PRA, BoE, and FCA Finalize Policy Decisions on Operational Resilience

The following are the key highlights of the final policy package published by each supervisory authority:

• PRA published the policy statement PS6/21 that sets out new Operational Resilience Parts of the PRA Rulebook (Appendix 1), amendments to the Group Supervision Part of the PRA Rulebook (Appendix 1), a new supervisory statement SS1/21 on impact tolerances for important business services (Appendix 2), and a new Statement of Policy on operational resilience (Appendix 3). It also contains feedback to responses to the December 2019 consultation paper CP29/19 on operational resilience. After considering responses to CP29/19, PRA has amended certain aspects of the draft policy under the Operational Resilience Parts of the PRA Rulebook and SS1/21. PRA considers that these changes will not have a significant impact on firms and will not have a significantly different impact on "mutuals" than for other firms. PS6/21 will be effective from March 31, 2022 and is relevant to UK banks, building societies, and PRA-designated investment firms (banks) as well as the UK Solvency II firms, the Society of Lloyd’s, and its managing agents (insurers).
• BoE published individual policy statements and supervisory statements on the operational resilience expectations for central counterparties and central securities depositories. The policy on central counterparties and central securities depositories takes effect from March 31, 2022. Within a reasonable time after March 31, 2022 and in any event no later than March 31, 2025, central counterparties and central securities depositories are expected to take all reasonable actions to ensure they remain within their impact tolerances in the event of extreme but plausible disruption to operations. BoE also published a policy statement, supervisory statement, and Operational Resilience Chapter of the Code of Practice for Recognized Payment System Operators and Specified Service Providers. The amendments to the Code of Practice applies from March 31, 2022.
• FCA published the policy statement PS21/3 that sets out the final rules on operational resilience and provides feedback to the December 2019 consultation paper CP19/32. FCA mostly implemented the proposals as consulted on, with the exception of certain amendments to reflect the feedback received. PS21/3 applies to banks, building societies, PRA-designated investment firms, insurers, recognized investment exchanges, enhanced scope Senior Managers and Certification Regime (SM&CR) firms, and entities authorized and registered under the Payment Services Regulations 2017 or Electronic Money Regulations 2011. FCA rules and guidance will come into force on March 31, 2022. By March 31, 2022, firms must have identified their important business services, set impact tolerances for the maximum tolerable disruption, and carried out mapping and testing to a level of sophistication necessary to do so. Firms must also have identified any vulnerabilities in their operational resilience. As soon as possible after March 31, 2022, but no later than March 31, 2025, firms must have performed mapping and testing so that they are able to remain within impact tolerances for each important business service.

Related Links

• Joint Policy Decisions (PDF)
• PRA Notification
• BoE Policy and Supervisory Statements
• FCA Policy Statement
• Joint Discussion Paper, July 2018 (PDF)
• Consultation, December 2019

Effective Date: March 31, 2022

Keywords: Europe, UK, Banking, Insurance, Securities, Operational Risk, Investment Firms, BoE, PRA, FCA