On 28 April 2022, the Prudential Regulation Authority (PRA) published a speech by David Bailey (Executive Director, UK Deposit Takers Supervision) entitled ‘Operational Resilience: Next steps on the PRA’s supervisory roadmap’.

In his speech Mr Bailey focuses on operational resilience which is one of the PRA’s highest supervisory priorities at the moment. It has been just over 12 months since the PRA’s operational resilience policy was published. Since then firms have been working towards the end of March deadline that recently passed to identify their Important Business Services (IBS), set impact tolerances, and start mapping and testing to ensure they can remain within those impact tolerances.

Specifically Mr Bailey:

• Provides a brief recap of the PRA’s operational resilience policy, including its expectations of firms and the links to other key policy areas such as outsourcing and critical third parties. Mr Bailey covers three particular policy expectations – IBS, impact tolerances and mapping and testing.
• Shares some of the PRA’s initial assessments of firms’ progress based on its supervisory work on UK banks and building societies so far. Given that it is less than a month since the PRA received initial responses from firms, Mr Bailey’s observations are preliminary, although there are some important themes that are already emerging from the PRA’s review of the board-approved lists of IBS. On IBS, the PRA’s current view is that firms have generally made positive progress against its expectations for identifying these services. Firms have taken a wide variety of approaches to the granularity with which they have identified their IBS. As the PRA continues its supervisory work it will be asking firms to clarify how they have incorporated the key points of the policy that make clear that IBS should: (i) deliver a specific outcome or service to an identifiable external user. This means if it’s more than one outcome, or the user cannot be identified, then the granularity is too high; (ii) be granular enough that they are distinguished from business lines which are a collection of services; (iii) be at a level where one impact tolerance per regulatory objective can be set; (iv) not be at the level of internal services (where the granularity would be too low); and (v) be at a level where boards can make prioritisation and investment decisions. The PRA has also noted that the granularity with which firms defined their IBS impacted the tolerances they then defined. Mr Bailey states that the range of impact tolerances that have been submitted for payments-related IBS seems “surprisingly wide”.
• Cover what is coming up next in the PRA’s operational resilience roadmap including its expectations around what firms should be doing, and the supervisory steps the PRA will be taking. The PRA expects firms to proactively develop and progress their approaches to mapping and testing as they approach the end of March 2025 when all aspects of the policy should be fully implemented.