During a speech given at the London Institute of Banking and Finance, Sasha Mills, Executive Director, Financial Market Infrastructure, at the Bank of England, has set out the Bank’s vision for operational resilience and explained what it is looking for from Financial Market Infrastructures (FMIs) in the run up to the March 2025 Operational Resilience Policy compliance deadline.
Key points from the speech include:
- The aim is that by the March 2025 Operational Resilience Policy compliance deadline crucial bits of financial market infrastructure are able to respond to and recover from an extreme but plausible disruption scenario before the market or payments ecosystem it serves is destabilised.
- A major focus of [the Bank’s] supervisory activity is in maintaining confidence in FMIs through ensuring they are operationally resilient… “When we talk about firms being ‘operationally resilient’, we mean firms can prevent, respond to, recover from, and learn from these disruptions. Disruptions could come from a variety of places. Cyber-attacks are one of the most frequently cited risks to UK financial stability we see in our industry engagement, but we are also concerned about events like natural disasters or operational errors.”
- Over recent years, the Bank has put in place policies on operational resilience and outsourcing and third party risk management. “We are about to finalise a third plank of these policies later this year with the publication of rules for firms that provide critical services to the financial sector.”
- The first component of the Bank’s Operational Resilience Policy “asks FMIs to identify which business services are important to financial stability – or put another way, services which, if disrupted, could threaten financial stability. Then, we ask firms to say what level of disruption those important business services could experience before risking financial stability, and we call this an ‘impact tolerance’. While expressing impact tolerances in terms of time is necessary to plan for continuity of an important business service, FMIs should consider if there are other metrics that could play a useful role.”
- FMI’s “also need to consider how data integrity (or lack of) may impact time to recover – any recovered data that will be used in critical processes, once restored, needs to be checked to be accurate, complete, valid, and reliable. Obviously as supervisors we will probe how FMIs are thinking about these questions – this is not ‘one size fits all’.”
- “Having identified the important business services and impact tolerances, we expect FMIs to show they can meet those impact tolerances – that is to recover their services within tolerance – under a variety of extreme but plausible disruption scenarios. Now, having processes and operations which meet this bar doesn’t happen overnight, so we have given FMIs several years and a deadline of March 2025 to meet this required standard of resilience.”
Up to March 2025 and beyond
- Less than a year out from the March 2025 deadline, there is still a lot of work for FMIs and regulators to do.
- FMIs should “be fully testing their ability to remain within impact tolerances for ‘extreme but plausible’ scenarios – ensuring that response plans and capabilities are robust, and where not, that strategic investment is being made. This is a key requirement.”
- “For the calibration of impact tolerances, we expect to see greater engagement than we have seen thus far between FMIs, their participants, and the wider market.”
- “Another area that still requires significant work is the approach and method FMIs use to test disruption to important business services.”
- We “expect to see FMIs working to ensure that the ‘extreme but plausible’ scenarios they have planned for directly link to the risks and vulnerabilities they face and have mapped. This is not an off the shelf set of scenarios. It’s important that the scenarios chosen are indeed of an ‘extreme but plausible’ scale.”
- “FMIs need to do further work to improve on the sophistication of their testing approaches, looking for testing methods in addition to tabletop and desktop exercises. Testing types and methods should be as realistic and sophisticated as possible, covering recovery of all critical systems, services, and data – whilst also of course ensuring the testing itself does not introduce any additional risk. Operational resilience testing should also consider the impact of disruption on the wider eco-system that the FMIs operate in, and FMIs should increase their efforts to involve critical third parties and their participants within their testing.”
- “The Bank expects FMIs to prioritise their efforts on scenario testing over the next year so that they can identify vulnerabilities sufficiently early to remediate them before March 2025. We’ll be continuing to look over the coming year for robust remediation plans from FMIs, with appropriate funding and resources dedicated to address weaknesses found during testing. The speed at which vulnerabilities are remediated should reflect the potential impact to the financial sector that disruption, associated with that vulnerability, would cause.”
- “Whilst the March 2025 deadline represents a significant milestone, it is also not the end of the story and should not be seen as a ‘one off’ event – after the deadline, FMIs will need to continue to monitor and improve their operational resilience as risks and technologies evolve. Cyber threat actors who seek to harm the financial system will not stop developing their techniques, so FMIs need to remain vigilant to the changing threats they are exposed to.”
