Thinking System Wide
THINKING SYSTEM-WIDE
Four achievable steps to help firms to master the stability and markets aspects of Operational Resilience
With the implementation deadline of March 2025 in the rearview mirror, UK financial institutions (FIs) have reached a major milestone in their compliance journey for the FCA/PRA Operational Resilience regime. However, the regulators have been keen to point out since March that compliance is not a once and done activity. FIs are expected to continue to evolve and mature their approaches, and to be prepared to confront a rapidly evolving risk landscape.
In addition, the regulators have been clear that they consider certain areas of existing compliance generally below par across the whole sector. One such area that they have called out frequently over the last 18 months is the adequacy of FIs’ attempts to assess or mitigate their potential to cause intolerable harm to financial stability and market integrity. It was perhaps no surprise, therefore, that this topic was the focus of the Bank of England’s keynote address at the recent Annual Conference for the Cross Market Operational Resilience Group (CMORG), in which Liz Oakes of the Bank’s Financial Policy Committee (FPC) spoke of FIs’ ‘shared responsibility for “thinking system-wide”’.
In a way, it’s quite natural that these aspects of the Operational Resilience regime have proved some of the trickiest for FIs to master. Unlike the potential intolerable harms Important Business Service (IBS) disruptions can cause to consumers and the safety of the firm, the harms associated with financial stability and market integrity are inherently more outward looking. They concern the broader financial and market ecosystems in which FIs operate and hence it can be a lot harder for individual firms to predict or understand when looking primarily to their internal data and processes for guidance.
For many leaders of Operational Resilience functions, the path to demonstrating credible progress on these aspects of the regime is unclear. The topic is difficult, and it requires thinking about an FI’s ability to trigger not only operational but also financial risks. Perhaps most challenging of all, it requires them to have some sense of the often-complex ways in which these two types of risk interact in the highly digitised world of modern financial services.
Understanding the Two Concepts
Whilst financial stability and market integrity are both more outward looking than either consumer/policyholder protection or firm safety and soundness, they are nonetheless fundamentally different concepts. To mature the approach to financial stability and market integrity, FIs must get clear on how these concepts differ from one another and to avoid the cardinal sin of conflating both into a single category of “market harm".
Market Integrity
This is covered under the FCA’s mandate. The term “market” is used to refer exclusively to financial markets (i.e., money, capital and insurance markets), but not non-financial markets such as those for housing or commodities (save related derivatives).
The notion of market integrity has traditionally been defined with reference to market abuses such as market manipulation or insider trading. On such a traditional rendering, a market with integrity is one in which the conduct of participants conforms to the agreed rules of engagement and so does not undermine the market’s fairness and efficiency in discovering prices.
However, the concept of market integrity has expanded over the years and come to be broader in scope. This is especially true of the way that the FCA defines it. These broader notions tend to encompass anything which undermines the fairness or efficiency of markets, whether this is driven by bad behaviour or merely bad fortune, such as operational shocks.
An example of the latter might involve a glitch in an automated trading platform which results in its accidental mass purchase of shares in Company X. This could lead to the market value of these stocks becoming artificially inflated for a time, undermining the ability of the market to settle on their real value of Company X shares and simultaneously giving an unfair advantage to those with existing holdings.
Financial Stability
This is covered by the PRA mandate under the direction of the Financial Policy Committee (FPC), the Bank of England body responsible for macroprudential oversight.
Financial stability is really all about systemic risks (i.e., risks to the UK financial system as a whole, as opposed to risks to the individual FIs which make up that system). Traditionally, much of the focus on systemic risk involving FIs has been centred on its more exclusively financial forms (e.g., asset bubbles, long-term trends in credit cycles, complex balance sheet interdependencies and associated counterparty exposures).
What makes the focus on financial stability within the context of Operational Resilience so unique is that the systemic risks at issue involve a mixture of both operational and financial elements. Here, it is the job of firms to understand how their specifically ‘operational disruptions […] can be the source of shocks to the wider financial system, or […] act as amplifiers in episodes of financial stress’.
