We use necessary cookies to make our site work (for example, to manage your session). Operational resilience is defined by the UK supervisory authorities as 'the ability of firms and Financial Market Infrastructures and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions.'. With the first policy milestone having passed on 31 March 2022, firms now have until no later than 31 March 2025 to be able to operate within their impact tolerances. The PRA states that it may issue a subsequent consultation paper with draft rules in 2015. 2.3 A firm's operational arrangements must ensure the continuity of the critical servicesit receives in the event of: (1) circumstances in which all or part of the business of any other member of itsgroupis likely to fail; or (2) the failure of all or part of the business of any other member of itsgroup. CP21/21 also contains proposals to make minor amendments the Operational Continuity Part of the PRA Rulebook; the PRA proposes an implementation date of 1 January 2023 for these changes. The PRA states that it has amended certain aspects of its proposed policy, the main ones applicable to insurers being as follows: To provide greater clarity for firms, the PRA has decided to amend the definition of important group business services in Rule 1.2 of the Operational Resilience rules applicable to Solvency II firms. The PRA has published Policy Statement 10/17: Ensuring operational continuity in resolution - reporting requirements (PS10/17).. In PS10/17 the PRA provides feedback to responses to Consultation Paper 28/16: Ensuring operational continuity in resolution - reporting requirements (CP28/16).In CP28/16 the PRA set out proposals for the data the PRA intends to collect in connection with the . This addendum clarifies the scope of application of the PRA's proposals in CP38/15, published in October 2015. PRA is proposing other minor formatting and clarification amendments to the Operational Resilience (Appendix 1) and Operational Continuity Parts of the PRA Rulebook (Appendix 3), along with the consequential amendments to the supervisory statement SS1/21 on operational resilience (Appendix 2). The PRA has made a consequential amendment to Operational Continuity 1.1 to ensure that the change in the definition does not change which firms are in scope of the rules. BoE has updated the Operational Continuity in Resolution section of the Statement of Policy as well as the sections where firms' submissions and disclosures under the Resolution Assessment Part of the PRA Rulebook in 2020/21 were mentioned. According to the PRA, when firms outsource functions to third parties, they remain responsible for those functions. This followed draft rules published in December 2019 as part of Consultation Papers CP19/32 (FCA) and CP29/19 (PRA). Ring-fenced Bodies. The FCA has published its findings from a recent review of business continuity planning (BCP) among small and medium-sized retail banks, payments institutions and electronic money institutions. 1 Introduction; 2 Operational arrangements for critical services; 3 Facilitating recovery and resolution; 4 Scope of Outsourcing; Sunday 1 January 2023 for the Operational Continuity Part. Whilst it might sound like an easy task, operational resilience is actually a complex process that goes beyond crisis . . The Financial Conduct Authority (FCA) in the UK defines operational resilience as "the ability of firms and financial market infrastructures, and the financial sector as a whole, to prevent, adapt, respond to, recover and learn from operational disruptions.". The regulator is holding a consultation until 3 April on proposed new guidance on outsourcing and third party risk management. 1. . Guidance, the UK Prudential Regulation Authority (the "PRA") issued on 7 July 2016 a policy statement on ensuring operational continuity in resolution (PS21/16) (the " PRA Policy Statement"). The PRA's consultation paper "Operational resilience: Impact tolerances for important business services" (CP29/19) CP29/19 proposes to implement (i) amendments to the PRA Rules which will introduce a regulatory framework in relation to operational resilience; and (ii) a Statement of Policy (SoP) setting out the PRA's approach to the . However, they say that if the internal services are part of the "chain" of activities which underpin an According to the PRA's operational resilience policy, firms should be operationally resilient irrespective of how they utilize outsourcing and third-party services. Table of Contents + Expand all headings Expand side bar > SS9/16 - Ensuring operational continuity in resolution. This chiefly introduces the requirement, which must be complied with "within a reasonable time" and by no later than 30 June 2022, for certain operational resilience group obligations to be applied to CRR consolidation entities. Additionally, the rules complement PRA and FCA requirements on operational resilience, also published on 31 March 2021. . Following the Prudential Regulation Authority's (PRA) publication last week of a series of four Consultation Papers concerning Bank Resolution and Operational Continuity in Resolution (OCIR), some of the more interesting takeaways covered the Regulator's perspectives on how resolution and operational resilience will interact. on a standalone basis; the PRA is giving priority to those services which are outward facing. For a long time, operational continuity remained a relatively unknown term outside of the hallowed . The discussion paper is one of four . The Bank of England (BoE) and the Prudential Regulation Authority (PRA) are consulting in parallel on a package of proposals relating to their policies for operational continuity in resolution (OCIR). proposals to apply the group provisions in the Operational Resilience Part of the PRA Rulebook relevant to Capital Requirements Regulation (CRR) firms to holding companies, and to make other minor formatting and clarification amendments to the Operational Resilience Worldbuilding: the Master Guide (with Template) The Continuity of Change. Disruption could be caused by a variety of different factors including, for example, a cyber . Mr Mackinnon notes that firms' processes for existing requirements, such as their disaster recovery and business continuity testing, could be used as part of the implementation of operational . PRA published a new waiver by consent to waive the Continuity of Access requirements contained in the Depositor Protection Part of the PRA Rulebook (DPP). 