AML/CFT Supervision of Credit and Financial Institutions and Cryptoassets

22. The FCA continues to strengthen and recalibrate its tiered-supervisory approach based on risks. As noted in the 2016 FSAP AML/CFT TN and the 2018 MER, the FCA’s tiered approach involved the systematic AML program, proactive AML program, risk-assurance reviews, and reactive approaches. The 14 largest financial institutions were subject to a systematic AML program, involving an intensive 4–6-month inspection involving 4–5 staff conducted every four years. Other high risks entities were subject to a less intensive proactive AML program, where 2 –3 staff inspect the entity within 2–4 days every four years. Risk assurance reviews were undertaken by the FCA on a yearly basis, which reviews specific areas across a broader range of selected supervised entities. When the FCA receives actionable information, it also undertakes reactive supervision. This may be entity specific or across a cohort of entities. In the 2018 MER, the FCA was encouraged to consider how to ensure appropriate intensity of supervision for all the different categories of its supervisory population from low risk to high risk. In response to this, the FCA has identified the changes to proactive AML supervisory approach that focuses on key issues or areas among multiple targeted supervised entities across risk profiles and communicating the results to the sector. The changes include the introduction of new Modular Assessment Proactive Programme that focuses on reviewing the highest risk areas of the largest and most systematically important entities more frequently; Proactive AML Programme that drives supervisory attention on outliers, hotspots and emerging themes as identified through the data/other intelligence sources; and Focused Supervisory Interventions Programme that will increase the breadth of the FCA's proactive AML supervision by engaging with entities on specific issues or risk indicators.

23. The breadth and depth of AML/CFT supervision by FCA could be further enhanced. Out of the 22,000 entities, 23 percent are assessed as high risks, and majority (73 percent) are deemed medium risks. However, the annual number of desk-based and onsite inspections (less than 200) in the past three years do not appear commensurate to the assessed risks of the supervised entities (even if these were only confined to the higher risk entities) (Figure 6). Although there is no expectation that all supervised entities are subject to annual onsite inspections, IMF staff express concerns as to the extent to which a substantial portion of supervised entities are effectively monitored for AML/CFT compliance, given the size of the supervisory population, their risk profiles, and number of inspections. While reactive supervision can aim to capture serious ML/TF violations, this relies on complaints, whistleblowers, or intelligence from law enforcement agencies. The duration and frequency of inspections under the Proactive AML Programme for high risk but non-systematic entities should also be re-calibrated, to better mitigate risks. While supervised entities are required to implement group-wide AML/CFT programs (including for those operations outside the United Kingdom), the extent to which these programs are monitored by the FCA and the effectiveness of coordination with relevant home/host supervisors is outside the scope of this TN.

United Kingdom: FCA On-Site and Desk-Based Inspections

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: IMF staff calculations.* The FCA’s 2018/19 desk-based reviews are comprised of 20 risk assurance reviews and 27 reactive case reviews. Reactive cases were not assigned a compliance rating.Note: Onsite inspections ceased on March 16, 2020, due to the COVID pandemic restrictions.

• Download Figure
• Download figure as PowerPoint slide

View Full Size

United Kingdom: FCA On-Site and Desk-Based Inspections

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: IMF staff calculations.* The FCA’s 2018/19 desk-based reviews are comprised of 20 risk assurance reviews and 27 reactive case reviews. Reactive cases were not assigned a compliance rating.Note: Onsite inspections ceased on March 16, 2020, due to the COVID pandemic restrictions.

• Download Figure
• Download figure as PowerPoint slide

United Kingdom: FCA On-Site and Desk-Based Inspections

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: IMF staff calculations.* The FCA’s 2018/19 desk-based reviews are comprised of 20 risk assurance reviews and 27 reactive case reviews. Reactive cases were not assigned a compliance rating.Note: Onsite inspections ceased on March 16, 2020, due to the COVID pandemic restrictions.

• Download Figure
• Download figure as PowerPoint slide

24. The FCA is utilizing new data driven analytical tools to support risk-based AML/CFT supervision. Tools developed by the FCA analyze data provided by entities to identify outliers, which would then be inputs to identifying entities subject of monitoring. Other analytical tools on sanctions and transaction monitoring are also being developed to test the effectiveness of AML/CFT controls of supervised entities (e.g., using fuzziness tests over names of designated or sanctioned individuals). More than 2,500 of the 22,000 entities (based either on entity type or activity type) are obliged to annually submit financial crime data returns, which provides the FCA key information to assess the nature of inherent financial crimes risks (e.g., exposure to politically exposed persons, sanctions screening controls, jurisdictional risks, suspicious transaction reports, and resources to fight financial crime). As noted above, this regulatory return requires firms to provide details on those jurisdictions it has assessed and considered high-risk.

25. On entities dealing with cryptoassets, the FCA is ramping its efforts to understand their ML/TF risks, monitor registration and ensure effective supervision. The FCA was designated as the AML/CFT supervisor for cryptoasset businesses and have taken a robust approach to their registration. Those wishing to engage in cryptoasset activities first need to be registered and approved by the FCA, including those business that are already registered or authorized by the FCA for other activities. Those seeking to obtain registration are obliged to identify their beneficial owner/s, detail their AML/CFT controls and risk assessment, ad submit to a fit and proper assessment, among others. As of end-December 2021, the FCA has approved registration for 22 entities,³⁰ with more than 40 other entities subject of a temporary registration.³¹ These registered entities are required to conduct customer due diligence and report suspicious transactions consistent with the MLR. The authorities have noted the increased ML risks from cryptoasset exchanges, cryptoassets automated teller machines and peer-to-peer exchange platforms. The FCA is designing a dedicated supervision function to monitor AML/CFT compliance as the sector evolves. The efforts by HMT to incorporate the FATF’s travel rule with respect to cryptoassets³² are also welcome since it will require registered entities to obtain, hold and transmit identifying information of both parties in any cryptoasset transaction. This will increase information available to relevant LEAs to follow the virtual money trail.

26. Ensuring that the FCA has broad access to data from supervised entities and robust technological tools to analyze information will contribute to addressing the breadth and depth of risk-based AML/CFT supervision. Material data on supervised entities should be accessible and periodically submitted to the FCA, as inputs to its risk-based supervisory plans and strategy. While the number of entities required to file annual financial crime data returns have almost tripled (from 2,500 to 7,000 entities),³³ this remains limited and is not commensurate to the risk profile of the FCA-supervisory population. All supervised entities should be obliged to periodically submit AML/CFT returns that disclose key risk factors including risk classifications of its customer bases (including customers that are politically exposed persons³⁴), products or services offered, and geographical risks. To address the expected large volumes of submissions to be received, advanced technological tools should be able to assist in analyzing these massive data points, ensure controls over the quality of the data, and flag key indicators that would further inform the analysis by FCA supervisors. As noted in the earlier section on risk profile, cross-border payments can be useful inputs to identifying unusual transaction flows, which could be flagged using big data and machine learning.

