‘Severe but plausible’ - the regulators set out their operational resilience expectations
It will have been hard to escape the phrase ‘operational resilience’ over the past months, a subject that has been brought to the forefront of firms’ attention with the advent of the Covid-19 pandemic and most recently by the publication of the FCA’s policy statement, outlining their final rules to strengthen operational resilience in the financial services sector. This represents an important moment as it outlines the regulator’s expectations for firms in concrete terms.
While there was praise for the sector’s resilience during the pandemic period, there is a warning too: “…we would emphasise that being operationally resilient is an iterative and evolving process. As we have seen with the pandemic, disruption can happen at any time and we should assume that it will occur.” – FCA, PS21/3
What does the policy statement say?
In simple terms, the regulators are looking for firms to take action to prepare for the inevitability of a disruptive event and ensure they remain operationally resilient to prevent harm to consumers, market and firms.
In their 2019 consultation paper, the FCA listed the steps firms would need to take to build their operational resilience including identifying important business services, setting impact tolerances against these, mapping underlying dependencies and testing the ability to stay within those impact tolerances in severe but plausible scenarios.
Many of these concepts are reiterated and developed in the policy statement, where they provide more detail on some of the queries raised by respondents to the CP. The main development is that firms in scope have been afforded a little more flexibility regarding the regulators’ expectations on mapping and scenario testing. Firms will not need to have mapped or performed scenario testing of every important business service during the next twelve months but the regulators expect firms to develop their sophistication in these areas over the subsequent transitional period.
A helpful overview of the regulators’ joined-up approach is available through their shared final policy summary. Our analysis of the policy statement and impact on our sector can be found on our webpage.
Implications for members and next steps
Not all investment managers are formally in scope of these rules – it applies to enhanced scope Senior Managers & Certification Regime firms only - but some firms may fall into both the FCA’s and PRA’s versions of the policy. However, even firms out of scope may wish to follow the spirit of the requirements set out by the regulators, given the outcomes that greater resiliency can provide to the firm and its clients.
Firms which are in scope will need to ensure they start to think meaningfully about the requirements in light of the 31 March 2022 deadline. Those firms which are well advanced or that have already started preparations will find nothing in these rules that slow them down or cause them to revisit work already been done.
The regulator has not changed the timelines involved. They first issued a discussion paper on this subject in 2018 and saw the consultation period extended by the pandemic itself, and so were reluctant to provide more time for firms to implement the rules. Although as of now there are four years before some elements of the rules take effect (if using the three-year transitional period) there is much to be done and the FCA clearly expect firms to not take all of the time up to March 2025 in ensuring they can consistently remain within their impact tolerances.
We have a wide range of operational resilience publications available to IA members to enable them to work through the different elements of the requirements. Further resources, such as our guidance on important business services and sample governance structures can be found on our dedicated operational resilience expert page.
To hear more about the regulatory expectations for firms and industry views about members’ experiences to date, you can attend our Operational Resilience Forum, part of our Resilience Day on 26th May 2021 where we will be hearing directly from the FCA. This event is open to both members and non-members.