An example of such a systemic shock driven by an internal operational disruption is the case in which an FI loses the ability to process outbound CHAPS payments but not inbound payments. Under these conditions, a so-called “liquidity sink” could emerge in which significant amounts of liquidity start to pool in the impacted FI, putting pressure on their counterparties to draw on liquidity reserves from elsewhere to fund their daily commitments.
Critically, FIs should take note that triggering financial instability is a higher bar to clear than undermining market integrity. This is because it is in general harder to trigger systemic risks to the financial system than it is to disrupt markets. They should also be clear that financial instability can be triggered by factors which sit outside of financial markets, such as declines in public trust in financial institutions. Financial stability is broader than just market stability, and FIs should careful not to confuse the former with the latter.
Four Priority Actions
Armed with clarity on this distinction, FIs may be strategizing on how best to approach maturing their approaches. Our advice to these organisations is to focus on the following four priority actions.
1. Get to know your systemic risk profile
Every FI has their own unique role to play within the UK financial system and the broader economy. This is responsible for shaping the characteristic ways in which a particular FI can trigger system-wide impacts through operational and financial shocks. Having a solid understanding of this systemic risk profile is vital to enabling Operational Resilience teams to know which IBSs have the potential to impact financial stability and setting the right impact tolerances.
Developing a good grasp on this requires taking a step back and looking holistically at the organisation as a whole, especially its role within the financial system. This will likely need to involve engagement with a diverse range of internal stakeholders, many of whom may not previously have had any involvement in Operational Resilience compliance, including financial risk teams and potentially internal treasury functions.
To date many FIs have instead adopted a more ad hoc approach, working backwards from the definition of specific IBSs to their potential to cause intolerable harm to financial stability. Regrettably, this has often involved little to no engagement with in-house financial risk specialists. In the absence of the broader context provided by a holistic view, these efforts are often short-sighted. The result is impact tolerance thresholds which are hard to justify and metrics for articulating those thresholds which bear little to no relationship with the way that IBS might drive financial instability.
When FIs have a robust understanding of their systemic risk profile, it is far easier for them to read across from specific IBS and the ways in which they might trigger system-wide stresses.
2. Understand if and how your IBS interact with markets
The next task can be more efficiently approached by looking at each individual IBS in turn. The objective here is to understand if and when your IBS may have the ability to directly or indirectly influence either equality of access or prices within a market.
Naturally, IBS which are focused on the booking or settlement of trades in financial markets are the primary candidates. So too are those IBS which involve the sale of retail investment products such as access to mutual funds and Exchange Traded Funds (ETFs). But FIs should be careful not to assume that these are the only IBS which have the potential to cause intolerable harm to market integrity. An example of a less obvious candidate would be any IBS which covers high-value payments, such as CHAPS. For whilst these IBS are not as directly focused on the trading of financial assets, they are critical to many of the high-value settlements of these trades. As such, they have the potential if affected to generate sufficient operational contagion and uncertainty in financial markets as to have an impact on price discovery and equality of market access.
More generally, FIs should make sure to thoughtfully assess the relation of every IBS to financial markets, even when it seems obvious on the surface that there isn’t one. This is vital to ensuring that you accurately scope which IBS require the setting of market integrity impact tolerances, but it is equally important for ensuring that you have a robust and consistent rationale for where one is not required. The regulators are looking to FIs to demonstrate that they have conducted the appropriate due diligence on the stability and markets aspects of Operational Resilience. Hence, having a clear and confident justification for ruling certain areas of IBS provision as out of scope is just as important as ruling the relevant areas as in scope.
3. Revisit your Financial Stability and Market Integrity impact tolerances
Having completed these first two actions above, FIs will be in a much stronger position to assess both 1) which IBS require market integrity and/or financial stability impact tolerances but also 2) what would serve as appropriate metrics and thresholds for articulating the point at which IBS disruption could cause intolerable harm to these two forms of common good.
FIs with a strong retail focus should in general expect to have fewer IBS with market integrity impact tolerances than IBS with financial stability impact tolerances. However, as alluded to above, FIs should also expect the impact tolerance thresholds articulating the point at which intolerable harm is caused to financial stability to in general be higher than those for market integrity.