27. Use of third parties may also be considered to broaden FCA’s AML/CFT supervisory reach. Currently, the FCA is empowered to appoint and engage “Skilled Persons” as part of its regulatory toolkit.³⁵ The objective of the FCA when using a Skilled Person is to fact find, obtain expert analysis or recommendations on a firm for either remedial action or whether an investigation is more appropriate. A Skilled Person report can be used to diagnose a niche area or review an entity’s wider AML/CFT framework. Each case is determined on a case-by-case basis. The FCA vets and selects Skilled Persons through a procurement process that assesses technical capability and commercial offering (weighted in favor of the former). The FCA may consider further leveraging Skilled Persons to support or complement supervisory activities, particularly for lower risk entities, subject to targeted and transparency guidance and criteria. Resort to such mechanism can be useful or advantageous, considering innovations to financial services (including on financial technology and cryptoassets).

28. In addition to increased government funding, the proposed Economic Crime Levy, will enable additional resources for the authorities’ efforts to combat economic crime.³⁶ AML-regulated entities with annual U.K. revenue over £10.2m will be levied, based on the U.K. revenue size band an entity falls into, either £10,000, £36,000 or £250,000. The levy aims to generate £100m per annum to help fund new and uplifted AML capabilities, including the reform measures under the 2019 ECP. Additional resources to AML/CFT supervisory activities should also be considered, including investments on technological and analytical tools to aid risk identification and oversight (such as monitoring of cross-border payments using big data and machine learning).

29. Enforcement actions against serious AML/CFT violations by supervised entities continue to be pursued. As noted in the 2018 MER, the FCA has a broad range of tools available for enforcement.³⁷ These include remedial actions (e.g., use of action plans, attestations by firms, early interventions, restricting or suspending an entity’s business or license) and sanctions (e.g., banning individuals from an industry, fines and disgorgements, and public censures). Since 2018, there have been more than £665 million of fines imposed by the FCA, including against more than seven large financial institutions.³⁸ In October 2021, the FCA secured its first criminal prosecution under the 2007 MLR, when a major bank pleaded guilty to serious AML/CFT violations and subsequently sentenced to pay fines of over £264 million. In collaboration and coordination with foreign counterparties, the FCA has also been involved in “global resolutions”, where financial penalties have also been imposed against entities for AML/CFT violations. As part of a global resolution agreement (US$475 million) with US and Swiss authorities, the FCA fined a major bank in October 2021 for £147 million for failure to properly manage the risks of bribery with respect to loans related to a foreign government-sponsored project.³⁹ Finally, the authorities (SFO) have also utilized global deferred prosecution agreements, which allow them to leverage information from competent foreign authorities and extract a share of the penalties.

30. Continued efforts to pursue enforcement actions will help create a deterrent impact and strengthen AML/CFT compliance by supervised entities. The FCA has several investigations against entities and individuals for AML/CFT violations ongoing, but this number could grow as the breadth and depth of supervisory activities expands. Full resort should be made to the application of the broad range of enforcement tools (particularly criminal penalties against corporations and senior managing officials) commensurate to the scale of the AML/CFT violations. With respect to corporate criminal liability, the identification principle (i.e., identifying the senior person with controlling will and mind and making their acts attributable to the supervised entity) provides for a high bar for prosecuting corporate criminal liability for economic crimes. Enhancing the legal framework on corporate criminal liability can contribute to ensuring strong AML/CFT compliance in large entities by holding senior management accountable for failure to prevent economic crimes. In this regard, the Law Commission is studying options for corporate criminal liability, including for serious violations of AML/CFT obligations by supervised entities.⁴⁰

AML/CFT Supervision of TCSP, Legal and Accountancy Sectors

31. AML/CFT supervision of some sectors is overlapping. In particular, TCSPs can either be subject to AML/CFT supervision by the FCA, HMRC or PBSs. The 9 PBSs are responsible for supervising for AML/CFT compliance most of the accountancy sector; but HMRC also supervises other accountants, often sole practitioners working part-time with a small number of clients, where more than 95 percent are classified as low risk. Meanwhile, the legal sector is supervised by 13 PBS, where nearly two-thirds are under the Law Society/Solicitors Regulation Authority. Supervised entities can also be multi-service businesses, whereby they provide TCSP, accountancy and legal services as ancillary to their main business line (e.g., family offices).

32. OPBAS continues to intensify AML/CFT oversight of the legal and accountancy sectors by supporting deeper risk understanding by the PBSs and consistency of their supervisory approaches. Since its establishment in 2018, OPBAS has published three reports on its assessment of supervisory practices of the PBSs.⁴¹ PBSs have made progress and are generally assessed by the OPBAS to be in technical compliance with the AML/CFT legal framework. OPBAS, however, observed variance in the level of effectiveness of implementation. For example, some of the larger PBSs (e.g., Solicitors Regulation Authority) have issued their own assessment of ML/TF risks to guide their members. However, a vast majority of the PBSs have not implemented an effective risk-based approach to AML/CFT supervision, and two thirds did not demonstrate an effective enforcement framework. OPBAS continue to guide PBSs and ensure the consistency of supervisory approaches and prevent regulatory arbitrage. Robust oversight by PBSs (including use of effective, dissuasive, and proportional sanctions) should also contribute to promoting a strong compliance culture among TCSPs, accountants and lawyers.

33. Efforts by OPBAS to inform and raise awareness of key ML/TF risks in the accountancy and legal sector are positive developments. In conjunction with the NECC, OPBAS established two Intelligence Sharing Expert Working Groups (ISEWGs), each for the accountancy and legal sectors. ISEWGs are aimed at facilitating the increase of information sharing between the PBS, LEAs, AML/CFT supervisors and other relevant agencies. This includes both strategic intelligence sharing (developing common understanding of emerging or existing ML/TF threats) and tactical intelligence sharing (developing high quality live intelligence sharing with LEAs). ISEWGs provided support and inputs to the 2020 NRA exercise, which helped identify additional key factors contributing to the high ML/TF risks in the accountancy and legal sectors. Through typology reports, alerts, and anonymized case studies, the ISEWGs create a virtuous feedback loop, ensure consistency, and build trust between public and private stakeholders (e.g., supervisors and LEAs can gain operational perspective on transactions and flows; while supervised entities are informed of trends to better calibrate their AML/CFT controls). Such information sharing platforms should continue and help foster deeper understanding and awareness of risks in these two high risk sectors.

