PS2/22 | CP21/21 - Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience)

PS2/22 - Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience)

Published 11 March 2022

1: Overview

1.1. This Prudential Regulation Authority (PRA) Policy Statement (PS) provides feedback to responses to Consultation Paper (CP) 21/21 ‘Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience)’.^{footnote [1]} It also contains the PRA’s final policy, in the form of:

• amendments to the Operational Resilience Part of the PRA Rulebook, the Insurance – Operational Resilience Part of the PRA Rulebook and the Group Supervision Part of the PRA Rulebook (Appendix 1);
• updated SS1/21 ‘Operational resilience: Impact tolerances for important business services’ (Appendix 2); and
• amendments to the Operational Continuity Part of the PRA Rulebook (Appendix 3).

1.2. This PS is relevant to different types of firms as follows:

• Operational Resilience:
  • UK banks, building societies, and PRA-designated investment firms (all of which will hereafter be known as ‘banks’), and CRR consolidation entities;
  • UK Solvency II firms, and the Society of Lloyd’s and its managing agents (all of which will hereafter be known as ‘insurers’); and
• Operational Continuity in Resolution: UK banks, building societies, and PRA-designated UK investment firms currently in scope of, or likely to come in scope of, the Operational Continuity Part of the PRA Rulebook.

Background

1.3. In CP21/21, the PRA proposed that certain group obligations in the Operational Resilience Part of the PRA Rulebook, relevant to CRR firms, should apply to CRR consolidation entities. This would mean that the same substantive policy requirements would apply directly to these CRR consolidation entities, rather than to the individual firms in their groups. In addition, CP21/21 proposed to make other minor formatting and clarification amendments to the following:

• the Operational Resilience Part applying to CRR firms;
• the Operational Resilience Part applying to Solvency II firms;
• the Group Supervision Part; and
• the Operational Continuity Part.

1.4. CP21/21 proposed to use section 192XA of the Financial Services and Markets Act 2000 (FSMA) to change Chapter 8 and related provisions of the Operational Resilience Part, from imposing certain obligations on firms that are part of a group and/or consolidated group, to imposing those obligations directly on the CRR consolidation entity.^{footnote [2]} This change gives effect more directly to the initial policy intention, which stated that, where applicable, ‘a group-level view’ of operational resilience is taken. To effect this change, CP21/21 proposed amendments to Chapter 1 (Application and Definitions), Chapter 2 (Operational Resilience Requirements), and Chapter 8 (Group Arrangements) of the Operational Resilience Part, as well as amendments to Chapter 1 (Introductions) and Chapter 9 (Groups) of SS1/21.

1.5. Further minor formatting and clarification amendments were proposed in CP21/21 to the Operational Resilience Part, the Operational Resilience rules applying to Solvency II firms, and the Group Supervision Part. These changes provide further clarity to the rules, amend typos, align formatting with the PRA Rulebook, and link to definitions provided in the PRA Rulebook Glossary and the Interpretation Act 1978.

1.6. Additionally, CP21/21 proposed an amendment to the Operational Continuity Part of the PRA Rulebook, deleting the word ‘other’ in Operational Continuity 2.3. This change clarifies the intended scope of application of the rule, as the word ‘other’ has the potential to be interpreted by firms as limiting the application of Rule 2.3 to intragroup service providers only. It is not the PRA’s intention to limit the application of Rule 2.3 in this way.

Summary of responses

1.7. The PRA received five responses to the CP. Respondents were supportive of the proposals and broadly recognised the rationale behind the PRA’s proposal to apply certain group provisions in the Operational Resilience Part of the PRA Rulebook relevant to CRR firms to CRR consolidation entities. Generally, the comments focused on the implementation timeline for the Operational Resilience Parts. A clarification was requested regarding the proposed update to paragraph 9.2 of SS1/21. Respondents were supportive of the proposed update to the Operational Continuity Part. More detail regarding the CP responses is set out in Chapter 2 below.

Changes to draft policy

1.8. Where the final rules differ from the draft in the CP in a way which is, in the opinion of the PRA, significant, FSMA requires the PRA to publish:

• details of the difference together with a cost benefit analysis; and
• a statement setting out in the PRA’s opinion whether or not the impact of the final rule on mutuals is significantly different to: the impact that the draft rule would have had on mutuals; or the impact that the final rule will have on other PRA-authorised firms.

