Global menu

Our global pages

Close
Print Friendly and PDF
Default New Image

Operational Resilience, Fintech, Cyber Security and Outsourcing

The international regulatory response to the global financial crisis of 2008-09 resulted in significant changes to rules and regulations to ensure that financial institutions (FIs) were financially resilient and better placed to withstand future shocks to the financial system.

Since then, the regulatory focus has shifted to the operational resilience of FIs and financial market infrastructure (FMI) to withstand significant disruption to critical services. Major global banks like the Bank of England have openly stated that operational resilience is as important as financial resilience. In part, this is a consequence of high-profile incidents involving technological failures at major banks and the increasing number of cyber-attacks affecting FIs, which lead to severe disruption to the delivery of financial services.

However, there are more fundamental reasons for why regulators and governments are coordinating internationally to develop and implement operational resilience requirements. Key amongst those reasons is the exponential growth in the digital and technological infrastructure to support financial services, with increasing numbers of FIs relying on a core pool of third party outsource service-providers (an issue described by regulators as “concentration risk”). Without a proper grip on the resilience of this infrastructure, regulators are concerned the financial sector will be vulnerable to another crisis-level event of the nature experienced in 2008-09.

The global COVID19 pandemic heightened awareness of these issues as the financial sector shifted overnight to a remote working environment, which depended on a resilient operational and technological framework to maintain the delivery of important business services.

FIs and FMI are therefore under increasing levels of scrutiny to demonstrate their ability to respond to and recover from significant disruption, and they need to ensure this approach is built into financial technology. Any failure to demonstrate compliance or, ultimately, to deliver resilience when a disruption occurs will likely result in regulatory action. It will also increase litigation risk both for the FI concerned and also for any third parties providing services to the FI, where they might have been the cause of the disruption.

Top three things on the horizon

1. It's the final countdown to operational resilience (or is it?) - As we reach the final Operational Resilience deadline set by UK regulators today, Financial Services firms would be wise not to rest on their laurels, with numerous cybersecurity and outsourcing issues arising from the conflict in Ukraine – Read more
2. Building Operational Resilience: The PRA view - On 5 May 2021, Lyndon Nelson (Deputy CEO of the PRA), delivered a speech to UK Finance, following the publication of PS6/21: “Operational Resilience: Impact tolerances for importance business services” in March this year – Read more
3. Operational Resilience: the clock has started; the time to act is now -Lyndon Nelson (Deputy CEO, PRA) and Suman Ziaullah (Head of Department for Technology, Resilience and Cyber Specialists, FCA) delivered key note addresses at City & Financial’s 8th Operational Resilience and Cyber Security Summit – Read more

View previous articles 
Default New Image
Default New Image
Print Friendly and PDF

© Eversheds Sutherland 2023. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities.

Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.