34. Given the high risk of the TCSP, accountancy and legal sectors, the U.K. authorities should further explore mechanisms that ensure consistency of AML/CFT supervisory approaches. For low capacity or high-risk PBSs, the OPBAS could be given discretionary power to directly conduct AML/CFT supervision to maximize efficiencies and better harmonize supervisory approaches. While some PBSs can manage and effectively perform their AML/CFT supervisory responsibilities, opening the possibility of direct AML/CFT supervision could be an alternative approach for other PBS that may not have the same degree of resources or capacities. Such an expansion of OPBAS’s powers would require legal amendments and entail additional resources. Notably, the issue of extending OPBAS’s remit and powers is one of the questions in the HMT’s call for evidence on the AML/CFT regulatory and supervisory regime, in addition to the broader question of the overall supervisory model (i.e., whether to seek a degree of consolidation of the supervisory regime towards a model with fewer, very few, or even a single supervisor).⁴²

Further the Resilience Against Cyber Risk

53. Constantly evolving cyber threats require vigilance from the financial institutions, regulators, and supervisory authorities alike. Malicious cyber actors with varying level of sophistication continue to evolve and innovate their tactics, techniques, and procedures (TTPs). The first half of 2021 has been characterized by the exploitation of a series of critical zero-day vulnerabilities⁶¹ (e.g., in F5 Big-IP, MS Exchange, and Pulse Secure), supply chain attacks, and distributed denial-of-service attacks. Additionally, non-malicious incidents like accidental data disclosures and configuration, implementation or processing errors continue to be an important source of cyber risk.⁶²

54. The shifts in business operating practices and use of technology in response to COVID-19 pandemic are increasing the vulnerability to cyber risk threats. In general, financial institutions’ existing business continuity plans and home working arrangements have been successfully leveraged to maintain operational resilience. But malicious cyber actors have been exploiting the COVID-19 pandemic theme, for example in phishing campaigns, and certain cybersecurity controls needed to be relaxed all the while the attack surface grew due to the increased use of potentially vulnerable services and personal devices. Furthermore, pandemic response measures often impacted financial institutions’ ability to respond to additional operational stress.

55. The U.K. authorities have identified cyber risk as a top financial stability concern within the broader operational resilience agenda. A cyber incident impacting the confidentiality, integrity or availability of a financial institutions’ critical activities may have the potential to destabilize that institution. U.K. supervisory authorities focus on outcome-based assessments and the supervisees’ cybersecurity controls’ design adequacy.

56. The materialization of a cyber risk may have ramifications for the wider financial system, both domestic and international. While not every cyber incident at a systemically important financial institution threatens the financial stability of the jurisdiction, systemic impact resulting from a cyber incident is conceivable under certain conditions. For a single-firm incident to impact the wider financial system a series of size, non-substitutability and interconnectedness threshold criteria would need to be exceeded. Category 1 supervised institutions and BOE supervised FMIs generally meet these criteria.⁶³

57. Critical third parties are increasingly identified as a potential source of a systemic cyber events. Compromising widely adopted technology solutions could be an effective manner of impacting a series of financial institutions at the same time. Due to economies-of-scale and network effects, plus the potential for improvements in the resilience of individual institutions, technological diversity between institutions is decreasing. Financial institutions are adopting common software solutions, acquiring highly similar hardware components, and migrating to a select set of global Cloud Service Providers (CSPs). A cyber incident in the supply chain could be propagated via confidence and financial contagion channels.

58. Continuous enhancement of operational and cyber resilience is becoming the norm as cyber incidents are bound to happen. Although not necessarily destabilizing events, most financial institutions report having faced cyber incidents over the last year. Strong capabilities to timely detect anomalies and compromises, as well as to respond and recover are critical in the current cyber threat landscape.

Review Scope: Systemic Banks and Financial Market Infrastructures

59. The note reviews key elements of the cybersecurity regulatory and supervisory approach for the financial sector in the United Kingdom. This includes the role and practices of the U.K. authorities⁶⁴ in the development and maintenance of the cybersecurity regulatory framework, cyber threat intelligence gathering, cyber risk related information sharing, on-site and off-site supervisory processes, cybersecurity testing and operational resilience.

60. This review is limited to the framework for systemically important banks, insurers, and financial market infrastructures. Supervisory practices for non-systemic financial institutions in the United Kingdom were out of scope for this review.⁶⁵ Single-firm cyber incidents with the potential to become systemic events are typically limited to the institutions in scope. However, cyber incidents at other institutions might also threaten regulators’ objectives, for example, financial stability in case of a coordinated multi-firm attack. The designation of critical national infrastructure in the financial sector, as well as additional expectations and arrangements⁶⁶ regarding their cybersecurity posture and resilience, were also out of scope.

61. The mission collected information from several sources. These include questionnaire answers provided by the BOE, PRA, FCA and HMT, interviews with both authorities and supervised institutions, the study of relevant national laws and reports published by the authorities, as well as documentation of their work.

62. Conclusions and recommendations of the review are aligned with international regulatory and supervisory good practices. As there are no binding international regulatory standards on cybersecurity risk management, the mission team used internationally recognized regulatory good practice as the basis of this report. The following documents were used as a benchmark in the assessment: the FSB Stock take of Publicly Released Cybersecurity Regulations, Guidance and Supervisory Practices; the BCBS Cyber-resilience: Range of practices; the IMF Departmental Paper on Cybersecurity Risk Supervision and the G7 Fundamental Elements for Effective Assessment of Cybersecurity in the Financial Sector. The basis of the review in the case of FMIs was the CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures.

Legal Basis

63. The BOE, PRA and FCA objectives and responsibilities in mitigating cyber risks and strengthen resilience of the United Kingdom’s financial sector stem from their broad statutory objectives and responsibilities. Cyber risk regulation and supervision of systemically important banks and insurers is conducted jointly by the PRA and FCA, focusing respectively on cyber risks which could affect the safety and soundness of regulated firms, and which could cause detriment to consumers or the integrity of the market. The BOE plays an important role in mitigating cyber risks that could affect the financial stability of the system. In addition to FMIs, the BOE also regulates firms that provide critical services to recognized payment systems, by virtue of the statutory power of HMT to bring them in the BOE remit.

64. Authorities’ statutory powers are defined in the Financial Services and Markets Act of 2000 (FSMA 2000) and the Banking Act of 2009 and are fully applicable in cyber risk and resilience matters. The regulators have broad statutory powers to set the rules related to the mitigation of cyber risks, as well as to supervise and enforce these rules. Furthermore, they have powers regarding information-gathering and dealing with failing financial institutions. HMT has statutory powers to respond to disruption, including those induced by cyber incidents. HMT can also propose legislation that changes the statutory powers of the regulators to Parliament.

65. The FSMA 2000 provides the PRA and FCA with the statutory power to request “skilled person reports”, which is a highly effective but not regularly used supervisory tool. A skilled person report (Section 166 of the FSMA 2000) can be commissioned for the following purposes: to identify, measure and address risks; to monitor the development of identified risks; to limit or reduce the impact or likelihood of identified risks; and to define and implement adequate responses for materialized risks. However, this tool has been used very sparingly. For example, in the last three years the supervisor authorities, together, commissioned six skilled person reports in the field of Technology and Information Management (Lot J).

66. The Banking Act 2009 allows HMT to include specified service providers to recognized payment systems in the recognition order of payment system operators. Based on Section 206A, HMT can bring the specified service provider within the regulatory remit of the BOE. So far, there is only one such firm in the United Kingdom.⁶⁷ Part five of the Banking Act 2009 gives statutory powers including information-gathering, reviewing proposed appointments, directions and enforcement, and special administration regime.