Having completed a thorough review of your FI’s systemic risk profile and the connection of your IBS to financial markets, this scoping exercise might reveal that changes to your existing IBS framework are required. In many cases, this may involve having fewer impact tolerances in place than previously. You will be able to embrace these changes with confidence in the knowledge that you have a focused and robust understanding of the drivers of these forms of intolerable harm and can communicate a more nuanced and mature position in the next self-assessment.
Similarly, FIs who have chosen to adopt performance metrics in addition to time metrics for articulating impact tolerance thresholds will be in a much stronger position to determine whether these accurately predict the point of intolerable harm. Upon reviewing them, FIs may find that their existing metrics are neither direct nor indirect measures. In this case, they will be armed with the newfound understanding necessary to identify more appropriate metrics.
4. Proactively plan to mitigate systemic and market impacts
This step is perhaps the most important of all. In addition to revising impact tolerances, FIs should look to demonstrate to the regulators that they are taking proactive steps to minimise the ability of internal operational disruptions to trigger either financial instability or declines in market integrity.
Many FIs have adopted similarly proactive stances towards their ability to cause intolerable harm to the consumers and clients of their IBS. These so-called “Customer Treatment Strategies” have been used by FIs to soften the blow of IBS outages, minimising the risk of breaching consumer protection impact tolerances, thereby enhancing IBS resilience. They have also served as clear evidence to the FCA that FIs are taking the initiative and not simply approaching Operational Resilience compliance as a reactive box ticking exercise.
FIs who are serious about responding to the recent calls from the regulators to do more to mature the stability and markets aspects of their Operational Resilience compliance should be considering doing something similar. By developing “Market Treatment Strategies”, FIs can get out on the front foot, demonstrating the maturity of their understanding and their willingness to embed this into their existing playbooks and response strategies.
Put simply, Market Treatment Strategies should articulate what actions the FI would be willing and able to take to minimise impacts on market integrity and/or financial stability in the event of an internal operational disruption which might trigger such impacts. For the most part these actions will focus on financial, operational or informational interventions which would not increase the speed at which the affected IBS are restored but which treat the impacts which these disruptions cause to financial markets and the broader financial system.
In developing these Strategies, FIs can also draw heavily on their renewed understanding of their systemic risk profile and the role of their IBS in financial markets, maximising the utility of undertaking that initial work and ensuring alignment with new and improved impact tolerances.
In building out Market Treatment Strategies in this way, FIs will be able to demonstrate to the regulators that they have done more than simply review and update areas of their approach which have received challenge. They will have demonstrated a commitment to meaningful long-term improvement. Furthermore, they will be able to confidently and credibly evidence to the regulators that they have taken seriously their part in the shared responsibility for thinking system-wide.
How Beyond Blue Can Help
FIs looking to take decisive action to mature their approaches to the stability and markets aspects of Operational Resilience will need to move fast if they aim to provide a material progress update in the next self-assessment submission. By putting in place a plan to deliver against these four actions, they can demonstrate to the regulators they have a credible path forward.
Beyond Blue’s expert teams are ready to support, bringing a wealth of experience and technical expertise in both digital disruption to financial services and systemic risk. With a proven track record of implementing the four priority actions outlined above for systemically important UK FIs, our teams are uniquely positioned to secure your success in meeting these new regulatory expectations. In addition to our decades of experience across public and private sector industries, we have established ourselves as the trusted industry experts on Operational Resilience compliance, working with multiple major FIs to both ensure compliance and to embed a culture which prioritises resilience without stifling innovation.
Our strength is our people, our unique blend of expertise and our ability to deliver unparalleled Operational Resilience support tailored to your priorities and needs. We stand prepared to help you take the next steps in preparing for a complex digital future. For enquiries: enquiries@beyondblue.tech
Nicholas Currie
Principal Consultant
nicholas.currie@beyondblue.tech
Rayhaan Jeewa
Consultant
rayhaan.jeewa@beyondblue.tech
Want to speak to us?
If you would like to discuss a cyber or resilience problem with a member of the team, then please get in touch however you feel most comfortable. We would love to help you and your business prepare to bounce back stronger.
