The UK's Financial Services Authority announced at the September meeting of the Operational Risk Standing Group (ORSG) that it would be delaying, until further notice, the implementation of the Prudential Sourcebook text for 'systems and controls'.
The new guidance had an original deadline of the end of this year, and by many industry accounts firms had already spent eight figures implementing the new rules. However, the regulator has yet to make an official public announcement on the issue, and did not return calls by press time.
The ORSG meeting, held last week, left many industry participants stunned. Says one: “There were 30 of us sitting around the table listening to this and thinking, ‘dear me’.” More than one ORSG member spoken to for this article has noted that the abandonment of the ‘systems and controls’ text will result in substantial reputational risk for the FSA in the future.
The text for ‘Consultation paper 142: Operational Risk Systems and Controls’ was issued in ‘near final’ form in October 2003 after repeated consultations with the industry. The text, due to be finalised in November, outlined guidance to firms on the creation and maintenance of systems and controls, and it covered areas such as operational risk, managing inadequacies in a firms’ processes, outsourcing and business continuity management. The implementation deadline was set as December 31, but that has now been called off by the regulator.
The new guidance has been shelved because of a conflict with the implementation timetable of the ‘Markets in Financial Instruments Directive’ (MiFiD), also known as the revised ‘Investment Services Directive’ (ISD2), from the European Union. This directive “regulates the authorisation, behaviour and conduct of business of securities firms and markets, aims to provide for an integrated securities market in the EU and for the effective cross-border provision of investment services, whilst enhancing the protection of investors and market integrity and promoting fair, transparent and efficient financial markets”, according to a statement on the UK Treasury website. The directive was passed by the EU Parliament on March 30, and published in the EU’s Official Journal on April 30. The UK must implement the directive by May 1, 2006.
The passage of MiFiD had been pushed ahead, allegedly so that the bill would not get bogged down upon the arrival of the EU accession countries in May. As a result, say several sources, the impact of some of the content of the new directive was not adequately analysed to take into account existing UK regulatory initiatives. “Apparently the implementation of the MiFiD means large chunks of what is currently guidance has to be recast as rules,” says one source. As a result, the FSA would have been in a position where it would have had to immediately rescind brand new guidance and kick off a consultation on how to change it into rules if it had allowed ‘Systems and controls’ to move ahead.
The FSA has also been under increasing pressure in recent months to stop ‘gold plating’ EU directives, and instead simply translate such directives straight into the UK regulatory framework. The EU financial regulatory framework focuses on rules, and steers clear of offering regulatory guidance to firms. ‘Systems and controls’ - which was widely seen as being super-equivalent to EU regulations and took the form of guidance - was an accident waiting to happen, according to several industry sources.
Industry sources are said to be furious with the FSA for the sudden turnaround, as many had been ‘full steam ahead’ with implementing ‘systems and controls’ at their own firms. Said one: “The willingness of senior people within firms to take seriously FSA deadlines will be damaged.” Another said firms were keeping quiet about the FSA’s sudden change of direction because they were embarrassed - many had had to champion their ‘systems and controls’ projects internally for budget purposes, and were now faced with the prospect of having substantial political egg on their faces.