The UK Financial Conduct Authority (“FCA”) published on July 5 a joint Discussion Paper with the Prudential Regulation Authority (“PRA”) and the Bank of England (“BoE”) on “Building the UK financial sector’s operational resilience.”

The Discussion Paper focuses on the ability of regulated firms and financial market infrastructures (“FMIs”) to “respond to, recover and learn from operational disruptions,” most notably cyber-attacks.  The supervisory authorities recognise that a lack of operational resilience represents a threat to financial stability and describe it “as no less important than financial resilience.”

The supervisory authorities invite feedback on several questions in the Discussion Paper from firms, trade associations, and consumer bodies as well as from individuals and businesses who use authorised or recognised entities’ business services.  The authorities will use responses to help develop potential proposals for consultation and develop their respective approaches.  The deadline to respond is October 5, 2018.

The supervisory authorities consider that the most effective way to manage operational resilience is to focus on “business services,” rather than systems and processes.  In order to do this, firms first need to understand the extent to which they may be prone to operational disruption.  Designing and managing operations based on the assumption that operations will be disrupted will help firms respond to these events, and ensure that they can continue to provide vital services.

Much of the Discussion Paper focuses on how firms can use “impact tolerance” testing — i.e., testing tolerance to disruptive events — to ensure operational resilience.  Determining a firm’s impact tolerance reflects the BoE’s Financial Policy Committee’s (“FPC”) recent Financial Stability Report (published June 2018), in which it described its own approach to testing the financial system for disruption caused by cyber-attacks, known as the “FPC’s impact tolerance.”  This is based on “the time after which disruption to services could cause material economic impact.”  Once the FPC has established its impact tolerance, it will then measure the ability of other firms to meet the same standards.

In terms of specific measures, the supervisory authorities indicate in the Discussion Paper that they expect an operationally resilient firm or FMI to have:

• a clear understanding of the most important business service or services;
• a comprehensive understanding and mapping of systems and processes that support these business services, including those over which the firm or FMI may not have direct control — this includes understanding the resilience of outsourced providers or entities within the same group but in another jurisdiction;
• knowledge of how the failure of an individual system or process could impact the provision of the business service; and
• knowledge of which systems and processes are capable of being substituted during disruption so that business services can continue to be delivered.

The importance of planning also is underlined in the Discussion Paper, specifically:

• tested plans that enable firms and FMIs to continue or resume business services when disruptions occur;
• effective internal communication plans, escalation paths and identified decision makers; and
• specific external communication plans for the most important business services, which provide timely information for customers, other market participants and the supervisory authorities.

The Discussion Paper also refers to the supervisory authorities obtaining assurances from firms that they are taking steps to ensure the continuity of their most important business services, and that boards and senior management are sufficiently engaged.  The use of the FPC’s impact tolerance stress-testing approach is one way of assuring firms are able to meet a certain standard.  In addition, the supervisory authorities indicate that they intend to: (i) review how impact tolerances are set and used by firms; (ii) gain assurances that firms have properly analysed their systems, people and processes that support business services; and (iii) gain assurances that firms have the capabilities to deliver operational resilience.  Supervisory authorities are likely to use questionnaires drawing on existing frameworks, such as the existing National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.