, where there was strict liability for the company's breach), the rationale in Ferreira for there to be additional knowledge on the part of the secondary party beyond that of the primary infringer does not apply. 

This argument appears, however, to ignore the fact that, under the Market Abuse Regulation, it is sufficient to impose liability if the person making the announcement knows or ought to have known that it contains false or misleading information, whereas the relevant provisions of FSMA do not have an equivalent "ought to have known" lesser test. 

The FCA, furthermore and somewhat unconvincingly, considers that requiring more would fundamentally undermine the market abuse regime and its objectives, as the implication would be that directors could remain passive in response to warning signs, so as to avoid acquiring actual knowledge that an announcement contained false or misleading information, and thereby insulate themselves from individual liability. But directors, of course, cannot be wilfully blind to wrongdoing and avoid liability. 

What does this mean for directors?

Directors should be aware of the risk of personal liability arising from a company's breaches where it can be shown that they were involved in the breach and had knowledge of the facts on which the breach depends. 

The FCA has demonstrated that it is willing to pursue enforcement action against directors who are knowingly concerned in a company's breaches. Carillion is not the only recent example of the FCA's appetite to impose liability on directors for being knowingly concerned in a company's breaches. The FCA is also seeking to fine two former executive directors of Metro Bank for being knowingly concerned in its breach of Listing Rule 1.3.3R (misleading information not to be published). 

Osborne Clarke comment

The FCA continues to demonstrate that it will take an expansive view as to what actual knowledge a director is required to have to be knowingly concerned in a company's breach and that it will risk adverse court judgments if necessary. 

We already have the (helpful) Ferreira case to give some clarity on where the courts stand. Perhaps unsurprisingly, the former directors of Carillion have referred their Decision Notices to the Upper Tribunal, so we can anticipate further clarity and guidance there in due course.