UK financial regulators focus on "operational flexibility"

The new loopholes discovered by digital technology reshaping the financial service industry have prompted all parties to be concerned about the operational flexibility of financial service providers. Operational flexibility refers to the ability of enterprises and financial market infrastructure providers to prevent, adapt, and recover from operational disruptions and learn lessons from them. In this regard, on December 5, 2019, the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) jointly issued a draft for comments on enterprises and financial market infrastructure providers: “Building the Operational Flexibility of the UK Financial Industry”, which was further expanded and formed on the basis of the 2018 discussion draft. Its main contents include: enterprises and financial market infrastructure providers should judge the aforementioned changes beyond their own commercial interests based on the transformative impact of the assessment technology on their business services. Then, the tolerance of interruption should be set for each core business accordingly, and sustainable operation can be guaranteed within the tolerance (under serious but reasonable circumstances). In addition, core business should be planned and tested to identify vulnerabilities in operational flexibility and respond as necessary.

Megan Butler, executive director of the FCA's Investment Supervision Department, believes that threats and challenges have become more obvious in the crisis-ridden network environment and large-scale technological changes. Therefore, operational flexibility has become an important part of protecting the financial system, financial institutions, and financial consumers. A flexible financial system can provide the most important services with the least disruptions, which is in the public interest, even for serious operational disruptions. The publication of the consultation document aims to achieve this goal.

It is mentioned in the consultation document that enterprises and financial market infrastructure should:

(1) Determine what its important business services are. If these services are interrupted, what damage may be caused to consumers or the integrity of the market, whether it will threaten the viability of the company or cause the instability of the financial system.

(2) Set impact tolerance for each important business service, that is, quantify the maximum damage that these services can withstand.

(3) Identify and record the personnel, processes, technologies, facilities, and information that support its important business services.

(4) Take action to keep the ability of these services to withstand operational interruption within the permissible range.

Sam Woods, PRA's chief executive officer and vice president in charge of prudential supervision, said: "Operational flexibility is an important part of the company's safety and stability, and it has become an important priority of PRA." This consultation signifies that we have incorporated operational flexibility into the next stage of the regulatory framework. At the same time, our proposals on outsourcing and cloud computing will guide companies to maintain flexibility in adopting new technologies.

Jon Cunliffe, the deputy governor in charge of financial stability, said: “Financial market management information systems, including wholesale and retail, are the core of the financial sector. They are the channels through which the financial system operates. Therefore, the safe and flexible operation of the enterprise and financial market infrastructure is very important for our bank to achieve the goal of financial stability. Not only do businesses and financial market infrastructure need to consider what steps they need to take to minimize operational disruptions, but also how quickly they can recover from operational disruptions."

As a supplement to the operational flexibility policy recommendations, PRA issued a consultation document on “outsourcing and third-party risk management”. PRA hopes that enterprises should ensure that their important business services can remain within their scope of influence, even if these services rely on outsourcing or third-party suppliers.

Why focus on operational flexibility? There are mainly the following areas:

1. Cyber threats and maintenance pressure

2. Changes in customer needs and digitalization of financial services

3. Internal pressure to prevent reputation risks.

The operating environment of financial services is changing rapidly and facing a lot of pressure. Therefore, it is not difficult to understand that operational flexibility is also facing challenges, as follows:

1. Set tolerance for operational disruption

2. Managing third-party relationships are becoming more and more important

3. The daunting challenge of data security

4. Scenario testing that needs improvement

In the public interest, even in severe operational incidents, a flexible financial system should always strive to ensure the continuity of its important business services with minimal interruption. Therefore, in recent years, operational flexibility has been the top priority of regulatory agencies. However, the improvement of operational flexibility faces many challenges. This not only requires companies to start from the public interest, change their way of thinking, and correctly understand operational flexibility, but also requires companies to establish clear internal responsibilities to manage operational flexibility, so that every senior manager knows their responsibilities. At the same time, the regulatory authorities should proceed from the goal of business service continuity and constantly review the regulatory methods for the industry.