Last year, spooked by the pandemic and fearful of a systemic fallout like that seen with the financial crisis, UK regulators unveiled new arrangements to shine a much brighter light on the operational resilience of financial firms.
The move last March by the Prudential Regulation Authority (PRA) to create a new, enhanced regulatory framework for monitoring the ability of key financial institutions to withstand, contain and recover from shocks was widely welcomed. Hot on the heels of the PRA’s initiative, the Bank for International Settlements issued its own revised principles for operational resilience.
Nick Applebee, principal consultant & solutions SME at real-time treasury software expert Planixs, believes the ensuing war in Ukraine, ongoing economic turmoil, volatility and geopolitical uncertainties makes the PRA’s new operational resilience policy look even more prudent. However, he is concerned by the watchdog’s policy demands being set at a “minimum level” and its neglect of one aspect of banking operations that he believes is vital for truly effective operational resilience.
“The events of the last two to three years show how shockingly, suddenly the operating environment can change,” says Applebee. “If the PRA’s proposals are to make a truly satisfying impact on assessing the ability of key financial sector actors to withstand, recover and contain future shocks in a fast-moving world, I cannot see how you can neglect the importance of leveraging of real-time data.
“Whether it is for supporting operational resilience or other activities aimed at gaining visibility and control, access to cleansed, real-time data and tools are imperative for supporting the more preventative and proactive approach that everyone really wants to see,” he says.
“Once you have data then it can be used to construct key measures and indicators to generate trigger points and red flags and help ensure informed decision making. As the saying goes, in God we trust, everybody else must bring data to the table.”
As it stands, there is still time for Applebee’s championing of real-time data for operational resilience monitoring to gain traction, if not with the PRA, through revisions of its policy, then firms in the crosshairs of the new regulations taking on real-time themselves as a matter of prudent governance.
The PRA’s policy is aimed at banks, insurers, financial market infrastructures (FMIs) that allow the clearing, settlement, and recording of financial transactions, and “critical third parties” such as providers of IT, cloud and managed services. It features three main elements:
- Firstly, it requires financial firms to identify “important business services” (IBS) – services they are providing external end-users which have the potential to harm consumers, damage market integrity or threaten the viability of firms in the event of a disruption.
- The second is the requirement for firms to set “impact tolerances” for these IBSs. Here the PRA expects firms to assume that disruption to these services will occur and then set clearly defined time-based metrics, and well-defined thresholds, at which the disruption would threaten regulatory objectives.
- Finally, the PRA’s last and most challenging operational resilience requirement, the one where leveraging real-time data would be especially advantageous in Applebee’s view, is the expectation of firms to perform mapping and testing so they are able to demonstrate their ability to stay within their impact tolerances.
“Firms’ testing strategies should incorporate the risks and vulnerabilities they will face in severe but plausible scenarios and then demonstrate how they will remediate any disruption in a timely manner,” according to the PRA xxx “The experience gained from this testing can then inform how firms monitor risks to their operational resilience and increase the maturity of their overall processes.”
The first milestone
By March 2022, one year from the policy first emerging, firms had to have met the first two of these elements. Looking three years ahead, firms will have had to prove they are able to remain within the impact tolerances that they have set out. This is where the PRA believes “assurance gained from high-quality mapping and testing will be key”.
By 2025, the PRA expects firms to have “embedded fully coherent mapping and testing frameworks”. Applebee anticipates that thereafter, in line with how it has dealt with its previous policies, the PRA will only further intensify its demands and scrutiny.
With the first milestone achieved, and the PRA is hailing the “good progress” made by firms in reaching it, Applebee expects the regulator’s focus on firms’ progress to become more intense over the next three years as they refine and enhance their initial outputs from mapping and testing exercises. He believes that as firms progress with that mission, they should consider the many compelling reasons to leverage real-time data to gain a much more realistic picture of their operational resilience – and much more besides.
“Treasuries in financial institutions are now operating in a world where liquidity is becoming more complex and moving faster than ever before,” says Applebee. “Payments and settlements are moving to real-time, often driven by client activity.
“Also, interest rates and inflation are becoming interesting again. Moreover, decentralised finance, digital assets and cryptocurrencies are extending the range of venues where treasury needs to monitor and manage liquidity,” he says.
“A treasury, therefore, needs to control cash and securities liquidity in real-time, both to keep regulators happy and to optimise funding and buffer costs.”
