On the 10th of January 2023, Nathanaël Benjamin (Executive Director Authorisations, Regulatory Technology, and International Supervision) and Rebecca Jackson (Director Authorisations, Regulatory Technology, and International Supervision) published an open letter to International Banks active in the UK, setting out the PRA’s 2023 priorities for this sector.
We have summarised the main priorities below.
Operational Risk and Resilience
The regulator will continue to maintain focus on assessing firms against the PRA’s operational resilience rules as set out in the Supervisory Statement (SS) 1/21 regarding Impact Tolerances for Important Business Services(IBS). The PRA focus will be on using this framework, and the testing that firms are conducting, to assess whether they can remain within their Impact Tolerance for each IBS.
In response to increasing digitisation, changes in payment systems, and the need to address legacy IT systems, many firms are executing large and complex programmes of IT change. The PRA expects these changes to be well managed with the associated transition and execution risks appropriately mitigated.
The PRA observed a material increase in outsourced services, particularly to cloud providers. Firms are expected to manage the risks from using outsourced cloud services and to work towards full Outsourcing and Third-Party Risk Management compliance as set out in SS2/21.
The PRA also pointed out that the number of firms offering crypto products continues to grow, presenting new challenges for risk management. So, these firms will continue to be monitored, with the expectation that they have fully understood the impact crypto products will have on their Operational Resilience, and have met the PRA supervisory expectations as set out in SS1/21 before engaging with these opportunities in any material way.
Financial Resilience
The operating environment for all firms is expected to remain challenging in 2023. It is crucial that firms manage their financial resources to ensure that the financial sector can continue to support businesses and households. Firms should take proactive steps to assess the implications of the changing economic outlook. The PRA will maintain focus on financial resilience through ongoing assessments of individual firms’ capital and liquidity positions, as well as how these may evolve in light of potential headwinds.
Risk Management and Governance
The PRA expects that firms have learnt from previous crises, and have embedded lessons learnt across the first and second lines of defence. The regulator expects firms to reflect on their risk management, governance, and control frameworks. This should include a comprehensive review of onboarding and due diligence practices, as well as counterparty pricing and margining frameworks.
Firms should also undertake a thorough review of their counterparties and stress test counterparty exposures in a way that considers how these frameworks operate in practice, to better understand ex-ante risks across a wide range of situations and ensure appropriate risk mitigation in a crisis while continuing to support the broader economy.
The PRA will continue to assess firms’ risk management and control frameworks through individual and cross-firm thematic reviews. A particular focus will also be on firms’ ability to monitor and manage counterparty exposures, specifically to non-bank financial institutions.
The letter also cover a few other areas, including RTGS, Data, Climate Change and Diversity and Inclusion. You can read the full letter from the PRA here.
To enquire how our Operational Resilience and Third-Party Risk Management specialists can help your firm, enquire here or book a time with one of our consultants here now
