Featured Product

    Lyndon Nelson of BoE on Ensuring Operational Resilience in Cyber Era

    June 05, 2019

    Lyndon Nelson, Deputy CEO and Executive Director, Regulatory Operations and Supervisory Risk Specialists, spoke in London about the ongoing work to ensure operational resilience in the financial services sector in UK, particularly in the face of increasing cyber threats. BoE expects to publish a discussion paper on operational resilience, which would contain recommendations for both the industry and regulators.

  • The information to be provided by a third party seeking authorization to assess the compliance of securitizations with the STS criteria provided for in Securitization Regulation should enable a competent authority to evaluate whether and, to what extent, the applicant meets the conditions of Article 28(1) of the Securitization Regulation. An authorized third party will be able to provide STS assessment services across EU. The application for authorization should, therefore, comprehensively identify that third party, any group to which this third party belongs, and the scope of its activities. With regard to the STS assessment services to be provided, the application should include the envisaged scope of the services to be provided as well as their geographical scope, particularly the following:

    • To facilitate effective use of the authorization resources of a competent authority, each application for authorization should include a table clearly identifying each submitted document and its relevance to the conditions that must be met for authorization.
    • To enable the competent authority to assess whether the fees charged by the third party are non-discriminatory and are sufficient and appropriate to cover the costs for the provision of the STS assessment services, as required by Article 28(1)(a) of Securitization Regulation, the third party should provide comprehensive information on pricing policies, pricing criteria, fee structures, and fee schedules.
    • To enable the competent authority to assess whether the third party is able to ensure the integrity and independence of the STS assessment process, that third party should provide information on the structure of those internal controls. Furthermore, the third party should provide comprehensive information on the composition of the management body and on the qualifications and repute of each of its members.
    • To enable the competent authority to assess whether the third party has sufficient operational safeguards and internal processes to assess STS compliance, the third party should provide information on its procedures relating to the required qualification of its staff. The third party should also demonstrate that its STS assessment methodology is sensitive to the type of securitization and that specifies separate procedures and safeguards for asset-backed commercial paper (ABCP) transactions/programs and non-ABCP securitizations.

    The use of outsourcing arrangements and a reliance on the use of external experts can raise concerns about the robustness of operational safeguards and internal processes. The application should, therefore, contain specific information about the nature and scope of any such outsourcing arrangements or use of external experts as well as the third party's governance over those arrangements. Regulation (EU) 2019/885 is based on the draft regulatory technical standards submitted by ESMA to EC.

     

    Related Links

    Effective Date: June 18, 2019

    Press Release
  • Proposed Rule 1
  • Proposed Rule 2
  • Proposed Rule 3
  • Presentation on Regulatory Framework (PDF)
  • Presentation on Resolution Plan Rules (PDF)
  • In his speech, Mr. Nelson highlights the importance of a strong collaboration when it comes to building resilience in the financial sector. He mentioned that, last year, the UK authorities had issued a discussion paper, setting out an ambitious and innovative outcome-based approach to enhancing operational resilience of the UK finance sector. At a policy level, the paper set out that firms should assume that operational disruption would occur and plan accordingly. The paper has received very positive feedback from industry and globally, particularly its outcome-based approach and the concept of impact tolerance but it also raised issues that require clarification, most notably the family tree of operational risk, operational resilience, operational continuity in resolution, and a number of other terms. The UK authorities will respond to this and other questions in the Autumn.  He also mentioned that the discussion paper is a joint document from different authorities such as the Financial Policy Committee, FCA, BoE's Financial Market Infrastructure supervisors, and PRA. This reflects how highly prized BoE considers collaboration to be in this area.

