BoE sets operational resilience expectations for payment system operators
The Bank of England has published a Supervisory Statement detailing its expectations for operational resilience among recognised payment system operators and specified service providers. The guidance aims to enhance financial stability by preventing and mitigating disruptions in critical payment systems.
Safeguarding critical payment flows
The Bank of England's Supervisory Statement (SS) outlines its approach to operational resilience for Recognised Payment System Operators (RPSOs) and Specified Service Providers (SSPs).
This guidance, issued under the Banking Act 2009, is crucial for entities whose prolonged disruption could significantly threaten payment transfers or system efficiency, thereby impacting financial stability.
While central counterparties (CCPs) and central securities depositories (CSDs) are excluded due to separate existing regulations, the Bank will assess non-UK RPSOs and SSPs on a case-by-case basis, considering their systemic importance and local regulatory equivalence.
The SS emphasizes that operational resilience is a key component of protecting and enhancing financial stability, ensuring payment systems are efficient, robust, and do not cause or exacerbate instability.
The Bank's supervision of financial market infrastructure firms (FMIs) is judgement-based and forward-looking, using a risk assessment framework to identify and mitigate risks.
Defining resilience and disruption limits
The Supervisory Statement defines operational resilience as the ability of financial market infrastructures (FMIs) to prevent, respond to, recover from, and learn from disruptions.
It mandates identifying 'important business services' – those whose prolonged disruption could significantly threaten payment transfers or system efficiency, impacting financial stability.
RPSOs and SSPs must identify these services, considering factors like market share and transaction volume.
A key concept is 'impact tolerance,' defined as the maximum tolerable level of disruption for an important business service.
RPSOs must set these tolerances, using metrics such as outage length or affected users.
SSPs must align their tolerances with RPSO obligations, driving investment and governance.
Beyond business continuity
This Supervisory Statement clarifies the Bank of England's proactive stance on operational resilience, moving beyond traditional business continuity to emphasize prevention and mitigation.
The framework underscores the systemic importance of payment systems, placing a binding burden on operators to identify risks and set robust impact tolerances.
However, the case-by-case approach for non-UK entities introduces supervisory discretion, potentially leading to inconsistencies.