New UK Regulation on Operational Resilience: What’s Next for Organisations?

Important Business Services (IBS) are described as services that, if they were to be disrupted, would cause irreparable harm to one or more of the firm’s clients or pose a danger to the UK financial system or market. 

In this new iteration, the PRA and FCA respectively introduced the concept of internal services and internal processes to cater for those services and processes which are critical to the delivery of IBS but cannot be considered IBS themselves. However, they will have to be thoroughly considered when creating the mapping of IBS dependencies.  Examples include processes like employee payroll or settlements, and services usually shared centrally such as HR functions or IT support. 

In other words, IBS must be externally facing and consider services that firms provide to their customers. 

Firms that are dual-regulated face the complexity of addressing both PRA and FCA rules, including setting separate impact tolerances to comply with the regulators’ different objectives (i.e. one for addressing potential harm to consumers; and another based on objectives to mitigate harm to financial stability, safety and soundness, and policyholder protection). The regulators have confirmed that firms will need to demonstrate that they have considered each of the PRA and FCA’s objectives when setting their impact tolerances.  

Following concerns raised by firms during the consultation phase, the regulators have clarified that work done to meet the objectives of one regulator “should be leveraged” to meet those of the other. However, they have set out that firms choosing to concentrate their efforts in ensuring they can remain within the more stringent tolerance must: 

• Consider both PRA and FCA objectives when setting impact tolerances 
• Ensure recovery and response arrangements are appropriate for both the shorter and longer impact tolerance  
• Build comprehensive scenario testing that considers plausible disruptions for both recovery horizons and not only the shorter tolerance. 

In addition, large firms can and should acknowledge that some business entities face more stringent requirements due to the nature of the business they do, local regulation, etc. It is recommended to allow lower impact tolerances for that entity given Group approval

Even though testing is the firm’s duty, third parties should be involved for this part of the operational resilience plan. The firm and its third-party partners should collaborate closely during the entire process, from mapping to testing. Furthermore, if companies deem it necessary, testing may be done by third parties. 

This is closely aligned with global regulatory trends in response to firms’ increasingly complex third- party environments and heavy cloud infrastructure. We can indeed see more stringent requirements being put on the management of third (and fourth) party dependencies by the PRA itself through the Outsourcing and Third-Party Risk Management Supervisory Statement, and by the European Union with DORA. Both introduce specific instructions for management accountability of third-party risk, monitoring of providers, pre-contract due diligence and exit strategies.

The risk of multiple disruptions affecting a single service should not have any impact on how organisations set their impact tolerances. The scenario for this exercise should be focused on the event of a single disruption. 

However, it may also happen that multiple IBS are disrupted at the same time. It might be the case if for example, a cyber-attack hits a group on a large scale. For that reason, firms are required to consider substitutability of each service and get a notion of which services are dependent on the same processes. It means that testing plans for such scenarios must include all IBS that will be affected at the same time.