    Next, he offered an overview of the activities of the Cross-Market Operational Resilience Group (CMORG), which was historically chaired exclusively by BoE, but has now been re-shaped with the introduction of a co-chair structure—"I now co-chair with UK Finance." said Mr. Nelson. The most visible of CMORG’s activities is to support a regular cross-sector operational exercise program, which helps industry and authorities alike understand our operational capabilities when things go wrong and build capabilities to address these before they do. In addressing the threat from Cyber, BoE welcomes the announcement by UK Finance of the formation of the Financial Sector Cyber Collaboration Center, which promises to bring a step change to industry collaboration and, therefore, defensive capabilities on cyber. This is a great example of where firms can address risks that are unmanageable by firms individually by tackling the problem for the broader public good. There is still room for industry to go further. The last sector exercise identified a number of areas that lend themselves to this approach and a report will be released shortly about these. However, the key points are:

    • Developing ideas on how to protect systems and data more robustly against both accidental and deliberate damage
    • Balancing system availability with protecting data integrity during periods of operational stress
    • How to secure data against permanent loss, so that we can absolutely guarantee data integrity and availability
    • How to resume key services safely when disruptions have occurred, without losing data, damaging integrity, or causing contagion into the wider financial system

    Mr. Nelson said that these are all complex issues, which neither regulator nor firms can fix in isolation, but they do define the key operational disruptions scenarios for which better solutions are needed compared to those we have today. He concluded, that, in the next ten to twenty years, there is an opportunity to add to the many advantages of the UK by making it one of the most operationally resilient locations anywhere in the world. "Imagine being able to justifiably claim that even with operational disruption payments can be made and business can still be conducted after only a short delay. As a central bank and a regulator we are ready to take up the challenge."

     

    Related Link: Speech

     

    Keywords: Europe, UK, Banking, Cyber Risk, Operational Resilience, Cyber Testing, International Cooperation, CMORG, Operational Risk, PRA, BoE

    Related Articles
    News

    BIS Report Notes Existing Gaps in Climate Risk Data at Central Banks

    A Consultative Group on Risk Management (CGRM) at the Bank for International Settlements (BIS) published a report that examines incorporation of climate risks into the international reserve management framework.

    July 29, 2022 WebPage Regulatory News
    News

    EBA Publishes Multiple Regulatory Updates for Regulated Entities

    The European Banking Authority (EBA) published the final guidelines on liquidity requirements exemption for investment firms, updated version of its 5.2 filing rules document for supervisory reporting, and Single Rulebook Question and Answer (Q&A) updates in July 2022.

    July 29, 2022 WebPage Regulatory News
    News

    APRA Consults on Prudential Standard for Operational Risk

    The Australian Prudential Regulation Authority (APRA) is seeking comments, until October 21, 2022, on the introduction of CPS 230, which is the new cross-industry prudential standard on operational risk management.

    July 28, 2022 WebPage Regulatory News
    News

    EC Amends Rule on Securitizations; ESRB Updates Reciprocation Measures

    The European Commission published a Delegated Regulation 2022/1301 on the information to be provided in accordance with the simple, transparent, and standardized (STS) notification requirements for on-balance-sheet synthetic securitizations.

    July 27, 2022 WebPage Regulatory News
    News

    APRA Announces Revisions to Capital Framework for Banks

    The Australian Prudential Regulation Authority (APRA) is announced revisions to the capital framework for authorized deposit-taking institutions to implement the "unquestionably strong" capital ratios and the Basel III reforms.

    July 26, 2022 WebPage Regulatory News
    News

    EBA Examines Remuneration Data and Use of Large Exposure Exemptions

    The European Banking Authority (EBA) published a report that examines the use of certain exemptions included in the large exposures regime under the Capital Requirements Regulation (CRR).

    July 22, 2022 WebPage Regulatory News
    News

    UK Authorities Publish Discussion Paper on Critical Third Parties

    The Bank of England (BoE), the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA) published a joint discussion paper that sets out potential measures to oversee and strengthen the resilience of services provided by critical third parties to the financial sector in UK.

    July 22, 2022 WebPage Regulatory News
    News

    BoE Issues Update on Ongoing Data Transformation Program

    The Bank of England (BoE) issued a communication to firms to provide an update on the progress of the joint data transformation program—which is being led by BoE, the Financial Conduct Authority (FCA), and the industry—for the financial sector in UK.

    July 21, 2022 WebPage Regulatory News
    News

    EBA Issues Draft Methodology and Templates for 2023 Stress Tests

    The European Banking Authority (EBA) published the draft methodology, templates, and template guidance for the European Union-wide stress test in 2023.

    July 21, 2022 WebPage Regulatory News
    News

    EBA Issues SREP Guidelines and Standards for Investment Firms

    The European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) jointly published the final guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) for investment firms.

    July 21, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8407