SYSC Senior Management Arrangements, Systems and Controls sourcebook

You are viewing the Handbook in the past on 01/10/2015

Used in

Related links to this Part

Export part as

SYSC 1

Application and purpose

SYSC 1.1A

Application

  • 01/04/2009



[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering:



- various topics relating to automated trading and direct electronic access. See

and



- certain aspects of the MiFID suitability requirements which also deal with the system and control aspects of suitability. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-suitability-requirements.]

SYSC 1.1A.1

handbook-guidance
The application of this sourcebook is summarised at a high level in the following table. The detailed application is cut back in SYSC 1 Annex 1 and in the text of each chapter.

Firms that SYSC 19D applies to should also refer to the Remuneration part of the PRA Rulebook

SYSC 1.1A.1A

handbook-guidance
Chapters 4 to 9 are not applicable to CRR firms (other than incoming firms).

SYSC 1.1A.2

handbook-guidance
The provisions in SYSC should be read in conjunction with GEN 2.2.23 R to GEN 2.2.25 G. In particular:
(1) Provisions made by both the FCA and PRA may contain obligations for or references to FCA-authorised persons. GEN 2.2.23 R limits the application of those provisions so that the PRA will only apply them in respect of PRA-authorised persons and not to such FCA-authorised persons as are included within the provision.
(2) Provisions made by both the FCA and PRA may be applied by both regulators to PRA-authorised persons. Such provisions are applied by each regulator to the extent of its powers and regulatory responsibilities.

SYSC 1.2

Purpose

  • 01/12/2004

SYSC 1.2.1A

handbook-guidance
The purposes of SYSC are:
(1) to encourage firms' directors and senior managers to take appropriate practical responsibility for their firms' arrangements on matters likely to be of interest to the PRA because they impinge on the PRA's functions under the Act;
(2) to encourage firms to vest responsibility for effective and responsible organisation in specific directors and senior managers; and
(3) to create a common platform of organisational and systems and controls requirements for all firms.
  • 19/06/2014

SYSC 1.4

Application of SYSC 11 to SYSC 21

What?

SYSC 1.4.1

handbook-guidance
The application of each of chapters SYSC 11 to SYSC 21 is set out in those chapters and in SYSC 1.4.1A R.

SYSC 1.4.1A

handbook-rule
SYSC 12, SYSC 19A, SYSC 19D, SYSC 20 and SYSC 21 do not apply to a firm in relation to its carrying on of auction regulation bidding.

SYSC 1.4.1B

handbook-guidance
Apart from SYSC 12, SYSC 19A, SYSC 19D, SYSC 20 and SYSC 21 which are disapplied by SYSC 1.4.1A R, the other chapters of SYSC 11 to SYSC 17 do not apply in relation to a firm's carrying on of auction regulation bidding because they only apply to an insurer. SYSC 18 provides guidance on the Public Interest Disclosure Act.

SYSC 1 Annex 1

Detailed application of SYSC

  • 01/04/2009

Export chapter as

SYSC 2

Senior management arrangements

SYSC 2.1

Apportionment of Responsibilities

  • 01/12/2004

SYSC 2.1.1

handbook-rule
A firm must take reasonable care to maintain a clear and appropriate apportionment of significant responsibilities among its directors and senior managers in such a way that:
(1) it is clear who has which of those responsibilities; and
(2) the business and affairs of the firm can be adequately monitored and controlled by the directors, relevant senior managers and governing body of the firm.

SYSC 2.1.1A

handbook-guidance
Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

SYSC 2.1.2

handbook-guidance
The role undertaken by a non-executive director will vary from one firm to another. For example, the role of a non-executive director in a friendly society may be more extensive than in other firms. Where a non-executive director is an approved person, for example where the firm is a body corporate, his responsibility and therefore liability will be limited by the role that he undertakes.

SYSC 2.1.3

handbook-rule
A firm must appropriately allocate to one or more individuals, in accordance with SYSC 2.1.4 R, the functions of:
(1) dealing with the apportionment of responsibilities under SYSC 2.1.1 R; and
(2) overseeing the establishment and maintenance of systems and controls under SYSC 3.1.1 R.

SYSC 2.1.4

handbook-rule

Allocation of functions

This table belongs to SYSC 2.1.3 R

SYSC 2.1.5

handbook-guidance
SYSC 2.1.3 R and SYSC 2.1.4 R give a firm some flexibility in the individuals to whom the functions may be allocated. It will be common for both the functions to be allocated solely to the firm's chief executive. SYSC 2.1.6 G contains further guidance on the requirements of SYSC 2.1.3 R and SYSC 2.1.4 R in a question and answer form.

