Update 3 June 2021: This update is relevant only to firms with annual gross written premiums in excess of £10 billion determined on the basis of the average annual amount assessed across a rolling period of three years, calculated by reference to the firm’s accounting reference date. It has come to the PRA’s attention that there was a typographical error in paragraph 3.15 of Policy Statement (PS) 6/21 ‘Operational resilience: Impact tolerances for important business services’. This has resulted in PS6/21 not reflecting accurately the wording of the Operational Resilience – Solvency II Part of the PRA Rulebook, effective from Wednesday 31 March 2022. The figure of £10 billion referred to in paragraph 3.15 should read £15 billion. This has now been corrected.
Published on 29 March 2021
Operational resilience: Impact tolerances for important business services
This paper is issued jointly by the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA), and the Bank of England (‘the Bank’) in its capacity of supervising financial market infrastructures (FMIs), collectively ‘the supervisory authorities’.
A key priority for the supervisory authorities is to put in place a stronger regulatory framework to promote the operational resilience of firms and FMIs. To this end, the supervisory authorities published a joint Discussion Paper on Operational Resilience in 2018 setting out an approach to operational resilience (page 3 of 3). Following this, the supervisory authorities published a suite of consultation documents (‘the consultations’) in December 2019 to embed this approach into policy (page 2 of 3).
The proposals were designed to improve the operational resilience of firms and FMIs and protect the wider financial sector and UK economy from the impact of operational disruptions. The consultations proposed requirements and expectations for firms and FMIs to:
- identify their important business services by considering how disruption to the business services they provide can have impacts beyond their own commercial interests;
- set a tolerance for disruption for each important business service; and
- ensure they can continue to deliver their important business services and are able to remain within their impact tolerances during severe (or in the case of FMIs, extreme) but plausible scenarios.
Operational resilience: Impact tolerances for important business services (joint covering document)
Operational resilience: Impact tolerances for important business services – PS 6/21
Overview
This Prudential Regulation Authority (PRA) Policy Statement (PS) provides feedback to responses to Consultation Paper (CP) 29/19 Operational resilience: Impact tolerances for important business services (page 2 of 3). It also contains the PRA’s final policy, as follows:
- a new Operational Resilience Parts of the PRA Rulebook (Appendix 1);
- amendments to the Group Supervision Part of the PRA Rulebook (Appendix 1);
- a new Supervisory Statement (SS) 1/21 ‘Operational resilience: Impact tolerances for important business services’ (Appendix 2); and
- a new Statement of Policy (SoP) ‘Operational resilience’ (Appendix 3).
This PS is relevant to:
- UK banks, building societies, and PRA-designated investment firms (banks); and
- UK Solvency II firms, the Society of Lloyd’s and its managing agents (insurers).
Summary of responses
The PRA received 48 responses to the CP. There was general support for the main components of the policy, consistent with feedback to the 2018 Discussion Paper (page 3 of 3). Broadly, the comments focused on implementation, proportionality, alignment with the Financial Conduct Authority, alignment with international principles and requests for further detail on PRA expectations. More detail covering all CP responses is set out under the relevant policy sections in Chapter 2 of the PS.
Implementation
The Operational Resilience Parts will be effective from Thursday 31 March 2022. To comply with the rules, firms should contact their supervisors to agree their plans for meeting policy requirements.
SS1/21 will be effective from Thursday 31 March 2022.
The proposals set out in this PS have been designed in the context of the UK having left the European Union and the transition period having come to an end. Unless otherwise stated, any references to EU or EU derived legislation refer to the version of that legislation which forms part of retained EU law. The PRA will keep the policy under review to assess whether any changes would be required due to changes in the UK regulatory framework.