67. The cybersecurity framework for the financial sector is principles-based and outcome-focused. The different components of the cybersecurity regulatory framework provide a series of high-level expectations grounded in current internationally recognized best practices. In general, advanced financial systems with mature risk management practices benefit more from a principles - based approach. A focus on outcomes rather than prescriptive rules allows for more proportionality and risk-based supervision. At the same time, it could lead to variance in interpretation, challenges regarding consistency across firms and potentially debatable findings. Strong regulatory engagement and soft power is needed to address these challenges.⁶⁸

68. While not financial sector regulators themselves, HMT, and the National Cyber Security Centre (NCSC) work closely with the U.K. regulators and financial institutions on cybersecurity matters. HMT focuses on mitigating cyber risks with the potential to cause economic or societal harm or harms to public finances. As the United Kingdom’s National Technical Authority for cyber security, the NCSC provides technical cyber security advice to both regulators and financial institutions.

Regulators’ Governance Structure

69. Cyber risk forms an integral part of the discussion in different PRA and FCA risk and policy committees, resulting in it being integrated in the holistic risk view for the financial sector. There are five key Bank of England/PRA committees that deal with cyber risk and resilience: (i) the Financial Policy Committee (FPC) considers the financial stability and systemic aspects of cybersecurity and resilience; the Prudential Regulation Committee (PRC) is the highest decision-making committee for the PRA and has responsibility for key micro-prudential decisions, including issuing new rules; (iii) the PRA’s Supervision, Risk, and Policy Committee (SRPC) oversees the r isk portfolio, discusses thematic findings, reviews the appropriateness of the cyber risk supervisory tools and processes, and approves their updates; (iv) the FMI Board is the highest decision-making committee of the BOE in its capacity as supervisor of FMIs and critical service providers to recognized payment system operators within the BOE’s regulatory remit and (v) the Executive Committee is involved and consulted on the PRA cyber macro and microprudential strategy, cyber threat landscape, and the FPC cyber agenda. The FCA committees that are involved in cyber risk matters are: (i) the Executive Committee, which issues general guidance as defined by law and oversees crisis management arrangements including operational continuity; and the (ii) Executive Regulation and Policy Committee (ERPC), which oversees regulatory issues and is responsible for executive decision making.

70. The supervisory authorities have adopted a center-of-excellence model, which allows more flexible and risk-based assignment of deep technical expertise. Within the Bank, the Operational Risk and Resilience Division (ORRD) within the Supervisory Risk Specialists (SRS) directorate provides deep technical cyber risk expertise in support of PRA supervision and working with risk specialists within FMID, FMID supervision. Specifically, the ORRD informs and shapes regulation, and supports line supervisors and supervisory judgments based on specialist expertise, data analytics, and modeling. Each PRA supervision directorate has operational resilience hubs that are more focused on the market segment of the directorate, i.e., U.K. deposit takers, international banks, and insurance companies. Hubs therefore work more closely with line supervision and combine business understanding and cyber expertise. With the support of the ORRD cyber specialist team (and, where appropriate the Legal Directorate and Prudential Policy Directorate) this results in an effective organizational setup. Similarly, the FCA’s Technology, Resilience and Cyber ( TRC) department provides technical expertise to supervisors and firms so that they become more resilient to both cyberattacks and other disruption.

Macroprudential Framework

71. Discharging BOE’s responsibility to mitigate systemic cyber risk, the Financial Policy Committee (FPC) is the key governance body that develops the macro-prudential cyber risk mitigation and resilience framework. The FPC had formally recognized cyber threat as a risk to financial stability in 2013 and recommended establishing a work program to improve and test cyber resilience. Shortly thereafter, in 2014, the regulators launched the CBEST penetration testing program, globally the first of its kind. (See section on Testing) Leveraging the experience gained the FPC then evolved its recommendation to make CBEST a component for regular testing of the cyber resilience of the U.K. financial system. Then, in 2017 it set out a more specific framework driven by the FPC priorities that focuses on cyber resilience and testing with four key elements : (i) clear and proportional baseline resilience expectations; (ii) regular resilience testing by both firms and supervisors; (iii) identification of important firms outside of the regulatory perimeter; and (iv) clear and tested cyber incident response arrangements.

72. Besides discharging their micro-prudential supervisory responsibilities, the PRA’s, FCA’s and FMID’s work operationalize the FPC’s priorities in the cyber context. Examples include the recent operational resilience framework and expectations on outsourcing and third-party risk management (see section on Outsourcing and Third-Party Risk); the strengthening of the CBEST security testing program; and the cyber stress test program.

Microprudential Expectations and Additional Guidance for Cybersecurity

73. Cyber risk management expectations are implicitly included in the threshold conditions and fundamental rules that establish general expectations on risk management. The PRA Fundamental Rules and the FCA Principles for Business set out general risk management expectations, that are applicable to the identification and management of cyber risks and outsourcing risks, as well as business continuity and contingency planning. These rules are sufficiently broad to cover all aspects of cyber risk management practices at supervised financial institutions, however they do not have any technology or cyber risk specific provisions.

74. Supervisory expectations from U.K. regulators for financial institutions are further detailed in a series of supervisory statements and guidance. Figure 7 provides a schematic overview of the cybersecurity regulatory framework for systemic banks in the United Kingdom. The regulatory framework is informed by international good practice captured in frameworks like the NIST Cyber Security Framework, and cross-sectoral cybersecurity standards.

United Kingdom: United Kingdom’s Regulatory Framework for Cybersecurity at a Microprudential Level

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: Bank of England.

• Download Figure
• Download figure as PowerPoint slide

View Full Size

United Kingdom: United Kingdom’s Regulatory Framework for Cybersecurity at a Microprudential Level

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: Bank of England.

• Download Figure
• Download figure as PowerPoint slide

United Kingdom: United Kingdom’s Regulatory Framework for Cybersecurity at a Microprudential Level

Citation: IMF Staff Country Reports 2022, 108; 10.5089/9798400206771.002.A001

Source: Bank of England.

• Download Figure
• Download figure as PowerPoint slide

75. International principles and guidance form the basis for cyber risk and resilience reviews at the FMIs. The supervision of FMIs is conducted against the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI) and the Guidance on Cyber Resilience for Financial Market Infrastructures. Principles cover cyber governance, identification, protection, detection, response, and recovery (including a two-hour recovery time objective), testing, situational awareness, and learning and evolving. This guidance stays principle-based and mostly non-prescriptive, which allows for a degree of flexibility in their implementation.

76. The recently adopted operational resilience framework (ORF) provides a holistic strategic framework that brings together the different areas of financial regulation relevant to operational (including cyber) incidents, i.e., operational risk management, business continuity and contingency planning, data security, outsourcing and third-party risk management. In addition, the ORF leverages the U.K. regulators’ requirements and expectations on corporate governance and individual accountability, the Senior Managers and Certification Regime (SM&CR). In addition to the abovementioned detailed requirements and expectations⁶⁹, the regulators published in March 2021 their ORF (i.e., PRA PS6/21 and FCA PS21/3). This requires supervised financial institutions to:

• identify their important business services that if disrupted could cause harm to consumers or market integrity, threaten the viability of firms or cause instability in the financial system.

• set impact tolerances for each important business service, which quantify the maximum acceptable level of disruption they would tolerate.

• identify and document the people, processes, technology, facilities, and information that support their important business services; and

• take action to remain within their impact tolerances through a range of severe but plausible disruption scenarios.