He cautions, however, that while real-time control is an attractive, compelling vision, it is difficult to achieve. The required data needs to be captured in real-time at the individual transaction level, and the platform used for that must consume, aggregate, and apply complex analytics to this data, whilst delivering the results instantly in a variety of formats to a wide range of user groups.
“That is a significant undertaking as the largest global firms process millions of transactions every hour. Firms with less data still need to address challenges around defining functionality, creating real-time architectures, and keeping pace with constantly evolving business models and regulations,” says Applebee.
“In addition, a typical firm aiming to deliver real-time control faces many challenges from the outset: legacy inflexible application architectures; data isolated in silos; and inefficient manual processing.”
Real-time solutions, however, are available on the market to address such challenges. Planix’s own offering, Realiti, is “a real-time data amalgamator” that sits alongside existing applications and provides a firmwide view of, and the ability to optimise, cash, liquidity, and securities positions as they evolve throughout the day.
Realiti consumes and aggregates transactional-level data from external account providers and from the firm’s internal systems, executing analytics that delivers instant insights at the intraday level, in real-time and across all the firm’s accounts of interest.
“Liquidity is the lifeblood of the organisation and Realiti provides the liquidity activity tracker giving real-time status against liquidity plans,” says Applebee. “In addition to risk and regulatory benefits it offers, there is a strong business case that comes from understanding cash and securities liquidity in real-time.
“It helps with recycling scarce liquidity across various settlement venues. It delivers a more efficient funding process by reducing both operational costs and costs of encumbered collateral providing access to credit,” he says.
“Real-time also helps with optimising liquidity buffers; removing operational risk; generating efficiency savings from having easy access to timely data and enabling early warning indicators.”
Treasurers and CFOs to the fore
When it comes to the nitty, gritty of implementing the PRA’s operational resilience policies, Applebee expects CFOs and treasurers to play a key role, even if from only a governance perspective whereby a firm should ensure there is adequate knowledge, skills, and experience to provide challenge where needed.
Indeed, in the wake of Covid, Applebee has noted a significant shift among clients, with more and more looking to invest in real-time technology, with treasurers often taking the lead in policy and technology decision-making. This makes eminent sense to Applebee.
“Treasurers and CFOs, because of their breadth of knowledge, are the key individuals best placed to challenge the veracity of policies and outputs, ensure their firm is as resilient as it can be at the present time and in the future,” he says. “Treasuries are intrinsically forward looking, assessing what could happen and making sure firms can continue to operate under a range of circumstances.
“There is no doubt that those firms that already had a resilience framework in place were better prepared when the pandemic hit. Since the pandemic, we have certainly seen an increase in firms wanting to invest in technology and refine their processes because of remote working.”
The bigger picture
More broadly, Applebee stresses that the PRA’s policy is about much more than gaining a detailed understanding of firms’ key business services and developing highly informed impact tolerances.
“It demands that you go deeper – what people have you got to deliver on the policy? Where are they in the organisation? What are their processes? And what’s their technology? What investment might be needed? Identifying services that can be impacted is crucial, but you also need to understand what can impact them at a granular level and what needs to be done to retain them through thick and thin.”
In implementing the PRA operational resilience framework Applebee strongly advises them to ensure all key players across the organisation, up to and including executives, are included in the exercise and that they all agree and set clear standards.
“You must have the buy-in from senior – the tone will be set from the top. Do not make this a tick box exercise and ensure you invest time and budget now as the level of effort should not be underplayed,” he says. “In addition, if left undealt with, then other things are bound to come up which could also include the next black swan event – Ukraine happened after all.
“It is also really important to have strong governance in place – an annual review at least but in truth, the exercise should be regarded as a ‘living document’ to cater for new services, incidents and so on.”
While firms are on a learning curve with implementing the PRAs there is no doubt in Applebee’s mind that the PRA is too. He fully expects the watchdog to scrutinise in detail progress reports from firms as they come in, compare and contrast their experiences, identify inconsistencies, and, on the basis of that, potentially issue more revisions to its operational resilience policy.
“It’s been the case with previous policies that regulators, as time went on and they understood more, examined peer to peer issues more forensically, they started getting their teeth out a bit more, asking more questions,” says Applebee.
“There is obviously going to be more scrutiny of firms over the next three years. It’s a transition period and people in firms will need to think longer and harder,” he adds. “Once they do, I think the smarter, more enlightened ones will realise that real-time is the way forward for future-proofing, not just for operational resilience but for a host of other critical operations that underpin visibility and control. It really is top dog.”
Subscribe to get your daily business insights