The FCA expects all firms to have business continuity arrangements and contingency plans in place to deal with major events. The FCA’s expectations for firms dealing with the impact of COVID-19 sits within this broader regulatory context.
The FCA and the PRA are currently consulting on a specific operational resilience regime (see in particular, Consultation Paper CP19/32, which is now due to run until 1 October 2020). “Operational resilience” means “the ability…to prevent, adapt, respond to, recover and learn from operational disruptions”. Under the proposed new regime which will apply to the majority of authorised firms, firms are required to focus more effort and resources on achieving the continuity of their important business services in the event of severe operational disruption, and not just on recovery of the underlying systems and processes. As part of this, firms will be required to identify their “important business services” and map the successful delivery of such services to their underlying resources. Firms must then set an “impact tolerance” (the maximum duration of disruption to an important business service that a firm can cope with before intolerable levels of harm will arise to consumers or market integrity), which is intended to change the approach of boards and senior management away from traditional risk management towards accepting that disruption to business services is inevitable, and needs to be managed actively.
Outsourcing arrangements form an important component of the firm’s continuity and contingency planning. We set out in this note, some of the key issues that firms are facing in this context.
Expectation that firms will continue to meet their regulatory obligations
There has been no indication from the FCA or PRA that they are lowering the expected level of regulatory compliance for firms in light of COVID-19. Instead, firms are required to take all reasonable steps to meet the regulatory obligations which are in place to protect their consumers and maintain market integrity.
The FCA and PRA are actively reviewing the contingency plans of a number of firms and will continue to proactively discuss with firms and trade associations the issues they are facing in the coming days and weeks.
Assessing whether third party contracts are critical
The approach firms take to various categories of contractual arrangements will partially depend on whether those arrangements are critical. The COVID-19 outbreak has led some firms to reconsider the basis upon which they concluded that contractual arrangements were, or were not, critical to their business. Whilst in the past, contractual arrangements covering services such as cleaning, security and catering may not have been considered critical to the ongoing provision of services, these decisions are being re-tested in light of the challenges that the current crisis brings. As a result, several firms have concluded that, for example, cleaning contracts are critical at this time.
Firms should validate their processes for assessing the risks of third party contracts
COVID-19 is requiring some firms to re-test the systems used to assess the risks associated with third party contracts, in order to ensure that they are able to respond effectively to market pressures.
Firms outsourcing critical services should be monitoring their outsourcing arrangements closely as regulated firms remain responsible to the relevant regulator for the activities being conducted by outsourced providers. In the event that the operations of the outsourced provider are impacted by COVID-19 such that they can no longer meet their obligations under the outsourcing agreement, the regulated firm should take swift action to ensure continuity of business. The systems that are in place to monitor contractual arrangements should ensure that firms can satisfy this obligation.
Firms should consider whether it is appropriate to grant any relief from the performance of contractual obligations
Firms should consider how the issues of business continuity and force majeure are dealt with in the relevant contract, as this will to some extent determine what approach needs to be taken. If suppliers are unable to perform contractual obligations under outsourcing contracts, firms should then consider what approach they want to take. This in part, will be driven by whether or not the firm is able to perform its services and meet its own obligations.
The impact of triggering a force majeure event will depend on the governing law of the relevant contract, but from an English law perspective, common consequences of a force majeure event include:
- suspension of contractual obligations;
- non-liability;
- extensions of time to fulfil obligations;
- renegotiation of terms;
- obligation to mitigate losses; and
- the right to terminate the contract.
To benefit from those effects, recent case law suggests that the party looking to be excused must have been ready and willing to perform the contract, if it had not been for the force majeure event.
To the extent firms are considering how to apply force majeure provisions, they should review the wording of force majeure clauses, and consider consequences of triggering a force majeure and contact counterparties of contracts which may be affected and discuss a possible renegotiation, or postponement of obligations, as appropriate.
Interplay with SMCR
The FCA and PRA do not require or expect firms to designate a single SMF to be responsible for all aspects of their response to coronavirus. While it is important for firms to have a clear framework for allocating responsibilities to various SMFs for different aspects of their response to coronavirus, the FCA and PRA do not generally prescribe a ‘one-size-fits-all’ approach.
Where firms have an SMF24 (Chief Operations officer), aspects of their response to coronavirus that may naturally sit with this SMF. For instance, compliance with PRA and FCA requirements and expectations on outsourcing and business continuity.
The approach that firms are taking to managing the risk of coronavirus, including furloughing staff, should be considered in light of the responsibilities that such individuals have for critical areas of the firm’s operations.