1.9. After considering the responses to the CP, the PRA has amended the following aspects of the proposed policy:

• a new rule has been introduced to Chapter 8 of the Operational Resilience Part requiring CRR consolidation entities to comply with the requirements in Chapter 8 within a reasonable time, and by no later than 30 June 2022;
• new rules have been introduced to Chapter 8 of the Operational Resilience Part requiring CRR consolidation entities to assess the ability of group members to remain within impact tolerances for their important group business services, and to ensure the CRR consolidation entity’s board approves the CRR consolidation entity’s assessment;
• Chapter 9 of SS1/21 has been amended to clarify where the policy applies to a CRR consolidation entity and where the policy applies to an insurer;
• paragraph 9.2 of SS1/21 has been amended to delete the reference to the definition of important group business services, provide examples of important group business services and to clarify the PRA’s expectations regarding how CRR consolidation entities and insurers should consider important group business services;
• paragraph 9.3 of SS1/21 has been amended to clarify that a threat to the viability of the group is one example of how risks could arise to UK financial stability or a firm’s safety and soundness in the context of important group business services, or in the case of PRA-regulated insurers, policyholder protection;
• paragraph 9.4 of SS1/21 has been amended to remove the reference to the requirement relating to strategies, processes and systems, and to add an expectation that CRR consolidation entities should have a regular dialogue with other members of its group regarding the assessment required under Rule 8.8 of the Operational Resilience Part applicable to CRR firms;
• paragraph 9.5 of SS1/21 has been amended to clarify that firms are expected to work with other members of their group to take action, should it be likely that a relevant important group business service could not be delivered within its impact tolerance;
• a new bullet in paragraph 8.3 of SS1/21 has been inserted to clarify the PRA’s expectations regarding the contents of a CRR firm’s self-assessment as required under Rule 6.1 of the Operational Resilience Part applicable to CRR firms in respect of additional risks arising elsewhere in the group;^{footnote [3]}
• A number of minor amendments have been made to the Operational Resilience rules and SS1/21 to increase overall clarity. Paragraphs 1.2 and 1.5 of SS1/21 have been amended to include references to groups. A minor correction to Rules 7.1 and 7.2 of the Operational Resilience rules applicable to CRR firms and CRR consolidation entities has been made to remove a reference to ‘important group business services’. References to Rules 8.1 and 8.2 have been deleted, and a minor clarification has been made to 8.12 (1) and (2) to remove the words ‘by it’; and
• The title of the Operational Resilience Part applicable to Solvency II firms has been amended to ‘Insurance – Operational Resilience’. Throughout SS1/21, references to these rules have been updated with the new title. A consequential amendment has been made to Rule 1.2 of the Insurance – Operational Resilience Part.

1.10. The PRA considers that these changes will have a beneficial impact on firms in scope of the Operational Resilience Part relevant for CRR firms, particularly as they will allow more time to implement the governance procedures required under Rules 8.11 and 8.12. The new Rules 8.8 and 8.12(3) clarify that the CRR consolidation entity should assess whether each member of the consolidation group providing each important group business service could remain within the relevant impact tolerance, and should ensure that CRR consolidation entity’s management body approves that assessment. The PRA considers that the introduction of these requirements does not change the substance of the proposal in the consultation. Rather, the clarifications aim to facilitate consistent practice across CRR consolidation entities, helping to ensure that the benefits (to safety and soundness) of the operational resilience policy transpire more broadly.

1.11. Given the changes are not significant in nature, the cost benefit analysis remains unchanged. While the new requirements 8.8 and 8.12(3) may incur some costs to firms, the PRA considers that those costs would not be much greater than the cost of meeting the requirement to have in place the strategies, processes and systems to adequately undertake this assessment, as proposed in CP21/21.The PRA also considers that the changes will not have a different impact on mutuals compared to other firms.

