Operational Resilience

Consultation Paper

Policy Statement PS21/3

Enhanced firms under SM&CR are in scope.

The scope remains unchanged.

Identify important business services that if disrupted could cause harm to consumers or market integrity.

Firms will be required to identify their important business services, however the PS offers more clarity on the FCA’s expectations. For instance, they indicate that while internal processes (such as payroll) are important for maintaining a firm’s operational resilience, they do not in of themselves constitute important business services.

Set impact tolerances for each important business service specifying at a minimum, the length of time for which a disruption to that important business service can be tolerated.

This requirement remains largely unchanged. However, there is a new expectation for firms to take into account the impact of failure of other related important business services when setting impact tolerances for an individual important business service (ie if services share common resources). This should be undertaken in a proportionate manner

Identify and document the people, processes, technology, facilities and information that support a firm’s important business services.

Firms are still required to identify and document the necessary people, processes, technology and information required to deliver each of its important business services. Firms are also responsible for accurately mapping any relationship outsourced to an external third party.

Firms should test their ability to remain within their impact tolerances through a range of severe but plausible disruption scenarios.

This should be conducted regularly to identify any vulnerabilities that need remediation.

This requirement remains the same as articulated in the CP. However, the FCA have amended their requirement for firms to test their ability to remain within their impact tolerances annually as proposed, and instead firms are required to scenario test when there is a material change to the firm, following improvements made by the firm in response to a previous test and in any event, on a regular basis.

Conduct lessons learned exercises to identify, prioritise and invest in their ability to respond and recover from disruptions as effectively as possible

This requirement remains the same as articulated in the CP.

Develop internal and external communications plans for when important business services are disrupted

This requirement remains the same, and there is further clarity that firms can repurpose existing communications plans/strategies where appropriate.

Create a self-assessment document to evidence a firm’s compliance with the requirements.

This requirement remains the same as articulated in the CP.

Scope

We welcomed proportionality in the regulator’s thinking via the focus only on firms who are more likely to have an impact on other parties or market stability. However, we did not necessarily agree that using a firms’ SM&CR status as a proxy for this is the most appropriate mechanism.

We noted that some members voluntarily ‘opted-up’ their SM&CR status to ‘enhanced’ previously and now find themselves in scope of these regulations. As stated, in many cases this is not problematic due to their existing attention on the topic. However, the arbitrary selection of the SM&CR status of firms being used as the threshold for applicability is slightly disadvantageous to them.

The proposed scope outlined in the CP remains the same.  

The FCA outlined that they expect firms changing their status from ‘core’ to ‘enhanced-scope’ SMCR, and so bringing themselves into scope of this policy, to approach implementation in the same way as other enhanced firms.

Outcomes based

We welcomed the outcomes-based nature of the proposed regulations as firms are best-placed to understand their own internal business models, products and customer types in order to determine their important business services and impact tolerances for instance.

The PS remains outcomes-focused, indicating that firms are best placed to set their impact tolerances at the appropriate level and identify their important business services.

Investment management specific examples

We raised to the FCA that there is a notable lack of investment management specific examples in the CP.

It is welcome that the FCA have included an example fictional enhanced scope SM&CR investment manager to help illustrate its requirements.

Important Business Services

• We agreed that focusing on business services is an effective way for firms to understand the impact on consumers in the event of disruption and that firms are best placed to decide what their important business services are.
• We emphasised that it is important to determine the right level of granularity to avoid a dilution of impact. For example, identifying a large number of services (ie >15) would restrict the impact that reporting to senior management may have, and an understanding of where investment could have a meaningful impact.

The FCA indicate that firms are best placed to identify which of their services should be classed as important business services in the context of their business models and that they should determine the appropriate level of granularity.

Impact Tolerances

• We welcomed the concept of setting impact tolerances and in particular the fact that the FCA had not been prescriptive, and have focused on the overall objective.
• We raised that an additional complication that firms may face is the reliance and interconnectedness of outsourced service suppliers. It could prove problematic for firms if outsourced service providers have incompatible or inconsistent tolerances to them, and they may lack the ability to change these, or in extreme scenarios change their supplier.

• As with other areas of the policy, the FCA consider that firms are best placed to set their impact tolerances at the appropriate level.
• The FCA detail that when a firm is using a third-party provider in the provision of important business services, it should work effectively with that provider to set and remain within impact tolerances. Ultimately, the requirements to set and remain within impact tolerances remain the responsibility of the firm, regardless of whether it uses external parties for the provision of important business services.

Duration metric

• We did not agree with the draft requirement that time duration should always be used as one of the metrics in setting impact tolerances.
• Firms should be able to determine the most appropriate metric to use.

• Firms will be required to understand the maximum amount of time for which disruption to an important business service can be tolerated, or a point in time beyond which disruption cannot be tolerated.
• The supervisory authorities also clarify that a time-based metric can be defined in different ways and, where appropriate, must be used in conjunction with other metrics.

Dual-regulated firms

We recognised that it is logical to set different impact tolerance requirements given the different considerations of each regulator and their underlying responsibilities, we urged regulatory cohesion as far as possible to mitigate against any unnecessary burden on firms.

