When the UK authorities published their final policy on operational resilience at the end of March 2021, it was broadly acknowledged – including by the PRA itself – that the operational resilience landscape would continue to develop. The latest act on the UK stage is the PRA's proposals to apply the group provisions in the Operational Resilience Part of the PRA Rulebook relevant to Capital Requirements Regulation (CRR) firms to holding companies.
These proposals can be found in PRA Consultation Paper 21/21 (CP21/21) alongside some other minor formatting and clarification amendments to the Operational Resilience Part and Operational Continuity Part of the PRA Rulebook.
The Operational Resilience proposals regarding holding companies – CRR firms
The Operational Resilience Part of the PRA Rulebook is a recent addition; it is due to come into force on 31 March 2022. This date will also apply to the amendments to the Part proposed in CP21/21.
For CRR firms, as currently drafted Chapter 8 of the Part rested the responsibility with a firm that is the member of a group to 'ensure it takes account' of risk arising from the group context. Similarly, where a firm is a member of a consolidation group, it was to have responsibilities regarding the identification of important group business services and the setting of impact tolerances.
The PRA plans to rewrite Chapter 8 of the Part to shift responsibility in respect of important group business services to holding company level by applying the Part to the 'CRR consolidation entity'. As such, the board of the holding company or entity would be required to approve the important group business services and their impact tolerances. These obligations would not apply to insurance holding companies. Importantly, the PRA does not let CRR firms 'off the hook' with this change; firms which are part of a group will still be expected to take a group view of operational resilience.
This change reflects the power granted to the PRA under the Financial Services Act 2021 (FS Act) to make rules applying to approved and designated financial and mixed activity holding companies where it appears to the PRA to be necessary or expedient to make the rules for the purpose of advancing any of its objectives.
The PRA observes that this approach will 'ensure consistency' across the PRA Rulebook as regards the approach to consolidated prudential requirements at the level of the approved or designated financial and mixed activity holding company. However, prudential regulation does not exist in a vacuum; firms, senior managers and holding companies will still face into requirements which 'sit' at various levels of the organisation. As just one example, both the PRA and the FCA outsourcing regulation and guidance are largely addressed to risks at the individual regulated firm level. It is likely that some senior managers will have to think about the risk of intragroup outsourcing arrangements to the individual firm and also factor this into how they deliver the responsibilities for operational resilience which sit at the holding company level – not an easy balancing act.
There is clearly a logic to the PRA's plans. However, implementing the operational resilience requirements to the UK authorities' timeline was already looking quite challenging. Lifting some elements 'up a level' with less than five months to go certainly adds to it and will require some recalibration. Balancing this out, however, is that this change can facilitate a shift to approaching operational resilience more holistically as a 'run the business' initiative which goes across the organisation and eschews the silo approach which can occur in large organisations.
Implementation dates
As noted, CP21/21 includes other minor formatting and clarification amendments to the Operational Resilience Part. As with the change to Chapter 8, these will also come into force at the end of March 2022.
CP21/21 also contains proposals to make minor amendments the Operational Continuity Part of the PRA Rulebook; the PRA proposes an implementation date of 1 January 2023 for these changes.
The wider context
The UK's rules are a piece of the operational resilience jigsaw. Developments continue at the domestic and international level. Firms and groups which are operating across borders will need to bear in mind requirements being introduced by other regulators to similar timescales which, while these may be similar to the UK approach, will vary in scope, emphasis, and the level of the entity at which the requirements are targeted.
Our Operational Resilience Hub helps to keep you up to date on the upcoming regulatory expectations. The hub features an interactive timeline which covers the UK, EU, Hong Kong, Singapore and Australia, and output from global standard setters.
Key contacts
Disclaimer
Herbert Smith Freehills LLP has a Formal Law Alliance (FLA) with Singapore law firm Prolegis LLC, which provides clients with access to Singapore law advice from Prolegis. The FLA in the name of Herbert Smith Freehills Prolegis allows the two firms to deliver a complementary and seamless legal service.