Compared to our framework for things like capital, liquidity and accountability, the regulatory framework for operational resilience is thoroughly under-developed not only here in the UK but also internationally. This matters more than it used to for a number of reasons, but let me pick out two. First, the emergence of cyber-attacks is a clear and present danger to the financial system which our forebears simply did not have to worry about. And second, as more and more of us access banks and insurance companies digitally, with a major programme of bank branch closures in full swing, and in the age of social media where problems become very visible very quickly, operational failures hurt more than they used to. For the same reasons the Treasury Select Committee is rightly taking a strong interest in this topic. 1  £ as at year-end 2017 4  All speeches are available online at www.bankofengland.co.uk/speeches  4  We therefore published during the summer – jointly between the PRA, FCA and Bank as supervisor of market infrastructure – a discussion paper proposing a new framework for thinking about these issues. The central idea is a simple one: how much operational disruption to key business services should firms, the PRA, the FCA, and the wider Bank of England be prepared to tolerate? We call this ‘impact tolerance’. The focus of our future policy will be on the continuity of the business services that a firm’s customers and the wider economy rely upon.
Preventative mitigation is obviously very important, but having impact tolerance means acknowledging that disruptive events will happen, and that firms need to be able to recover within their set tolerance. I’m talking about planning for scenarios that are severe but plausible – we expect firms to be resilient against a wide range of scenarios, but not against Armageddon. I think it likely that the ordering of these impact tolerances between firms and the PRA will often be the opposite way round from capital. On capital, inserting the public interest means that as a general matter we will require firms to hold more capital than they would if left to their own devices – hence, a battleground. For operational resilience, a firm is likely to experience significant private costs – for instance, impact on their profits or damage to their brand – before their safety and soundness is at risk. The exception to this may be a subset of operations whose failure might pose a systemic risk to financial stability. But in most cases, I think interests are likely to be aligned – we all just need to get better at managing this set of risks, as some recent events have illustrated all too painfully. In this context, I will expand briefly on the PRA’s particular focus in this important area. Our general statutory objective is safety and soundness, with policyholder protection on the insurance side and a secondary objective to facilitate competition.