3. Simply said, operational resilience is the ability of organisations to adapt during times of crisis or disruption, and effectively manage operational risks like cyber threats, technology failures, economic or natural disasters. The new Supervisory Statement would supersede Supervisory Statement 9/16 'Ensuring operational continuity in resolution'. The Prudential Regulation Authority (PRA) published an addendum to Consultation Paper (CP) 38/15 'Ensuring operational continuity in resolution'. The amendments to the Operational Resilience, InsuranceOperational Resilience and Group Supervision Parts, and the updated SS1/21, take effect on 31 March 2022, and the amendments to the Operational Continuity Part take effect on 1 January 2023. 21.2 An operational continuity firmmust submit to the PRAannually (on a calendar year basis), within 45 business daysafter the end of the calendar year, the completed data itemPRA109. The PRA's new rules and guidance on operational resilience will come into force on 31 March 2022 and its rules on OCIR will come into force on 1 . However, these third-party arrangements are still subject to the PRA Fundamental Rules and other PRA requirements and expectations on business continuity, governance, operational resilience, and risk management. The current waiver by consent (and individual waivers) for the Continuity of Access rules expires on December 01, 2019. Operational Resilience vs. Outsourcing to Third-Party Providers. The FCA and PRA have proposed new rules for inclusion in the FCA Handbook and the PRA Rulebook. The note will be of particular . Deposit-takers should consider whether they meet one of the three . The Supervisory Statement is the result of a consultation paper (38/15) of the same title and is relevant to UK banks, building societies and PRA-authorised investment firms to which the Operational Continuity Part of the PRA Rulebook applies. Handbook and PRA Rules and new PRA Supervisory Statement). PRA 2017/21 Annex B Amendments to the Operational Continuity Part In this Annex, new text is underlined and deleted text is struck through. In light of the final OCIR policy of PRA, BoE also clarified the following: . The end of March saw a flurry of activity on operational resilience as the UK regulators published final policy on operational resilience and, for the UK Prudential Regulation Authority (PRA), final rules on outsourcing and third party risk management while the Basel Committee on Banking Supervision (BCBS) issued its new Principles for Operational Resilience and revised Principles for the . PRA - Prudential Regulation Authority; Supervisory Statements; 2016; Information; Table of Contents. The . 1 January 2019 is the critical date in the UK regulatory calendar: that is when the UK Prudential Regulatory Authority's (PRA) operational continuity requirements come into effect. or be part of firms' scenario testing under Operational Resilience. 2: Feedback to responses 2.1. The new rules and guidance relating to operational resilience and outsourcing will apply to a broad range of firms including banks, building societies, designated investment firms, insurance firms, e-money and payment services firms. Banks are working furiously to meet this regulatory deadline. 2 FACILITATION OF EFFECTIVE RECOVERY AND RESOLUTION PLANNING 2.3 A firm's operational and financial arrangements must ensure the continuity of the critical servicesit receives in the event of: The PRA has published updates to its policy and a revised supervisory statement on ensuring operational continuity in resolution (PS 9/21 and SS4/21) following its consultation paper in October. The proposals would make amendments to the Operational Continuity Part of the PRA Rulebook (see Appendix 1) and PRA OCIR expectations, and would result in a new Supervisory Statement on OCIR (Appendix 2). Amendments to the Operational Continuity Part In this Annex deleted text is struck through. 1.1 This Prudential Regulation Authority (PRA) supervisory statement is relevant to UK banks, building societies and PRA-authorised investment firms (hereinafter 'firms') to which the Operational Continuity Part of the PRA Rulebook applies.. 