1.12. When making rules, the PRA is required to comply with several legal obligations, including considering responses to consultation, and publishing an explanation of the PRA’s reasons for believing that making the proposed rules is compatible with its objectives and with its duty to have regard to the regulatory principles.^{footnote [4]} In addition, when making CRR rules or rules applying to certain CRR consolidation entities, the PRA must consider certain additional matters, and publish an explanation of the ways in which that consideration has affected the proposed rules.^{footnote [5]} In CP21/21, the PRA set out this explanation in Chapter 3, and below the PRA has provided updated explanations taking into account consultation responses.

1.13. The PRA considers that these changes to the draft policy will further advance the PRA’s objectives of promoting the safety and soundness of firms and securing an adequate degree of protection for policyholders, while enhancing proportionality and promoting clarity of the PRA’s approach to operational resilience. Due to the low materiality of the changes, the PRA considers that there would be minimal additional costs to firms. The PRA also expects that these changes will not have an impact on competition, and are therefore consistent with the PRA’s secondary competition objective.

1.14. The PRA must also publish a summary of the purpose of the proposed rules.^{footnote [6]} As outlined in CP21/21, the purpose of the changes to the Operational Resilience rules relating to CRR firms is to change Chapter 8 of the Operational Resilience Part from applying certain obligations on firms which are part of a group and/or consolidated group, to applying those obligations onto the CRR consolidation entity. In addition, the rules also make a number of clarifications and minor amendments to the Operational Resilience rules applicable to CRR firms and CRR consolidation entities, the Operational Resilience rules to Solvency II firms, the Group Supervision Part, and to the Operational Continuity Part. The purpose of these clarifications and minor amendments is to fix formatting errors, and, in the case of Operational Continuity Part, to provide consistency within the PRA’s Operational Continuity policy.

Implementation

1.15. The implementation dates for the changes set out in this PS are:

• Thursday 31 March 2022 for the Operational Resilience Parts and the Group Supervision Part; and
• Sunday 1 January 2023 for the Operational Continuity Part.

2: Feedback to responses

2.1. Before making any proposed rules, the PRA is required by FSMA to have regard to any representations made to it, and to publish an account, in general terms, of those representations and its feedback to them.

2.2. The PRA has considered the responses received to the CP. This chapter sets out the PRA’s feedback to those responses, and its final decisions.

2.3. The sections below have been structured broadly along the same lines as the chapters of the CP. The responses have been grouped as follows:

• Operational resilience; and
• Operational continuity in resolution.

Operational resilience

Proposals relating to CRR consolidation entities

2.4. The PRA proposed to amend Chapter 8 of the Operational Resilience rules applying to CRR firms to impose certain group obligations onto the CRR consolidation entity.

2.5. Two respondents expressed support for the proposed change to Chapter 8 of the Operational Resilience rules applying to CRR firms because it is consistent with the group-level approach to operational resilience. Another respondent stated that implementation of the proposed Operational Resilience policy would not result in any material increase in costs or resources.

Terminology in relation to CRR firms

2.6. The PRA proposed to amend the definition of ‘important group business service’ in Rule 1.2 of the Operational Resilience Part of the PRA Rulebook so that it referred to ‘the CRR consolidation entity’s consolidation group’, so that it would apply to CRR consolidation entities. The PRA also proposed to amend paragraph 9.2 in SS1/21 to reflect the policy intention in relation to CRR consolidation entities. Prior to the proposed amendments, paragraph 9.2 of SS1/21 referred to ‘group’ rather than ‘the CRR consolidation entity’s consolidation group.’

2.7. Four respondents commented on inconsistencies between the language used in the definition of ‘important group business service’ in Rule 1.2 of the Operational Resilience Part of the PRA Rulebook applying to CRR firms, and in paragraph 9.2 of SS1/21. Two respondents suggested that the language proposed in SS1/21 implied that CRR consolidation entities must identify important group business services in relation to a risk to any entity in the group, rather than the safety and soundness of any CRR firm within the CRR consolidation entity’s consolidation group. They observed that this would mean firms would need to identify any business service in a non-UK market as an important group business service even if their failure would have no impact on the safety and soundness of the CRR firm or UK financial stability.

2.8. Having considered the responses, the PRA clarifies that important group business services should, for CRR firms, be identified in relation to the CRR consolidation entity’s consolidation group. The PRA has amended the SS to distinguish where the policy applies to a CRR consolidation entity and where the policy applies to an insurer. The PRA has also, for clarity, removed the restatement of the definition of an important group business service in paragraph 9.2 of SS1/21. CRR firms and CRR consolidation entities should continue to refer to Rule 1.2 of the Operational Resilience Part applicable to CRR firms for the definition of important group business services.

