On July 5, the Bank of England (BoE), UK Prudential Regulatory Authority (PRA) and UK Financial Conduct Authority (FCA) (together, the Supervisory Authorities) published a joint discussion paper on an approach to improve the operational resilience of firms and financial market infrastructures (FMIs) in the UK financial services sector.

The paper highlights the importance of operational resilience, which relates to the ability of firms, FMIs and the financial services sector to prevent, respond to, recover and learn from operational disruptions. Such disruptions (including cyber-attacks) have the potential to harm consumers and market participants, threaten the viability of firms and FMIs, and cause instability to the financial system.

The paper focuses on the concept of “impact tolerance” in order to encourage firms and FMIs to think differently by including an assumption that operational disruptions will occur, allowing for evaluation of the potential vulnerabilities in business and operating models.

The discussion paper suggests the following approach for potential supervisory expectations and assessment:

• Preparation: Firms and FMIs identify and focus on the continuity of their most important business services as a means of prioritizing their own analysis, work and investment in operational resilience. They set impact tolerances for their important business services and are able to demonstrate substitutability or the capability to adapt processes during disruption.
• Recovery: Firms and FMIs assume disruptions will occur and develop the means by which they can adapt their business processes and practices in the event of shocks, in order to preserve continuity of service.
• Communications: Firms and FMIs have strategies for communicating with their internal and external stakeholders, including the supervisory authorities and consumers. This should include how to handle the situation to minimize the consequences of disruption.
• Governance: Firms’ and FMIs’ boards and senior management are crucial in setting the business and operational strategies and overseeing their execution in order to ensure operational resilience.

The Supervisory Authorities encourage market participants to respond to the questions and other observations raised in the discussion paper. The deadline for responses is October 5.

The discussion paper is available here.