UK insurers given a year to improve operational resilience

Regulators in the UK have given financial institutions, including banks and insurers, a one-year deadline to improve their operational resilience. The policy statement (PS21/3) has been jointly issued by the Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA) and the Bank of England. The rules come into effect on 31 March 2022, by which time firms must be able to identify vulnerabilities in their operational resilience and set impact tolerance levels for their most important business lines. Firms will then have three years in which to perform mapping and testing, and make the necessary investment to operate consistently within their impact tolerances. In addition to banks and insurers, the regulations apply to investment firms, exchanges, building societies and payment providers. “The disruption caused by coronavirus (Covid-19) has shown why it is critically important for firms to understand the services they provide and invest in their resilience,” stated the FCA. “Operational disruptions can cause wide-reaching harm to consumers and pose a risk to market integrity, threaten the viability of firms and cause instability in the financial system,” added the FCA in its statement. The regulator has also said that it “retains the view that operational resilience is at least as important as financial resilience”. According to tech consultancy Capco, the rule change presents two main difficulties for firms. Firstly, the accelerated timetable. The one-year deadline will be “a real challenge for firms” as many would have expected to have several years to comply, stated Capco. The second issue is the broad and open-ended scope of the rules, designed to prevent operational resilience becoming a “tick-box exercise” and instead to become a “discipline embedded within firms and demonstrably overseen and led by senior management”, said Will Packard, operational resilience lead at Capco. “A big challenge for firms is that, while there is a high compliance bar to clear, there is no defined outcome, in that compliance will require an iterative approach to refining operational resilience on an ongoing basis. “This is essentially an open-ended exercise and firms will need to show real discipline and persistence to meet the spirit of the regulations,” said Mr Packard. There is also a reporting and monitoring challenge for firms, given that any breaches of impact tolerances will have to be disclosed to regulators, said Mr Packard. This is compounded by a lack of clarity on certain definitions. For example, said Mr Packard, firms must set impact tolerances in terms of harm to vulnerable customers – but the current broad definition provided by the FCA will make it difficult for firms to identify these individuals or groups within their client base. Mr Packard also said that while the regulation is focused on preparing and testing the resilience of a firm’s services, it says little about the information systems and management structures required to ensure the firm remains within its impact tolerances. “Firms therefore need to think hard about monitoring those parameters and their ability to mount a rapid response to avoid impending breaches in the face of disruption,” said Mr Packard.

UK insurers given a year to improve operational resilience

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Zurich North America names professional liability, cyber leader

Arch Insurance International names deputy CEO

Courage and collaboration needed to manage emerging construction sector risks

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Zurich North America names professional liability, cyber leader

Arch Insurance International names deputy CEO

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Zurich North America names professional liability, cyber leader

Arch Insurance International names deputy CEO

Related Articles