Appendix
- Appendix 1: PRA RULEBOOK: CRR FIRMS, SOLVENCY II FIRMS: OPERATIONAL RESILIENCE INSTRUMENT 2021(pdf)
- Appendix 2: SS1/21 ‘Operational resilience: Impact tolerances for important business services’
- Appendix 3: Statement of Policy ‘Operational resilience’
Update 7 May 2020: On 20 March, we announced an extension to the Bank and PRA consultations on Operational Resilience until 1 October 2020. It is planned that firms and FMIs will not need to meet requirements resulting from the consultations before the end of 2021. While operational resilience remains a top priority for the Bank, PRA and FCA, the delays are intended to alleviate burden on firms and FMIs in the wake of the Covid-19 outbreak.
Update 20 March 2020: The deadline for responses will, in line with the FCA, be extended to 1 October 2020. For more information on this please see our statement ‘Bank of England announces supervisory and prudential policy measures to address the challenges of Covid-19’.
Published on 05 December 2019
Building operational resilience: Impact tolerances for important business services
A key priority for the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) is to put in place a stronger regulatory framework to promote operational resilience of firms and financial market infrastructures (FMIs). To this end, we published our joint Discussion Paper on Operational Resilience last year (see page 2 of 2) to start a dialogue with the financial services industry. We received an impressive level of engagement from industry and two key conclusions have emerged: (1) there is strong support for our proposed approach but respondents asked for a fuller explanation; and (2) many stakeholders see a strong alignment between the goals of firms or FMIs and the authorities in this area.
This paper is issued jointly by the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA) and the Bank of England (‘the Bank’) in its capacity of supervising financial market infrastructures (FMIs), collectively ‘the supervisory authorities’.
The Discussion Paper ‘Building the UK Financial Sector’s Operational Resilience’ (the DP), published in July 2018, set out an approach to operational resilience.
On Thursday 5 December 2019, the supervisory authorities published a suite of documents (‘the proposals’), which would embed that approach into policy. This paper provides a summary of the overall approach and development since the DP.
Detailed proposals from each supervisory authority are set out in the package of publications:
- a PRA Consultation Paper (CP), which includes draft rules, a draft Statement of Policy (SoP), and a draft Supervisory Statement (SS). On Thursday 5 December 2019 the PRA also published a CP which includes a draft SS on outsourcing and third party risk management which is a key part of operational resilience, and firms are encouraged to read this alongside the PRA’s operational resilience CP;
- a CP issued by the FCA, which includes draft rules and draft guidance. The FCA CP also contains a chapter on outsourcing; and
- individual CPs and draft SSs issued by the Bank for central counterparties, and central securities depositories. The Bank is also publishing a CP, draft SS and draft operational resilience chapter of the Code of Practice for recognised payment system operators and specified service providers.
Building operational resilience: Impact tolerances for important business services
PRA Consultation Paper 29/19 ‘Operational resilience: Impact tolerances for important business services’
Overview
In this consultation paper (CP), the Prudential Regulation Authority (PRA) sets out its proposals for PRA rules (Appendix 1 and 2), a supervisory statement (SS) (Appendix 3) and a statement of policy (SoP) (Appendix 4) designed to improve the operational resilience of firms and protect the wider financial sector and UK economy from the impact of operational disruptions. The draft rules and expectations seek to embed the concepts of the July 2018 Discussion Paper (DP) 1/18 ‘Building the UK financial sector’s operational resilience’ (the DP) into the PRA’s prudential framework (page 2 of 2). The accompanying joint Bank of England (Bank), Financial Conduct Authority (FCA) and PRA covering paper, ‘Building operational resilience: Impact tolerances for important business services’ sets out how the concepts in the DP have been updated in the proposed policy. The draft SoP sets out how the PRA proposes to supervise existing policies in the light of the proposed new operational resilience rules and expectations.
This CP is relevant to all:
- UK banks, building societies and PRA-designated investment firms (banks); and
- UK Solvency II firms, the Society of Lloyd’s and its managing agents (insurers).
The proposals aim to address risks to operational resilience including those arising from the interconnectedness of the financial system, and the complex and dynamic environment in which firms operate. The PRA considers that there is a need for a proportionate minimum standard of operational resilience that incentivises firms to prepare for disruptions and to invest where it is needed.