77. Dually supervised financial institutions must comply with both PRA and FCA expectations on impact tolerances. This is due to differences in statutory objectives and supervisory priorities. Generally, FCA requirements result in tighter tolerances, because in a cyber incident consumer harm usually occurs earlier than material impact on the safety and soundness of the firm.⁷⁰ However, the PRA and FCA developed their respective policies simultaneously and in close coordination and consider them to be aligned. Complying with the PRA’s and FCA’s respective expectations is not perceived as a major difficulty by the industry as the highest resilience expectation will implicitly set the bar and firms may concentrate their efforts in ensuring they can remain within the more stringent tolerance.

78. The European Banking Authority’s Guidelines on Information and Communications Technology and Security Risk Management have been onshored. These guidelines (EBA/GL/2019/04) define good practices for the mitigation and management of information and communication technology risks. Credit institutions, investment firms and payment service providers are required to:

• Establish sound internal governance and internal control frameworks.

• Manage and mitigate ICT and security risks through an independent and objective control function.

• Develop information security policies and training, as well as conducting reviews, assessments, and tests.

• Improve the monitoring and management of ICT operations, including the implementation of logging and monitoring procedures, as well as actively managing assets’ lifecycles.

• Reinforce project and change management procedures; and

• Adopt appropriate business continuity management and develop response and recovery plans.

Following the Brexit transition period, the BOE and PRA expect firms and FMIs to continue to make every effort to comply with existing EU Guidelines and Recommendations that are applicable as at the end of the transition period, to the extent that these remain relevant.

79. A key element of the cyber risk regulatory framework is the Senior Managers and Certification Regime (SM&CR). The SM&CR establishes individual accountability and responsibility for senior managers of financial institutions along several Senior Manager Functions (SMFs). In terms of operations and technology, including cybersecurity, SMF24 function holders are accountable and responsible to a financial institution’s board and the regulators (in this context the PRA and FCA) for that firm’s operations and technology. Through this mechanism the regulators aim to facilitate the development of an appropriate cybersecurity governance and organizational culture, both key priorities. Interestingly, SMFs can be shared but not split, with the single exception of the SMF24, which could be split as well, for example between an equally senior Chief Operating Officer (COO) and a Chief Information Officer (CIO). A hierarchical dependency between SMF holders is prohibited. For example, a Chief Information Security Officer (CISO) subordinated to the CIO cannot be an SMF24 holder and personal accountability for cybersecurity rests with the CIO instead. The SM&CR together with the new comprehensive ORF promote the convergence of business and technology resilience, which should result in enhanced cyber risk management practices.

80. While the SM&CR does not extend to BOE supervised FMIs, a non-objection process is in place for the appointment of key senior managers and board members. The process involves interviews and capability reviews before the appointment of key senior managers and board members. HMT is currently consulting on legislation that would formally extend the SM&CR to FMIs.

Outsourcing and Third-Party Risk

81. In recent years outsourcing and third-party risk has been on both the macroprudential and microprudential supervisory agenda. Relying on the broad rules of the PRA Fundamental Rules and the FCA Principles for Business has become less tenable in the wake of the growth of outsourcing in the U.K. financial sector, especially to the cloud.⁷¹ On the microprudential level the PRA and the FCA took a coordinated approach to setting expectations on outsourcing and third - party risk management. Effective cooperation between the authorities resulted in specific and aligned expectations that are at the same time principles-based and technology agnostic. These expectations are aligned with the EBA Guidelines on outsourcing arrangements as well (EBA/GL/2019/02) but also include additional details in certain areas to complement the PRA’s and FCA’s framework on operational resilience.⁷² On the macroprudential level the FPC has recognized the potential systemic risk posed by critical third-party service providers and has been closely monitoring the use of cloud services in the financial sector since 2018.⁷³ In 2021, the FPC noted that since the start of 2020, financial institutions “had accelerated plans to scale up their reliance on [cloud service providers (CSPs)] and in future place vital services on the cloud” and concluded that the reliance on a small number of CSPs and other critical third parties (CTPs) for vital services could increase financial stability risks in the absence of greater direct regulatory oversight of the resilience of the services they [provide]”. The Bank/PRA and FCA, working with HMT, are planning to develop additional measures to manage the risks stemming from CTPs, including (i) an appropriate framework for designating certain third party service providers as ‘critical’; (ii) resilience standards for CTPs in respect of any critical services they provided to U.K. firms, which should build on the operational resilience framework; and (iii) resilience testing of CTPs building on existing testing frameworks and sector exercises developed by the U.K. financial authorities e.g. CBEST and SIMEX. These could potentially be carried out in collaboration with overseas financial regulators and other relevant U.K. authorities.⁷⁴

As noted by FPC, The Bank /PRA and FCA, working with HMT, are planning to develop additional measures to manage the risks stemming from CTPs, including: an appropriate framework to designate certain third-party service providers as critical; resilience standards; and resilience testing. A joint Discussion Paper with detail on these proposals is planned for 2022.

82. The PRA’s policy statement on outsourcing and third-party risk management (PS7/21) extends the supervisory expectations and establishes contractual requirements. Financial institutions remain ultimately accountable for all activities they outsource to a third party, which is a key principle in the U.K. regulation on outsourcing in the financial sector. From March 2022 onward, financial institutions supervised by the PRA must ensure that material outsourcing contracts meet a series of regulatory requirements, including on access, audit, and information rights; data security; and the management of sub-outsourcing risk and business continuity, contingency planning and exit strategies. The new expectations enhance third-party risk management and the ability of the supervisor to monitor systemic risk stemming from third-party service concentrations and interdependencies; especially if backed up by commensurate supervisory activity.

83. The FCA’s guidance for firms outsourcing to the cloud and other third-party IT services (FG16/5) sets out largely similar expectations. Firms supervised by the FCA should comply with the risk management expectations covered in Principle 3 and SYSC 1.2.1 of the FCA’s handbook. Other sources of expectations include SYSC 8 and SYSC 13 of the handbook, the Electronic Money Regulations 2011, the Payment Services Regulations 2017, the directly applicable MiFiD II Org Regulation covering organizational requirements, and the EBA Outsourcing Guidelines.

84. Banks and insurance firms are required to notify the PRA and the FCA when entering or significantly changing a material outsourcing arrangement. In addition, FMIs are required to seek approval by the BOE on outsourcing critical activities. Under the European Market Infrastructure Regulation (EMIR), Central Counterparties are required to apply to the BOE for permission to outsource critical activities linked to risk management. Under the Central Securities Depositories Regulation (CSDR), Central Securities Depositories are required to apply to the BOE for permission to outsource any core services. Both CSDR and EMIR have been retained in U.K. law after the end of the Brexit transition period.

85. Currently the U.K. authorities have no legal powers to directly supervise the cyber resilience of critical third-party services, except for critical service providers to recognized payment systems which have been brought into the regulatory perimeter. Section165A of the FSMA 2000 provides the PRA with information gathering powers regarding third-party service providers, but this cannot be construed as supervisory power and is subject to safeguards, criteria, and requirements specifically related to the financial stability mandate. The FCA and PRA also have information gathering powers over service providers to insurers and, in the FCA’s case, FCA-regulated investment firms under Section 165 of FSMA. However, these powers do not cover all critical ICT third-party service providers (e.g., global cloud service providers) and only apply to service providers to a subset of regulated firms.