Important group business services

2.9. One respondent requested clarity with regards to whether identifying important group business services and setting impact tolerances should be undertaken at the level of the consolidated CRR consolidation entity of the CRR firm (or CRR firms), or only in relation to such CRR firms. The PRA requires important group business services and impact tolerances to be identified and set by the CRR consolidation entity in relation to risks to the CRR firm (or CRR firms) and, where relevant, UK financial stability. The PRA considers that disruption to certain services provided by other entities within a CRR consolidation entity’s consolidation group could (for example, via a threat to the viability of the group as a whole) transmit risk to the safety and soundness of the CRR firm (or CRR firms), and therefore should be identified as important group business services. This is in addition to services provided elsewhere in the UK consolidation group which, if disrupted, could affect the safety and soundness of the CRR firm more directly. The examples below show the various ways the safety and soundness of a CRR firm could be impacted by a disruption to services in other entities within a CRR consolidation entity’s consolidation group.

2.10. The intent of the Operational Resilience proposals for CRR consolidation entities is to ensure that CRR consolidation entities take a ‘group level view’ of operational resilience, meaning that they should identify and assess risks arising from disruption to services elsewhere in the CRR consolidation entity’s consolidation group that could impact the safety and soundness of a CRR firm (or CRR firms). The PRA proposed in CP21/21 to apply the provisions in Chapter 8 to CRR consolidation entities. The PRA’s intended outcome is that a CRR consolidation entity would assess its group members’ ability to remain within impact tolerances in severe but plausible scenarios of disruption to important group business services. The PRA has therefore amended Chapter 8 (Group Arrangements) in the Operational Resilience Part to include Rules 8.8 and 8.12(3). Rule 8.8 makes it clear that the CRR consolidation entity would (having put in place sound, effective and comprehensive strategies, processes and systems to do so under Rule 8.11(3)) be required to assess whether, in the event of a severe but plausible disruption, each member of the consolidation group providing each important group business service could remain within the impact tolerance set. Rule 8.12(3) clarifies that the management body of the CRR consolidation entity must approve the assessment. The PRA considers that the introduction of Rules 8.8 and 8.12(3) do not present a significant change from the policy consulted on in CP21/21. The new requirement should not be confused with the written self-assessment that CRR firms are required to complete. The PRA does not require CRR consolidation entities to write a self-assessment.

2.11. A CRR firm should understand the outcomes of the CRR consolidation entity’s assessment. The PRA has, therefore, added an expectation to paragraph 9.4 of SS1/21 that a CRR consolidation entity should have regular dialogue with other members of its group in order to facilitate the CRR firm’s own analysis. The PRA considers that a CRR firm should take account of risks to its safety and soundness that could arise as a result of disruption to important group business services when assessing its ability to remain within impact tolerance for each of its own important business services. The PRA also clarifies that a firm should cover its analysis of risks arising from elsewhere in its group in its self-assessment. This expectation is now contained in a new bullet point in paragraph 8.3 of SS1/21.

2.12. To provide further clarity for CRR consolidation entities and insurance groups in relation to requirements when setting impact tolerances for important group business services, the PRA has amended paragraph 9.3 of SS1/21 to state that ‘Boards and senior management should consider the level of disruption that would represent a threat to the CRR firm or insurer, for example, via a threat to the viability of the group’. The PRA has also, for clarity, removed the restatement of the requirement for CRR consolidation entities and insurers to ensure that the strategies, processes, and systems at the group level.

2.13. In line with the examples below, the PRA clarifies, for the avoidance of doubt, that paragraph 10.1 of PS6/21 ‘Operational resilience: Impact tolerances for important business services’^{footnote [7]} means that an important group business service would include a service which if disrupted, could impact the safety and soundness of the UK (PRA-regulated) entity directly, or for example, by causing failure of the whole group.

Examples of impacts to a CRR firm’s safety and soundness

Example 1

A UK consolidation group has a UK and international banking entity and the whole group operates under the brand name Bank ABC.

