Building operational resilience: Impact tolerances for important business services
A key priority for the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) is to put in place a stronger regulatory framework to promote operational resilience of firms and financial market infrastructures (FMIs). To this end, we published our joint Discussion Paper on Operational Resilience last year (see page 2 of 2) to start a dialogue with the financial services industry. We received an impressive level of engagement from industry and two key conclusions have emerged: (1) there is strong support for our proposed approach but respondents asked for a fuller explanation; and (2) many stakeholders see a strong alignment between the goals of firms or FMIs and the authorities in this area.
This paper is issued jointly by the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA) and the Bank of England (‘the Bank’) in its capacity of supervising financial market infrastructures (FMIs), collectively ‘the supervisory authorities’.
The Discussion Paper ‘Building the UK Financial Sector’s Operational Resilience’ (the DP), published in July 2018, set out an approach to operational resilience.
On Thursday 5 December 2019, the supervisory authorities published a suite of documents (‘the proposals’), which would embed that approach into policy. This paper provides a summary of the overall approach and development since the DP.
Detailed proposals from each supervisory authority are set out in the package of publications:
- a PRA Consultation Paper (CP), which includes draft rules, a draft Statement of Policy (SoP), and a draft Supervisory Statement (SS). On Thursday 5 December 2019 the PRA also published a CP which includes a draft SS on outsourcing and third party risk management which is a key part of operational resilience, and firms are encouraged to read this alongside the PRA’s operational resilience CP;
- a CP issued by the FCA, which includes draft rules and draft guidance. The FCA CP also contains a chapter on outsourcing; and
- individual CPs and draft SSs issued by the Bank for central counterparties, and central securities depositories. The Bank is also publishing a CP, draft SS and draft operational resilience chapter of the Code of Practice for recognised payment system operators and specified service providers.
PRA Consultation Paper 29/19 ‘Operational resilience: Impact tolerances for important business services’
In this consultation paper (CP), the Prudential Regulation Authority (PRA) sets out its proposals for PRA rules (Appendix 1 and 2), a supervisory statement (SS) (Appendix 3) and a statement of policy (SoP) (Appendix 4) designed to improve the operational resilience of firms and protect the wider financial sector and UK economy from the impact of operational disruptions. The draft rules and expectations seek to embed the concepts of the July 2018 Discussion Paper (DP) 1/18 ‘Building the UK financial sector’s operational resilience’ (the DP) into the PRA’s prudential framework (page 2 of 2). The accompanying joint Bank of England (Bank), Financial Conduct Authority (FCA) and PRA covering paper, ‘Building operational resilience: Impact tolerances for important business services’ sets out how the concepts in the DP have been updated in the proposed policy. The draft SoP sets out how the PRA proposes to supervise existing policies in the light of the proposed new operational resilience rules and expectations.
This CP is relevant to all:
- UK banks, building societies and PRA-designated investment firms (banks); and
- UK Solvency II firms, the Society of Lloyd’s and its managing agents (insurers).
The proposals aim to address risks to operational resilience including those arising from the interconnectedness of the financial system, and the complex and dynamic environment in which firms operate. The PRA considers that there is a need for a proportionate minimum standard of operational resilience that incentivises firms to prepare for disruptions and to invest where it is needed.
Responses and next steps
This consultation closes on Friday 3 April 2020. The PRA invites feedback on the proposals set out in this consultation. Please address any comments or enquiries to CP29_19@bankofengland.co.uk.
Subject to the feedback received, the PRA will work to develop final Operational Resilience Parts for publication in the second half of 2020. The PRA will continue to collaborate with the FCA and the Bank to develop an approach for regulated firms and Financial Market Infrastructures (FMIs) that is aligned as far as practicable.
The proposals set out in this CP have been designed in the context of the current UK and EU regulatory framework. The PRA will keep the policy under review to assess whether any changes would be required due to changes in the UK regulatory framework, including those arising once any new arrangements with the European Union take effect.
In the event that the UK leaves the EU with no implementation period in place, the PRA has assessed that the proposals would need to be amended.
- A second version of the proposed rules which includes the relevant amendments is attached to this CP. Depending on the timing of the UK’s withdrawal from the EU, the amendments may be made under the EU (Withdrawal) Act 2018 (EUWA). Please see PS5/19 ‘The Bank of England’s amendments to financial services legislation under the European Union (Withdrawal) Act 2018’ for further details. Changes under EUWA should be read in conjunction with the draft PRA transitional direction published in CP18/19 ‘UK withdrawal from the EU: Changes following extension of Article 50’ .
- The draft SS and draft SoP attached to this CP should be read in conjunction with SS1/19 ‘Non-binding PRA materials: The PRA’s approach after the UK’s withdrawal from the EU’.
The proposed implementation date for the proposals in the CP is the second half of 2021.
Bank of England Discussion Paper 1/18 | PRA Discussion Paper 1/18 | Financial Conduct Authority Discussion Paper 18/04
This discussion paper (DP) is issued jointly by the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA), and the Bank of England (the Bank) in its capacity of supervising financial market infrastructures (FMIs), (collectively 'the supervisory authorities'). The purpose of this DP is to share the supervisory authorities’ thinking regarding operational resilience and obtain feedback.
We welcome responses to the questions asked throughout the DP (listed in Chapter 8). Feedback is welcomed from all parts of the financial sector, as well as from consumers, market participants and other stakeholders, including other regulatory organisations.
The importance of operational resilience
Operational disruptions to the products and services that firms and FMIs provide have the potential to cause harm to consumers and market participants, threaten the viability of firms and FMIs, and cause instability in the financial system. This DP focuses on how the provision of these products and services can be maintained. Operational resilience refers to the ability of firms, FMIs and the sector as a whole to prevent, respond to, recover and learn from operational disruptions.
Discussion paper structure
- Chapter 2 explains why the supervisory authorities consider that managing operational resilience is most effectively addressed by focusing on business services, rather than on systems and processes.
- Chapter 3 explains that financial stability rests on the operational resilience of individual firms, FMIs and the system as a whole.
- Chapter 4 suggests that the boards and senior management of firms and FMIs would set their own tolerances for operational disruption, on the assumption that that some or all supporting systems and processes will fail.
- Chapter 5 expands the idea that firms and FMIs would develop impact tolerances for important business services.
- Chapter 6 explains how supervisors could gain assurance that firms and FMIs ensure the continuity of their most important business services, and that boards and senior management are sufficiently engaged.
- Chapter 7 summarises some of the key concepts set out in the DP.
- Chapter 8 is a complete list of the questions in the DP.
Responses and next steps
The supervisory authorities welcome feedback on this DP, including any specific suggestions, issues, or potential alternatives.
The supervisory authorities will work together to reflect on the feedback as they: develop potential proposals for consultation; develop their respective supervisory approaches; and work with the FPC as it develops its own impact tolerances. The supervisory authorities will also be drawing together existing policy material related to operational resilience in order to support firms and FMIs to build their resilience.
Please send any responses to DP1_18@bankofengland.co.uk by Friday 5 October 2018.