1.2 The purpose of this supervisory statement is to set out the PRA's expectations on firms to ensure operational continuity of critical services to . The term 'essential services' will not be introduced. In this consultation paper, the PRA outlines new proposals to apply to the group provisions in the Operational Resilience Part of the PRA Rulebook, which will be . The PRA expects resilience to be embedded in the way firms do business and for it to become a major consideration in their investment programmes. Other UK standards: PS7/21 and SS2/21 are designed to 'complement the requirements and expectations on operational resilience' in the PRA Rulebook, SS1/21 'Operational resilience: Impact tolerances for important business services' and the Statement of Policy 'Operational resilience'.The latter were published on the same day as the materials on outsourcing and form 'a helpful lens . Download this At a glance to see our summary of the updates to the PRA's operational continuity in resolution regime. The new SS would supersede SS9/16 'Ensuring operational continuity in resolution'. This series is split in three parts: Part 1 includes an overview of the most recent operational resilience regulatory developments in the UK. Except in relation to those functions described in SYSC 8.1.5R and (for a common platform firm in article 30(2) of the MiFID Org Regulation)7, where a firm relies on a third party for the performance of operational functions which are not critical or important . 3 The outputs will allow the PRA to continue developing rules . 11.03.2022. PRA has inserted a new rule into Chapter 8 of the Operational Resilience Part of the PRA Rulebook and extended the timeline to implement the requirements for CRR consolidation entities from March 31, 2022 to June 30, 2022. The PRA has issued a policy statement on operational resilience and operational continuity in resolution (OCIR). Looking through both the Consultation Paper and the proposed . 2.3 A firm's operational and financial arrangements must ensure the continuity of the critical servicesit receives in the event of: (1) circumstances in which all or part of the business of any other member of itsgroupis likely to fail; or (2) the failure of all or part of the business of any other member of itsgroup. The proposals would make amendments to the Operational Continuity Part of the PRA Rulebook (Rules) (see Appendix 1) and PRA OCIR expectations, and would result in a new Supervisory Statement (SS) on OCIR (Appendix 2). The Operational Continuity Part continues to apply to firms that perform a critical function. The Financial Conduct Authority (FCA) in the UK defines operational resilience as "the ability of firms and financial market infrastructures, and the financial sector as a whole, to prevent, adapt, respond to, recover and learn from operational disruptions.". the core requirements set out in the prr handbook state that firms must: 1. identify and document the details of the critical services they receive and details of the critical services required to deliver each of their critical functions and core business lines; and 2. be able to demonstrate they can put in place transition arrangements for the The PRA also issued with the policy statement a new "Operational Continuity" part of the PRA Rulebook, Simply said, operational resilience is the ability of organisations to adapt . Simply said, operational resilience is the ability of organisations to adapt . Operational Resilience Part of the PRA Rulebook relevant to Capital Requirements Regulation (CRR) firms to holding companies, and to make other minor formatting and clarification amendments. PRA Rulebook: CRR Firms, Non-CRR Firms, Solvency II Firms and Non Solvency II Firms: Senior Managers Regime and Senior Insurance Managers Regime (Amendment) (No 1) Instrument 2018 this link opens in a new window. The Operational Continuity Instrument 2016 sets out the final text of the new Operational Continuity Part of the PRA Rulebook and will come into effect on January 1, 2019. Finally, SS2/21 retains the definition of "material" from the PRA Rulebook but clarifies that materiality should be read as incorporating the concept of a "critical or important operational . operational Continuity in Resolution and resolvability. 2.2. The proposals would amend the Operational Continuity Part of the PRA Rulebook and PRA OCIR expectations, and would lead to a new Supervisory Statement on OCIR. UK Financial Services Law, PRA - Prudential Regulation Authority, Consultations, 2021 Consultations Banks/Credit Institutions, Capital Requirements, Capital Requirements Legislation - CRD IV/V, CRR/CRR2, Insurance & Reinsurance, Insurance and Reinsurance Directive - Solvency II, Mutual Societies, Operational resilience, Recovery and Resolution, Solvency II questions surrounding operational continuity, the PRA recently published a Discussion Paper (DP 1/14) on the topic and initiated a three month consultation. 28/06/2018. PRA2018/16 this link opens in a new window. The UK Prudential Regulation Authority (PRA) has published a consultation paper on operational continuity for larger retail and investment banks.It follows on from a 2014 discussion paper on the . order to comply with other regulatory requirement such as operational continuity in resolution (OCIR), business continuity planning, operational risk, . Clear roles and responsibilities should be assigned for business continuity and exit plans . We also agree with the PRA's analysis that the proposed changes to the Operational Continuity part of the Rule book are minor, clarificatory and will . a revised version of the PRA supervisory statement, Operational resilience: Impact tolerances for important business services ; and; PRA Rulebook: CRR Firms: Operational Continuity Instrument 2022 . . application thresholds set out in 1.1 of the Operational Continuity Part of the PRA Rulebook.2 1.3 The operational continuity policy support s the resilience and resolvability of firms including by seeking to ensure that group providers of critical services supporting suc h The final rules (documented within two Policy Statements) demonstrate the Regulators' reluctance to make major changes to its draft rules based on a large volume of responses. Firms that are dual regulated face the complexity of applying both the FCA and PRA's rules, including the . Developments continue at the domestic and international level. The continuity of critical shared services is a crucial 2 part of the process of identifying and removing impediments to . Archive . SS2/21 clarifies the application of the principle of proportionality to intragroup outsourcing and to "non-significant firms." On 25 November 2021, the PRA published Consultation Paper 21/21: Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience) (CP21/21).In CP21/21 the PRA sets out proposals to apply the group provisions in the Operational Resilience Part of the PRA Rulebook relevant to Capital Requirements . This goes further than business continuity planning and operational continuity which deal with siloes of functions and individual processes that make up a whole business service. 