Context
In what seems to be an intention to assist firms in considering their resilience to a ‘hostile attack’, the FCA has published ‘lessons for firms’ from its Defence, Security and Resilience Lab. The FCA brought together around 120 leaders from financial services, government and defence for the Lab. The findings are to share firms’ views on systemic risk, on the FCA’s work on strengthening resilience, and on how firms can assess their own exposure.
Key points to note and next actions
The headline findings are:
- Firms felt less confident about spotting shared risks
- Firms want clearer signals before committing capital
- International dependencies need to be considered when planning for resilience
- There are multiple shared dependencies between firms
- Some risks can’t be solved alone
The FCA plans to further investigate how it can support intelligence sharing with the financial sector, whether more focus is needed on back-up, ‘fail-safe’ technologies that can be used when disruption hits, and exploring access to banking and finance frictions.
The FCA has posed some questions to help firms assess their risk and support UK resilience:
- Have you mapped your firm’s systemic vulnerabilities: are they internal, external or supply chain dependencies? For example, if you rely on public sector databases, cloud services or payment infrastructures operating outside your business, how are your vulnerabilities spread across the technology, service providers, locations and people within your firm?
- Have you tested whether your back-up systems would be resilient if a disruption also affected other firms relying on the same back-up provider or infrastructure?
- Have you considered how your firm’s crisis communications would need to change if disruption or conflict-related events were affecting multiple firms, or the whole sector, simultaneously, rather than just you? How would you sustain your communications over a longer period?
- Does your firm provide a single point of failure, and if so, how quickly could your disruption impact others?
- Can your firm access defence sector expertise to support defence and dual-use clients’ access to finance?
- (For investors) Do you ask investee companies about their resilience measures?