The UK Financial Conduct Authority (“FCA”) published on July 5 a joint Discussion Paper with the Prudential Regulation Authority (“PRA”) and the Bank of England (“BoE”) on “Building the UK financial sector’s operational resilience.”

The Discussion Paper focuses on the ability of regulated firms and financial market infrastructures (“FMIs”) to “respond to, recover and learn from operational disruptions,” most notably cyber-attacks.  The supervisory authorities recognise that a lack of operational resilience represents a threat to financial stability and describe it “as no less important than financial resilience.

The supervisory authorities invite feedback on several questions in the Discussion Paper from firms, trade associations, and consumer bodies as well as from individuals and businesses who use authorised or recognised entities’ business services.  The authorities will use responses to help develop potential proposals for consultation and develop their respective approaches.  The deadline to respond is October 5, 2018.

The supervisory authorities consider that the most effective way to manage operational resilience is to focus on “business services,” rather than systems and processes.  In order to do this, firms first need to understand the extent to which they may be prone to operational disruption.  Designing and managing operations based on the assumption that operations will be disrupted will help firms respond to these events, and ensure that they can continue to provide vital services.

Much of the Discussion Paper focuses on how firms can use “impact tolerance” testing — i.e., testing tolerance to disruptive events — to ensure operational resilience.  Determining a firm’s impact tolerance reflects the BoE’s Financial Policy Committee’s (“FPC”) recent Financial Stability Report (published June 2018), in which it described its own approach to testing the financial system for disruption caused by cyber-attacks, known as the “FPC’s impact tolerance.”  This is based on “the time after which disruption to services could cause material economic impact.”  Once the FPC has established its impact tolerance, it will then measure the ability of other firms to meet the same standards.

In terms of specific measures, the supervisory authorities indicate in the Discussion Paper that they expect an operationally resilient firm or FMI to have:

  • a clear understanding of the most important business service or services;
  • a comprehensive understanding and mapping of systems and processes that support these business services, including those over which the firm or FMI may not have direct control — this includes understanding the resilience of outsourced providers or entities within the same group but in another jurisdiction;
  • knowledge of how the failure of an individual system or process could impact the provision of the business service; and
  • knowledge of which systems and processes are capable of being substituted during disruption so that business services can continue to be delivered.

The importance of planning also is underlined in the Discussion Paper, specifically:

  • tested plans that enable firms and FMIs to continue or resume business services when disruptions occur;
  • effective internal communication plans, escalation paths and identified decision makers; and
  • specific external communication plans for the most important business services, which provide timely information for customers, other market participants and the supervisory authorities.

The Discussion Paper also refers to the supervisory authorities obtaining assurances from firms that they are taking steps to ensure the continuity of their most important business services, and that boards and senior management are sufficiently engaged.  The use of the FPC’s impact tolerance stress-testing approach is one way of assuring firms are able to meet a certain standard.  In addition, the supervisory authorities indicate that they intend to: (i) review how impact tolerances are set and used by firms; (ii) gain assurances that firms have properly analysed their systems, people and processes that support business services; and (iii) gain assurances that firms have the capabilities to deliver operational resilience.  Supervisory authorities are likely to use questionnaires drawing on existing frameworks, such as the existing National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.

Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.