In today’s turbulent times, financial services firms can’t afford to ignore operational resilience The ability to withstand and respond to disruptive events such as cyber attacks, natural disasters, and pandemics is critical for any financial services establishment Operational resilience has become a top priority for financial services regulators worldwide, as they seek to ensure continuity of services to consumers, maintain market stability, and safeguard taxpayers
Operational resilience spans a wide range of areas, including technology, cyber, third-party risks, people, processes, and data Financial services firms are required to have a comprehensive and integrated approach to operational resilience, identifying potential disruptions, assessing their impact, and taking appropriate measures to prevent and mitigate them
The Financial Conduct Authority (FCA) in the UK has proposed new rules on operational resilience for financial services The proposals aim to enhance the resilience of firms and minimize the potential harm to consumers and the market in case of disruptive events The proposed rules require firms to identify their important business services and the systems and processes that underpin them Firms are required to set impact tolerances for each important business service, which will help them to determine the maximum acceptable disruption to that service Firms will also have to test their resilience arrangements, collaborate with other firms and authorities, and report on their resilience status regularly
The operational resilience framework is a continuous cycle of assessing, testing, and improving resilience plans based on changing circumstances and emerging risks Financial services firms can take several steps to build operational resilience:
1 Identify and prioritize important business services: Financial services firms must identify their critical business processes and prioritize them based on their impact on consumers, the market, and the firm Firms should have a thorough understanding of how their processes and systems work together, and the potential impact of any disruption
2 Set impact tolerances: Firms must set impact tolerances for each important business service, which will define the maximum acceptable disruption to that service Impact tolerances should be based on the potential harm to the consumer, market stability, and the firm’s commercial interests
3 Design resilience plans: Firms should develop resilience plans for each important business service, which will outline the measures to prevent, detect, respond, and recover from disruptive events Resilience plans should have clear roles and responsibilities, communication strategies, and testing schedules
4 Financial Services Operational Resilience. Build redundancy and diversity: Firms should build redundancy and diversity into their systems, processes, and people Redundancy means having backups and fail-safe mechanisms when primary systems fail Diversity means having multiple solutions to the same problem For example, firms can have multiple data centers in different locations, multiple communication channels, and multiple supplier relationships
5 Test and train: Firms should regularly test their resilience plans to identify gaps and weaknesses, and train their people to respond to disruptive events effectively Testing should cover a range of scenarios, including cyber attacks, natural disasters, and pandemics
6 Collaborate and communicate: Firms should collaborate with other firms, authorities, and stakeholders to enhance their resilience capabilities Collaboration can include information sharing, joint testing, and reciprocal support Firms should also communicate their resilience status regularly to key stakeholders such as customers, investors, and regulators
Operational resilience is not a one-time exercise but a continuous process of assessing, testing, and improving Financial services firms must embed resilience into their culture and strategy, and allocate appropriate resources to build and maintain resilience capabilities In addition, firms must comply with regulatory requirements, such as the FCA’s proposed rules, and demonstrate a commitment to resilience to gain trust and confidence from stakeholders
In conclusion, operational resilience is a critical aspect of financial services, especially during turbulent times Financial services firms must have a comprehensive and integrated approach to operational resilience, covering all areas of risks, systems, and people Firms must identify and prioritize their important business services, set impact tolerances, design resilience plans, build redundancy and diversity, test and train, collaborate and communicate Operational resilience is a continuous cycle of assessing, testing, and improving, and financial services firms must embed resilience into their culture and strategy, and comply with regulatory requirements By doing so, firms can enhance their resilience capabilities, maintain market stability, and safeguard the interests of consumers and the market.