86. The authorities have focused on firm-specific and thematic reviews of existing outsourcing arrangements, as well as related risk management and assurance processes. The plans to implement a RegTech solution to collect and analyze data on outsourcing and other third - party service agreements has the potential to enhance this work as well as the ability of the authorities to identify, monitor and manage third-party concentration risks.

87. Third-party cyber risks increasingly impact the scope and threat scenarios of CBEST testing. First, third-party service providers critical for the business services in scope of a CBEST assessment are expected to be involved by the assessed firm. Soft power is used by the U.K. authorities, in absence of hard legal powers, to incentivize firms to involve these third-party service providers. Second, there is an increased focus on supply-chain cyberattack scenarios as part of a CBEST assessment. The CBEST Implementation Guide explicitly notes that “Malicious Insider and Supply Chain Scenarios are a feature of the threat landscape for many firms [and] should always be analyzed and discussed during CBEST”.

88. The authorities’ cyber risk management expectations have gone through a major review and as a result now are much more specific in critical areas such as operational resilience and third-party risk. The strengthened regulatory framework for third-party risk supervision is still in early stages and insights on the implementation by supervised financial institutions will only become available in 2022, after the expectations become effective. Both the PRA and the FCA are developing approaches and tools to monitor progress and detect potential issues.

Recommendations

89. The authorities should continue reviewing cyber risk, and more broadly, technology risk management expectations with the aim to publish more specific guidance. Currently, expectations are too often implicit in high-level rules⁷⁵ and interpretation and implementation challenges exist. Regulators should also consider additional soft guidance, e.g., speeches and letters, to support cyber risk mitigation and resilience objectives.

90. The Bank/PRA and FCA should seek additional statutory powers to assess the resilience (including cyber resilience) of any critical services that third party service providers provide to regulated financial institutions, as recently suggested by the Bank of England Financial Policy Committee (FPC). This should include the ability to commission skilled persons reviews. Currently, firms are incentivized to require adequate cyber risk management in the supply chain by the principle of the ultimate responsibility for any outsourced activity residing with the firm, and supervisory soft power. Like most jurisdictions at present, the PRA does not have express statutory authority to directly review or examine any critical services that cloud, and other third - party service providers provide to regulated firms, unless these firms’ contracts with these service providers authorize such regulatory access (the PRA and FCA require firms to include clauses granting regulatory access in their contracts with cloud providers and other ‘material’ third party service providers). However, a more direct approach is advisable, because of the high levels of cyber risk stemming from the supply chain, the ongoing growth of outsourcing, and service provider market consolidation that leads to a lack of substitutability and the emergence of systemically important service providers.⁷⁶ In addition, while service agreements often include audit clauses, the supervisor can find it difficult or impossible to delve deeper into certain areas of concern at third parties without explicit statutory power. To avoid the risk of supervisory overreach, statutory powers should be limited to the services relevant to the Bank/PRA’s and FCA’s statutory objectives. As noted by FPC, The Bank /PRA and FCA, working with HMT, are planning to develop additional measures to manage the risks stemming from CTPs, including: an appropriate framework to designate certain third-party service providers as critical; resilience standards; and resilience testing. A joint Discussion Paper with detail on these proposals is planned for 2022.

91. The Senior Managers and Certification Regime should be extended to BOE supervised FMIs as currently being consulted on by HMT. This would further strengthen the accountability with respect to operational and cyber resilience, governance, and culture at FMIs and would result in a better aligned regime across all BOE, PRA and FCA supervised entities.⁷⁷

92. Macro-level expectations regarding operational and cyber resilience should be considered to support financial stability and guide individual institutions. Progress could be made in not just expecting firms to set their impact tolerances but imposing upper limits in case of extreme but plausible scenarios affecting important services, as well as specific requirements for recovery testing. Proportionality could be implemented based on the existing firm categorization system. More specific supervisory expectations can also help financial institutions in contract negotiations with critical technology service providers and would support BOE’s Future of Finance project goal of a safe and controlled cloud migration.

93. Firms would benefit from aligned cyber risk reporting processes and templates, including for reporting cyber incidents and material outsourcing arrangements. The absence of reporting templates typically results in less reliable and/or comprehensive records, which in turn impacts the effectiveness of the risk-based approach. Templates and report processing that are not aligned across authorities for reporting the same events, complicate internal processes at firms and may result in inconsistencies.

Supervisory Engagement

100. Supervisors meet bilaterally with SMF24 function holders of systemically important firms twice a year.⁷⁸ In these meetings supervisors discuss different aspects of the design of operational and cyber resilience control measures, business continuity and contingency plans, and information security strategies. These meetings are frequently used to review progress against remediation plans and to convey feedback and supervisory expectations regarding cyber resilience measures.

101. The Periodic Summary Meeting (PSM) sets the supervisory agenda and work program for the coming year, including cyber risk matters. PSMs are annual reviews of a firm’s key and potential key risks, which may result in an additional assessment and more detailed investigation of the risk. Furthermore, the meeting could be used to identify the most suitable risk mitigating action. Annual PSMs could be complemented with Mid-Point Reviews (MPR).

102. Firm-specific supervisory findings and recommendations are communicated via formal letters and CBEST final remediation plan documents. A PSM feedback letter is generally used to communicate the key messages from the PRA supervisory team as well as the corrective measures (if any) that the PRA expect the firm to implement in the context of findings. Similarly, the FCA communicates its finding via a letter to the firm with an accompanying risk mitigation plan, which describes the individual findings, the mitigation steps, and the timeline for completion. The findings in the risk mitigation plans are not given risk rankings. As part of the CBEST process the supervisors agree with firms a final remediation plan document which outlines prioritization, ownership, and timing of the expected remediations. Finally, sector-wide thematic findings are shared by the PRA and FCA with all their supervisees or through a regulatory digest communication.

103. Supervisory findings and recommendations are followed-up as part of the continuous assessment process. In exceptional cases, such as repeat findings or unsatisfactory remediation, a skilled person report could be required, and/or a formal investigation could be launched, which in turn could lead to enforcement action.

Thematic Reviews

104. Cyber and operational resilience focused thematic reviews are used to assess emerging risks and identify prevailing industry practices (e.g., to understand the impact of COVID-19). These reviews target specific cybersecurity topics with the goal to make firms aware of potential common vulnerabilities identified by supervisors and help them with mitigation. Both IBD and FMID have conducted thematic reviews to understand the impact of COVID-19 on the cybersecurity posture and the resilience of daily operations of financial institutions (including working from home arrangements). Collaboration with the NCSC is sought to obtain additional expertise and guidance, including identification of best practices.

105. Cyber themes emerging from the CBEST and CQUEST assessments are periodically shared with all PRA and FCA regulated firms, and FMID regulated FMIs. Given the sensitivity of the information, these documents are not published. However, to increase transparency, the FCA published two cyber insights documents that do not contain sensitive information, sharing the practices and experiences of the Cyber Coordination Groups (CCG) attendees.⁷⁹

106. The thematic review process is being redesigned to increase the completeness, coordination, and timeliness of the reporting. The aim is to implement annual regular and standardized thematic reporting. This entails increasing the number of data points recorded, aligning the PRA and FCA methodologies, and standardizing production and communication.

