Sasha Mills, Executive Director of Financial Market Infrastructure (FMI) at the Bank of England (BoE) has discussed the expectations for FMIs ahead of BoE’s 2025 policy deadline.
Mills stressed the significant need for ‘operational resilience’ in a speech given at the London Institute of Banking and Finance, where she outlined some key expectations for FMIs – ahead of the March 2025 deadline for these FMIs to meet the bank’s policy in this area.
In the speech, Mills described FMIs as the “pipes” and infrastructure, which interconnect and underpin modern financial markets and the real economy, stating that “confidence in FMI services is critical to having a vibrant and prosperous economy.”
One of BoE’s responsibilities is to supervise FMIs to ensure financial stability. If for some reason an FMI loses the ability to authorise or settle new payments, it’s the BoE’s and Mills’ priority to see that the crucial services the firm provides can be recovered as soon as possible.
New Policy
Over recent years, the BoE has implemented policies on Operational Resilience, outsourcing and third-party risk management. The BoE is on the verge of completing another key aspect of these policies later this year with the release of rules for firms offering critical services to the financial sector.
In regards to these new policies the bank has put in place a deadline of March 2025 for these FMIs to meet its policy.
In the new policy, the bank has emphasised two crucial areas. The first involves acknowledging the inevitability of some operational disruptions. Despite expecting FMIs to maintain robust incident prevention mechanisms, it understands that there will always be incidents that are extremely challenging, if not impossible, to avoid and therefore expects them to prepare accordingly.
Secondly, the policy focuses on financial stability outcomes and refrains from prescribing specific technological solutions or operating models for FMIs to adopt.
Mills said: “Resilience is about bouncing back safely when bad things happen as well as minimising the likelihood of an operational disruption occurring in the first place.”
A lot more work to do
In the past few years, the BoE has engaged with FMIs to understand progress made towards meeting this regulatory deadline, however, “there is still considerable work to be done for many FMIs,” Mills said.
Mills listed some of the biggest risks to FMIs, including cyber attacks and Artificial Intelligence (AI), calling for the need of continuous monitoring of all possible threats.
AI being a hot topic at the moment for the BoE, as Governor Andrew Bailey said while there are risks with AI, “there is great potential with it”.
“We expect to see FMIs accelerating their efforts to ensure that they have calibrated their tolerance for negative impacts on their important business services, and mapped the key people, processes, technology, facilities, and information needed to deliver these services,” Mills continued.
“FMIs should then be fully testing their ability to remain within impact tolerances for ‘extreme but plausible’ scenarios – ensuring that response plans and capabilities are robust, and where not, that strategic investment is being made. This is a key requirement.”
The BoE also expects to see greater collaboration than it has already witnessed between FMIs, their participants and the wider market, especially when designing impact tolerance.
Additionally, there is need for development in regards to testing possible disruptions to important business services.
Mills said: “For example, FMIs should be asking themselves the following questions: Are the scenarios extreme enough? How many scenarios are sufficient to ensure the risk has been looked at from several angles? Do the scenarios ‘think the unthinkable’?
“We need to see FMIs prevent incidents where they can, but we also need to know they know what to do when things do go wrong and ‘the worst’ – so to speak – does indeed happen.”
Furthermore, the bank states that FMIs need to do further work to improve on the sophistication of their testing approaches, pointing in the direction of industry wide tests such as Sector Simulation Exercise (‘SIMEX’), as well as tests designed and tailored by the FMI, to test impact and recovery actions, both for themselves and their participants and wider ecosystem.
The broader picture
However, the scope of Operational Resilience extends beyond UK FMIs. Existing policies also include their participants, such as banks and insurers, with supervision conducted by the PRA.
Mills explained that there is a growing focus on crucial components of the supply chain, the entirety of the UK financial system and the development of international standards.
The Financial Policy Committee (FPC) has established a system-level impact tolerance for payments. This framework aims to guide FMIs to provide payments services as they set their own impact tolerances.
Recently, the FPC outlined its macroprudential approach to operational resilience, stressing the importance of firm-level resilience as the foundation for system-wide resilience, underscoring the need for firms and FMIs to consider their roles in the broader system.
Furthermore, UK authorities have been granted powers to directly oversee critical third parties (CTPs), aiming to address concerns about the increasing reliance on a small number of third parties providing vital services.
This oversight, part of the Operational Resilience toolkit, aims to enhance system-wide operational resilience while emphasising that FMIs remain responsible for their own operational resilience.
What’s next?
Mills ended the speech with five simple points for FMIs to remember:
- First, FMIs are important to financial stability
- Second, operational disruption will happen
- Third, deep and collaborative thinking is required
- Fourth, detail is important
- Fifth, test the unlikely
Mills concluded: “FMIs which do these things will meet our expectations and more importantly will help ensure that the UK financial system functions well in good times and bad – and that individuals’ and businesses’ confidence in the financial system is maintained.”