Responses and next steps
This consultation closes on Friday 3 April 2020. The PRA invites feedback on the proposals set out in this consultation. Please address any comments or enquiries to CP29_19@bankofengland.co.uk.
Subject to the feedback received, the PRA will work to develop final Operational Resilience Parts for publication in the second half of 2020. The PRA will continue to collaborate with the FCA and the Bank to develop an approach for regulated firms and Financial Market Infrastructures (FMIs) that is aligned as far as practicable.
The proposals set out in this CP have been designed in the context of the current UK and EU regulatory framework. The PRA will keep the policy under review to assess whether any changes would be required due to changes in the UK regulatory framework, including those arising once any new arrangements with the European Union take effect.
In the event that the UK leaves the EU with no implementation period in place, the PRA has assessed that the proposals would need to be amended.
- A second version of the proposed rules which includes the relevant amendments is attached to this CP. Depending on the timing of the UK’s withdrawal from the EU, the amendments may be made under the EU (Withdrawal) Act 2018 (EUWA). Please see PS5/19 ‘The Bank of England’s amendments to financial services legislation under the European Union (Withdrawal) Act 2018’ for further details. Changes under EUWA should be read in conjunction with the draft PRA transitional direction published in CP18/19 ‘UK withdrawal from the EU: Changes following extension of Article 50’ .
- The draft SS and draft SoP attached to this CP should be read in conjunction with SS1/19 ‘Non-binding PRA materials: The PRA’s approach after the UK’s withdrawal from the EU’.
Implementation
The proposed implementation date for the proposals in the CP is the second half of 2021.
Bank of England Discussion Paper 1/18 | PRA Discussion Paper 1/18 | Financial Conduct Authority Discussion Paper 18/04
Introduction
This discussion paper (DP) is issued jointly by the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA), and the Bank of England (the Bank) in its capacity of supervising financial market infrastructures (FMIs), (collectively 'the supervisory authorities'). The purpose of this DP is to share the supervisory authorities’ thinking regarding operational resilience and obtain feedback.
We welcome responses to the questions asked throughout the DP (listed in Chapter 8). Feedback is welcomed from all parts of the financial sector, as well as from consumers, market participants and other stakeholders, including other regulatory organisations.
The importance of operational resilience
Operational disruptions to the products and services that firms and FMIs provide have the potential to cause harm to consumers and market participants, threaten the viability of firms and FMIs, and cause instability in the financial system. This DP focuses on how the provision of these products and services can be maintained. Operational resilience refers to the ability of firms, FMIs and the sector as a whole to prevent, respond to, recover and learn from operational disruptions.
Discussion paper structure
- Chapter 2 explains why the supervisory authorities consider that managing operational resilience is most effectively addressed by focusing on business services, rather than on systems and processes.
- Chapter 3 explains that financial stability rests on the operational resilience of individual firms, FMIs and the system as a whole.
- Chapter 4 suggests that the boards and senior management of firms and FMIs would set their own tolerances for operational disruption, on the assumption that that some or all supporting systems and processes will fail.
- Chapter 5 expands the idea that firms and FMIs would develop impact tolerances for important business services.
- Chapter 6 explains how supervisors could gain assurance that firms and FMIs ensure the continuity of their most important business services, and that boards and senior management are sufficiently engaged.
- Chapter 7 summarises some of the key concepts set out in the DP.
- Chapter 8 is a complete list of the questions in the DP.
Responses and next steps
The supervisory authorities welcome feedback on this DP, including any specific suggestions, issues, or potential alternatives.
The supervisory authorities will work together to reflect on the feedback as they: develop potential proposals for consultation; develop their respective supervisory approaches; and work with the FPC as it develops its own impact tolerances. The supervisory authorities will also be drawing together existing policy material related to operational resilience in order to support firms and FMIs to build their resilience.
Please send any responses to DP1_18@bankofengland.co.uk by Friday 5 October 2018.