107. FMID analyses cyber risk exposures from an operational as well as a clearing perspective. In case the IT infrastructure of a participant is compromised, FMID actively monitors the central counterparties (CCPs) exposures to it.

Self-Assessment

108. A cyber resilience self-assessment questionnaire (CQUEST) is used to collect information on, and analyze, firms’ practices and maturity levels. Returns are the basis, among others, of cross-sectoral and temporal analyses and help steer supervisory engagement. CQUEST is based on the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF). The NIST CSF is widely regarded as capturing the best practice in cyber risk management and cyber resilience. CQUEST consists of 48 multiple-choice questions structured along the NIST CSF functions of Identify, Protect, Detect, Respond, and Recover. CQUEST also incorporates an additional domain focusing on Governance/Leadership and expectations of Board/Senior Execs in relation to cyber. CQUEST is much simplified compared to the NIST CSF, which in turn is a high-level outcome-centric framework. While it provides useful information, CQUEST is a “light-touch” supervisory tool because there is no requirement to substantiate the self-assessment with evidence, unless supervisors detect inconsistencies, over-confidence, or other discrepancies later.

109. The authorities have process in place to ensure the consistency and relevance over time of CQUEST. The questionnaire is subject to an 18-months review cycle (24-months for FMIs) so it can keep pace with the changing threat landscape and the PRA and FCA coordinate assessments and share reports for dually supervised firms.

Testing

110. The authorities have pioneered and implemented a comprehensive testing regime that strongly supports the supervisory objectives of all authorities. The elements of the regime are the CBEST testing program, the cyber stress tests, and the industry crisis exercises.

Incident Reporting

124. The cyber incident notification guidelines leave the firms to decide when to notify the authorities of an event, which results in reporting inconsistencies . Systemic banks and insurance firms are expected to report cyber incidents under the PRA’s and FCA’s general notification requirements as soon as practically possible. Currently, there is no published and specific framework, rule, or guidance on reporting cyber incidents, leaving firms to develop their own internal processes and reporting strategies. Inconsistencies in reporting processes between firms were observed and resulted in reclassifications of (reported) incidents. Implicit expectations of the FCA appear to be stronger, resulting in broader reporting.

125. United Kingdom DT’s cyber trend reporting processes is heavily based on professional judgement, which could impact information flow. Professional judgement is key in determining the need as well as the appropriate level for escalation of a reported incident, which makes the process highly dependent on the experience and capabilities of a limited set of individuals. Similarly, information on cyber incidents is currently not collated and fed into risk summary and trend reports but shared with ORRD as deemed necessary (i.e., based on professional judgement).

126. FCA leverages the incident data maintained on the central record to identify trends and inform supervisory strategies. A team within the Technology Resilience and Cyber department (TRC) is responsible for a structured process for managing and recording cyber incidents, which is informed by an FCA-wide harm taxonomy to measure the severity and impact of the incident (i.e., harm to the firm itself, to its customers and to the stability of the market). This process includes collecting post incident reports to ensure that root causes for the incident are recorded, as well as a wide variety of information including details on compromised third parties (if any) and data breach details (if applicable). This information is fed into several internal dashboards.

127. The U.K. Financial Services Cyber Incident Response Framework provides firms with guidance on incident reporting and expected response across government, regulators, and law enforcement. The framework provides regulatory affairs and compliance teams with guidance on handling U.K. regulator interactions and mandatory reporting requirements, including the financial services authorities, the Information Commissioner’s Office (ICO), the National Cyber Crime Unite (NCCU) of the National Crime Agency and the Police’s National Fraud Intelligence Bureau (NFIB). Furthermore, the framework elaborates on the NCSC incident thresholds and classification structure. Finally, it provides incident management and response teams with best practices on information sharing and coordination.

Response Framework

128. The Authorities’ Response Framework (ARF) is used as a single mechanism to coordinate their response to cyber threats and incidents. ARF invocation is by consensus among all financial authorities, although any one authority can organize a call to discuss invocation. Given their strong relationship and ongoing cooperation in cyber matters, reaching consensus has been fast. Wider government may also be included in the response, depending on the severity of the incident. There is a defined incident severity categorization system in place. Once the ARF is invoked, an agreed upon Lead Financial Authority assumes responsibility for information sharing and coordination. For significant cyber incident the NCSC provide technical advice. The lack of formally documented rules on which authority leads in which type of incident does not seem to hinder agreement on the basis that there are agreed principles for decision-making on which authorities leads the ARF (e.g., consumer detriment (FCA), safety and soundness or financial stability (Bank), economic or societal harm or a risk to public finances (HMT)).

129. The authorities always maintain the ARF to remain effective. The ARF is owned by HMT but is jointly maintained by all financial authorities, based on an annual performance review, in which the NCSC also participates.

130. Coordination and information sharing protocols between financial institutions, FMIs, industry groups and the authorities are set out in the Sector Response Framework (SRF). The SRF supports collaborative engagement between firms and financial authorities in case of critical incidents. The criteria for classifying an incident are clearly set out in the Industry Incident Lexicon within the SRF.

131. The SRF architecture is complex both because of the large number of participating entities and their complex interrelationships, which may have an adverse impact on response agility. There are over ten organizations or cooperation mechanisms on the SRF map that are involved in some capacity in information sharing and response, not counting international organizations and individual firms. Key among these is the information sharing groups at the sub - sector level (i.e., retail and wholesale), the Finance Sector Cyber Collaboration Centre (FSCCC), the CMBCG, U.K. Finance’s Incident Communication Group (ICG), the NCSC, and of course the ARF members. The CMBCG is pivotal to the SRF as a strategic coordination and decision-making group. The ICG also plays a strategic role in coordinating external communications with the CMBCG.

Resources

132. The PRA and FCA work on upskilling generalist supervisors in cyber risk to reduce pressure on cyber risk specialists. The objective is to pull cyber knowledge into the generalist supervision teams for systemic banks and insurance firms. This should enable a reinforcement of the teams’ ability to make professional judgements related to cyber risks and more selectively request involvement from the cyber risk specialists.

133. The skilled person reports provide a tool to externally acquire highly specialized cyber expertise. A skilled person review can be commissioned for the following purposes: to identify, measure and address risks; to monitor the development of identified risks; to limit or reduce the impact or likelihood of identified risks; and to define and implement adequate responses for materialized risks. In 2020, three Lot J—Technology and Information Management reports were completed across banking and insurance, which suggests a limited use of the tool.

134. The FMID is appropriately resourced and has access to independent expertise. The Bank of England has established a team of more than 50 supervisors for 10 FMIs and a critical service provider, which is composed of supervisors with a general risk expert profile and cyber/IT experts. Access to subject matter experts at the PRA has been formalized and is used for periodic supervisory assessments and CBEST exercises.

Coordination and Cooperation

135. Procedures for coordination, information sharing, and collaborative supervisory activities between the PRA and the FCA are detailed in a Memorandum of Understanding.