The international entity provides significant hedging services to international clients. If the international bank is unable to deliver its hedging services for a prolonged period of time, due to the reputational damage, it is likely that clients of the UK CRR firm would choose to move their business to a competitor.

This could affect the safety and soundness of the UK CRR firm. Therefore international bank’s hedging services are an important group business service.

Figure 1: Example of impacts to a CRR firm’s safety and soundness

Example 2

A UK consolidation group has a UK and international banking entity and the whole group operates under the brand name Bank CBD.

The international bank underwrites mortgages for international clients and owns a substantial share of the market, providing high levels of revenue to the UK consolidation group. In the event that the international bank is unable to provide mortgage underwriting for an extended period of time, it is likely to have a large financial impact on the UK consolidation group.

This could affect the safety and soundness of the group as a whole, and therefore the UK CRR firm. Therefore, the international bank’s mortgage underwriting services are an important group business service.

Figure 2: Example of impacts to a CRR firm’s safety and soundness

Example 3

A UK consolidation group within an international group contains a ServCo. The ServCo is owned by a UK CRR firm and provides significant post-trade processing services to third parties.

The ServCo is fully reliant on the income from its post-trade processing business to remain a viable business.

The value of the UK CRR firm’s investment in the service company is very large and the failure of the ServCo could result in a failure of the UK CRR firm. Therefore the ServCo’s post-trade processing services are an important group business service.

Figure 3: Example of impacts to a CRR firm’s safety and soundness

Implementation timeline for CRR consolidation entities

2.14. Two respondents commented that the proposed implementation date of Thursday 31 March 2022 would not allow sufficient time to implement the requirements for CRR consolidation entities. Having considered the responses, the PRA has inserted a new rule into Chapter 8 of the Operational Resilience Part of the PRA Rulebook, that CRR consolidation entities will be required to implement the changes within a reasonable timeframe, no later than Thursday 30 June 2022. The PRA considers that this would give CRR consolidation entities sufficient time to identify important group business services; set impact tolerances; and put into place sound, effective, and comprehensive strategies, processes, and systems. It should also allow the management body of the CRR consolidation entity time to approve the important group business services and impact tolerances.

Branches

2.15. One respondent asked whether Chapter 8 of the Operational Resilience Part applied to UK branches of international groups. The Operational Resilience Parts of the PRA Rulebook do not directly apply to branches. The PRA’s policy on operational resilience for branches is set out in SS5/21.^{footnote [8]}

Other clarifications

2.16. To provide greater clarity for firms, the PRA has decided to amend the definition of important group business services in Rule 1.2 of the Operational Resilience rules applicable to Solvency II firms. Rule 1.2 now states that an important group business service means a service provided by a member of ‘the’, rather than ‘a’, firm’s group. The PRA considers that this will provide firms with clarity in relation to the scope of policy, as firms must only set important group business services in relation to the group of which they are a member.

2.17. To better align with PRA Rulebook convention, the PRA has amended the title of the Operational Resilience rules applicable to Solvency II firms to ‘Insurance – Operational Resilience’. Throughout SS1/21, references to these rules have been updated with the new title.

2.18. The PRA has made consequential amendments to Rules 7.1 and 7.2 in the Operational Resilience Part of the PRA Rulebook applicable to CRR firms to remove the references to ‘important group business services’. The management body at the CRR firm must approve important business services and their impact tolerances. References to Rules 8.1 and 8.2 have been removed, as these rules have been deleted from Chapter 8 of the rules.

Operational Continuity in Resolution

2.19. The CP proposed to delete the word ‘other’ in Operational Continuity 2.3 in order to align Rule 2.3 with the PRA’s broad expectation in SS4/21, ‘Ensuring operational continuity in resolution’, that firms should ensure they can meet payment obligations for their critical services, including through recovery, resolution, and related restructuring.^{footnote [9]}

2.20. One respondent expressed support for the proposed change to the Operational Continuity Part because it will support consistency with the PRA’s other expectations in relation to OCIR. Another respondent commented that the proposal would not present any material increase in costs or resources required to implement the PRA’s revised OCIR policy, which will come into force on 1 January 2023.

2.21. The PRA has therefore made no changes to the policy as consulted on following these responses.