Dual-regulated firms will need to set two impact tolerances. If the same business service is defined as an important business service under both PRA and FCA rules, the firm should have separate impact tolerances in consideration of the objectives of the two supervisory authorities (however if appropriate, this may be at the same point for each).

Outsourcing

• Given our industry’s reliance and the interconnectedness of outsourced service suppliers, we conveyed that this could prove problematic for firms if outsourced service providers have incompatible or inconsistent tolerances to them, and they may lack the ability to change these, or in extreme scenarios change their supplier. Service providers may face challenges if clients make differing or contradictory requests of them.
• We asked the FCA to consider that for many of these services, it is not viable to operate a second provider, and migration from one to another can take many years.

• Firms are required to map their important business services and test their ability to remain within impact tolerances, regardless of whether the operational resources are being provided wholly or in part by a third party.
• Firms that enter into outsourcing or third party arrangements remain fully accountable for complying with all their regulatory obligations. As part of their assurance, firms may ask third parties to provide mapping or scenario testing data but this is not required in all cases, particularly if other assurance mechanisms are effective and more proportionate.

Mapping

• Firms reported to us that they would benefit from more guidance on the appropriate level of granularity firms should take when conducting mapping.

• We also raised that given the use of third, fourth and fifth parties in many firms’ supply chains, firms may encounter a differing range of success in terms of the level of detail they can reach in their mapping processes.

• The regulators consider that firms are best placed to determine a proportionate and effective approach to mapping.

• Firms should understand the reliance placed on sub-outsourcing arrangements, and if these arrangements pose a threat to their operational resilience. Firms should, at a minimum, monitor sub-outsourced providers involved in the provision of important business services, including their ability to deliver the firm’s important business services within the firm’s impact tolerances.

Testing

• Firms would benefit from further clarity on what the FCA expects on how or if firms should coordinate testing with their key suppliers. Moreover, we stated that it would be helpful to gain feedback on the feasibility of such a testing process and whether that in itself could harm the resiliency of the firms and the markets.

• Firms should consider any potential issues (ie if there is a need to coordinate with third parties) when organising their testing schedule and consider how best to minimise disruption to other activities while still meeting the requirements.
• The regulators expect that firms will identify what can be considered ‘severe but plausible’ scenarios (ie based on previous incidents or near misses).
• However, the supervisory authorities also anticipate that this will be a common area for supervisory and firm discussion, including developing an understanding of how and why scenarios have been selected.

Industry-wide tests

Firms would benefit from further clarity on what the FCA expects on how or if firms should coordinate testing with their key suppliers. Moreover, it would be helpful to gain feedback on the feasibility of such a testing process and whether that in itself could harm the resiliency of the firms and the markets. For example, such testing may need to be scheduled and co-ordinated across industry. Due to the risk of failure involved and the resultant disruption, such an event should not take place without the involvement of the regulator.

The FCA believe that the introduction of industry-wide tests could be helpful for some firms, and particularly smaller firms, this needs to be balanced against the cost and resources to develop and maintain these tests and will consider if these tests could be developed over the longer term as part of their supervisory approach.

Testing methods

We welcomed the fact that testing may consist of one or more of ‘paper-based, simulations or live-systems’ and that firms are able to decide the most appropriate mechanism(s) to satisfy themselves of their resiliency. We took from this that it would be permissible for firms to solely conduct more theoretical forms of testing. However, if theoretical scenario testing is not considered sufficient, it should be noted that using more realistic or live testing would likely introduce risks that regulatory authorities need to be alive to, and potentially involved in.

The appropriate testing method will vary according to firm and that testing methods will also vary depending on the ‘severe but plausible’ scenarios identified by the firm in question.

Self-assessment

• We agreed that such a document will help boards locate, in one place, the resiliency assessment of the business on an ongoing basis and initiate discussion and decision-making.
• We asked for clarification on the deadline for the date of the publication of the first document, and assumed this would be one year following the rules coming into effect.
• We asked for clarity on the expectations for dual-regulated firms, assuming that only one self-assessment document would be needed to satisfy both regulators.

• This requirement remains the same as articulated in the CP.

• The first document will be required by 31 March 2022.

• The PRA and FCA consider that firms should undertake bespoke self-assessments which reflect their individual important business services and scenario testing, although these can leverage the same work.

Transitional arrangements

• We welcomed the proposed 3 year transitional arrangements to accommodate the significant change and time involved for firms to evidence mapping, reconsider tolerances and definitions of important business services as well as the time for board members to gain the necessary insights to make knowledgeable and informed decisions.

• The transition arrangements remain largely the same, although the regulators have introduced more flexibility on their mapping and scenario testing requirements; by 31 March 2022 firms are not expected to have performed mapping and scenario testing to the full extent of sophistication within this time.

International alignment

• We indicated that it is important to try and achieve regulatory alignment across jurisdictions to alleviate any potential friction for international firms.

• The regulators remain committed to ensuring supervisory coordination. Comparing their policy with the BCBS consultation, the supervisory authorities consider that there is alignment on the core principles despite some differences in terminology.
• As long as the principles are aligned, the supervisory authorities consider that firms and their supervisors should be able to work effectively across borders.