136. Generally, supervised institutions tend to actively collaborate with supervisory authorities in the context of technology and cybersecurity risk. This mirrors the more collaborative stance on cybersecurity issues between institutions.

137. The authorities actively participate and have key roles in international cyber resilience guidance development. In 2016, the G7 formed a Cyber Expert Group (CEG), co-chaired by the U.S. Department of the Treasury and the Bank of England. HMT and the FCA are also members, alongside other financial authorities across the G7. Since its creation, the CEG has developed several public documents, including Fundamental Elements for Cybersecurity; Fundamental Elements for Effective Assessment of Cybersecurity in the Financial Sector; Fundamental Elements for Third Party Risk Management; and Fundamental Elements for Threat Led Penetration Testing. In addition, the CEG has developed a Cyber Incident Response Protocol (CIRP) to improve coordination in the event of a cyber incident with cross-border implications for G7 countries. The Bank of England’s supervisory and policy teams participate and contribute to international committees and working groups hosted by the Financial Stability Board (FSB) and the Bank for International Settlements (BIS), which includes the Committee on Payment and Market Infrastructures (CPMI) and the Basel Committee for Banking Supervision (BCBS).

138. Collaboration with other relevant international supervisory authorities on CBEST is actively considered, and recognition of other threat intelligence-led penetration testing regimes is possible if minimum requirements have been met. Specifically, the PRA and FCA have been collaborating with the ECB to ensure alignment between the CBEST and TIBER-EU frameworks. The first pilots were completed in 2020 for collaboration with other European authorities as well. Supervisory authorities of the United States and several Asian jurisdictions have acted as observers in CBEST exercises. Collaboration and recognition of other threat intelligence-led penetration testing programs is crucial in reducing the burden for firms and supervisors alike.

139. International cooperation and supervisory coordination form integral parts of the BOE’s supervisory approach for FMIs that are systemically important for more than one jurisdiction. The BOE has concluded Memorandums of Understanding with a wide range of authorities in international jurisdictions, organizes colleges for each of its CCPs and participates in international oversight forums. A context of participation and mutual recognition of supervisory threat-intelligence led cyber testing has been established, i.e., authorities from international jurisdictions have been involved in CBEST testing and the Bank of England has participated in other international cyber testing.

Enforcement

140. The FSMA 2000 provides the PRA and FCA with appropriate powers to take enforcement, criminal or civil action against regulated and non-regulated firms and individuals who are failing or have failed to meet the standards. Examples of possible enforcement actions include: (i) prohibiting an individual from performing functions in relation to regulated activities and withdrawing approvals; (ii) suspending a firm for up to 12 months from undertaking specific regulated activities; (iii) suspending an individual for up to two years from undertaking specific controlled functions; (iv) censuring firms and individuals through public statements; and (v) imposing financial penalties on firms and individuals. In the past three years the PRA has not imposed penalties related to non-compliance with cyber risk related regulations while the FCA has fined one firm.

Recommendations

141. Supervisors should conduct additional cybersecurity control effectiveness verification activities to complement desk-based analytical work, supervisory engagement, and CBEST testing. These on-site examination activities provide value in at least three areas: (i) independent verification of information provided during supervisory engagements; (ii) as a result, encouraging candor in providing accurate cyber risk related information; and (iii) developing in-depth knowledge on the way supervised firms are organized and operated (including the corporate culture).

142. U.K. authorities should further strengthen their operational and cyber resilience supervisory teams. There is a strain on specialized cyber expertise and the expected increase in cyber risk regulatory and supervisory work compounds the problem. While upskilling non-specialist supervisors is useful, there are limitations to what it can achieve.

143. The authorities should consider additional opportunities to strengthen the penetration testing framework. These include:

(i) Internal threat intelligence and/or testing capabilities of firms, subject to meeting CBEST accreditation criteria, could be leveraged to reduce costs. Allowing firms to use their internal capabilities could also stimulate the adoption of testing regimes like STAR-FS.

(ii) Grey box testing and purple teaming,⁸² which would bring additional learning opportunities for CBEST participants. While grey-box testing would less closely mimic a real cyber-attack, it would allow for more comprehensive testing within the time limits. Purple teaming could improve the benefits of the exercise by providing the detection and response teams with deeper insights in faster feedback cycles.

(iii) A generic threat intelligence report for smaller firms, which could assist in further broadening participation in threat intelligence led testing,⁸³ effectively supporting the authorities’ objective to include a wider set of financial institutions while maintaining adequate regulatory assurance and technical rigor.

(iv) Security reviews of key protections against vulnerabilities that cannot be included in the penetration testing of live production systems. Examples include denial of service attacks, ransomware attacks, and data integrity attacks. The prevalence of these attack categories has been growing and pose a significant risk. Penetration testing cannot be used in these risk scenarios, but configuration reviews, for example, of network perimeter defenses, traffic scrubbing, anti-malware systems, or data integrity protection systems would add valuable assurance on the effectiveness of relevant mitigations. In addition, this would facilitate purple teaming.

(v) Finally, the red team could be allowed greater freedom to develop a cyberattack that has not yet been observed and set out in a scenario.⁸⁴

144. The CQUEST cybersecurity questionnaire could be usefully augmented with requiring that firms provide evidence to support the self-assessment. Currently, ascertaining the accuracy of the self-assessment is quite difficult; and besides some internal consistency checks there are no steps made in this regard (by design). However, requiring the attachment of supportive documentation to the answers implying higher maturity would convey stronger assurance over CQUEST results.

145. Prioritize developing the proposed cyber resilience maturity assessment framework of the core assurance framework to gain better insight in the cyber resilience posture of the supervised FMIs, and to communicate the supervisory expectations according to defined maturity levels. When fully developed, the proposed maturity assessment framework—aligned with international standards—will provide a convenient structure, defined maturity levels and linked indicators to support better insights obtained from supervisory engagement, inspections, and operational control effectiveness assessments. The maturity assessment could further clarify the supervisory expectations regarding the operationalization of the CPMI-IOSCO Guidance on Cyber Resilience for Financial Market Infrastructures and provide a meaningful basis for further improvements of the cyber resilience posture.

146. The usefulness of cyber stress testing could be greatly improved with quantifying the impact on liquidity and capital buffers. Risk to the broader economy caused by systemic cyber events is primarily transmitted through liquidity shortfalls (in the short term) and deterioration of capital positions (in the longer term). Therefore, ways of including liquidity and capital impact calculations in the cyber stress tests should be researched. Alternatively, such calculations could be done in the financial stress test, based on severe but plausible cyber incident scenarios.

147. Broad international representation and key functions in standard setting bodies could be further leveraged to promote internationally better aligned supervisory expectations and tools. The international financial system, including some of the globally largest firms supervised by U.K. regulators, would greatly benefit from better alignment of regulatory and supervisory expectations across jurisdictions. An incoherent set of cybersecurity guidance might negatively impact the U.K. regulators’ objectives as well. Furthermore, conflicting, redundant, or confusing approaches (including questionnaires and intelligence-led testing) could result in unnecessary duplication of effort. This duplication may drain resources available at supervised firms from actual cybersecurity enhancing activities.