25th November 2021 - UK PRA Consultation on Operational Resilience & Continuity Search for: The proposal introduced by the consultation paper would apply the group provisions in the Operational Resilience part of the PRA Rulebook relevant to Capital Requirements Regulation (CRR) firms to Holding Companies. On 25 November 2021, the PRA published Consultation Paper 21/21: Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience) (CP21/21).. The new SS would supersede SS9/16 'Ensuring operational continuity in resolution'. On 25 November 2021, the PRA published Consultation Paper 21/21: Operational Resilience and Operational Continuity in Resolution: CRR firms, Solvency II firms, and Financial Holding Companies (for Operational Resilience) (CP21/21).In CP21/21 the PRA sets out proposals to apply the group provisions in the Operational Resilience Part of the PRA Rulebook relevant to Capital Requirements . Published on 28 May 2021 First published on 7 July 2016 This supervisory statement is relevant to UK banks, building societies and PRA-authorised investment firms (hereinafter 'firms') to which the Operational Continuity Part of the PRA Rulebook applies. Regulators publish rules on operational resilience for finance sector. Specifically, it does not include internal services (such as HR) per se, i.e. To support EU financial services organisations on their journey to compliance we have compiled the key EU regulations around IT outsourcing, highlighting specific rules and guidance around business continuity and contingency planning for critical functions. Part 2 addresses the regulatory framework on operational resilience in the EU, and includes a table summarising the key UK and EU rules and guidelines relating to operational resilience. Banks, insurers and investment firms should seek clarification from the UK's Prudential Regulation Authority (PRA) over their obligations around data when engaging outsourcing providers. We'd also like to use some non-essential cookies (including third-party cookies) to help us improve the site. This follows on from their joint Discussion Paper published in July 2018 and resulting consultation papers (CPs . In CP21/21, the PRA proposed that certain group obligations in the Operational Resilience Part of the PRA Rulebook, relevant to Capital Requirements Regulation (CRR) firms, should apply to CRR consolidation entities. SYSC 4.1.1 R requires a firm to have effective processes to identify, manage, monitor and report risks and internal control mechanisms. On October 6, 2014, the Prudential Regulation Authority ("PRA") published a discussion paper on ensuring operational continuity in resolution in banks, building societies and investment firms regulated by the PRA. Financial institutions should expect their outsourcing and third-party risk management practices to come under increased scrutiny as part of the growing regulatory focus on the operational resilience of the financial services sector. Before making any proposed rules, the PRA is required by FSMA to have regard to any representations made to it, and to publish an account, in general terms, of those representations and its feedback to them. Download At a glance - Updates to Operational continuity in resolution Contact us Rakesh Majithia Partner, PwC United Kingdom Tel: +44 (0) 7803 023856 Email Duncan Scott The PRA proposes that these changes . Following the publication of the PRA's final rules and Supervisory Statement on "Ensuring operational continuity in resolution", Berwin Leighton Paisner LLP's Usman Wahid has produced a short note on key operational and contractual areas for firms covered by the rules ("regulated firms") to consider. Operational resilience is the ability of firms, financial market infrastructures and the financial sector as a whole to prevent, adapt and respond to, recover and learn from operational disruption. The series of coordinated consultation papers on operational resilience, published by the UK supervisory authorities in December 2019, provide the strongest . 24 February 2020 17:54 Insights paper: EU Financial Services Guidance for IT Outsourcing Regulation and Managing Third-Party Risk. The wider context The UK's rules are a piece of the operational resilience jigsaw. What are the proposals? The proposals would make amendments to the Operational Continuity Part of the PRA Rulebook (Rules) (see Appendix 1) and PRA OCIR expectations, and would result in a new Supervisory Statement (SS) on OCIR (Appendix 2). continuity of services to end users. a part of the requirement of firms to manage risks prudentially and, if necessary, hold capital buffers. Although the findings suggest that many firms have taken meaningful steps to build operational resilience into their systems and processes, the FCA also . On 29 March 2021, the Bank of England, FCA and PRA jointly issued a paper explaining their policy on strengthening operational resilience in the financial sector.