SYSC 2.1.6

handbook-guidance

Frequently asked questions about allocation of functions in SYSC 2.1.3 R

This table belongs to SYSC 2.1.5 G

SYSC 2.2

Recording the apportionment

  • 01/12/2004

SYSC 2.2.1

handbook-rule
(1) A firm must make a record of the arrangements it has made to satisfy SYSC 2.1.1 R (apportionment) and SYSC 2.1.3 R (allocation) and take reasonable care to keep this up to date.
(2) This record must be retained for six years from the date on which it was superseded by a more up-to-date record.

SYSC 2.2.2

handbook-guidance
(1) A firm will be able to comply with SYSC 2.2.1 R by means of records which it keeps for its own purposes provided these records satisfy the requirements of SYSC 2.2.1 R and provided the firm takes reasonable care to keep them up to date. Appropriate records might, for this purpose, include organisational charts and diagrams, project management documents, job descriptions, committee constitutions and terms of reference provided they show a clear description of the firm's major functions.
(2) Firms should record any material change to the arrangements described in SYSC 2.2.1 R as soon as reasonably practicable after that change has been made.

SYSC 2.2.3

handbook-guidance
Where responsibilities have been allocated to more than one individual, the firm's record should show clearly how those responsibilities are shared or divided between the individuals concerned.

Export chapter as

SYSC 3

Systems and Controls

SYSC 3.1

Systems and Controls

  • 01/12/2004

SYSC 3.1.1

handbook-rule
A firm must take reasonable care to establish and maintain such systems and controls as are appropriate to its business.

SYSC 3.1.2

handbook-guidance
(1) The nature and extent of the systems and controls which a firm will need to maintain under SYSC 3.1.1 R will depend upon a variety of factors including:
(a) the nature, scale and complexity of its business;
(b) the diversity of its operations, including geographical diversity;
(c) the volume and size of its transactions; and
(d) the degree of risk associated with each area of its operation.
(2) To enable it to comply with its obligation to maintain appropriate systems and controls, a firm should carry out a regular review of them.
(3) The areas typically covered by the systems and controls referred to in SYSC 3.1.1 R are those identified in SYSC 3.2. Detailed requirements regarding systems and controls relevant to particular business areas or particular types of firm are covered elsewhere in the Handbook.

SYSC 3.1.2A

handbook-guidance
Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

SYSC 3.1.3

handbook-guidance
Where the UK Corporate Governance Code is relevant to a firm, the appropriate regulator, in considering whether the firm's obligations under SYSC 3.1.1 R have been met, will give it due credit for following corresponding provisions in the codeand related guidance.

SYSC 3.1.5

handbook-guidance
SYSC 2.1.3 R (2) prescribes how a firm must allocate the function of overseeing the establishment and maintenance of systems and controls described in SYSC 3.1.1 R.

SYSC 3.1.6

handbook-rule
A firm which is not a common platform firm must employ personnel with the skills, knowledge and expertise necessary for the discharge of the responsibilities allocated to them.

SYSC 3.1.7

handbook-rule
When complying with the competent employees rules, a firm must take into account the nature, scale and complexity of its business and the nature and range of financial services and activities undertaken in the course of that business.

SYSC 3.1.10

handbook-guidance
If a firm requires employees who are not subject to a qualification requirement in TC to pass a relevant examination from the list of recommended examinations maintained by the Financial Skills Partnership, the appropriate regulator will take that into account when assessing whether the firm has ensured that the employee satisfies the knowledge component of the competent employees rule.

SYSC 3.2

Areas covered by systems and controls

  • 01/12/2004

Introduction

SYSC 3.2.1

handbook-guidance
This section covers some of the main issues which a firm is expected to consider in establishing and maintaining the systems and controls appropriate to its business, as required by SYSC 3.1.1 R.

Organisation

SYSC 3.2.2

handbook-guidance
A firm's reporting lines should be clear and appropriate having regard to the nature, scale and complexity of its business. These reporting lines, together with clear management responsibilities, should be communicated as appropriate within the firm.

SYSC 3.2.3

handbook-guidance
(1) A firm's governing body is likely to delegate many functions and tasks for the purpose of carrying out its business. When functions or tasks are delegated, either to employees or to appointed representatives or, where applicable, its tied agents, appropriate safeguards should be put in place.
(2) When there is delegation, a firm should assess whether the recipient is suitable to carry out the delegated function or task, taking into account the degree of responsibility involved.
(3) The extent and limits of any delegation should be made clear to those concerned.
(4) There should be arrangements to supervise delegation, and to monitor the discharge of delegates functions or tasks.
(5) If cause for concern arises through supervision and monitoring or otherwise, there should be appropriate follow-up action at an appropriate level of seniority within the firm.

SYSC 3.2.4

handbook-guidance
(1) The guidance relevant to delegation within the firm is also relevant to external delegation ('outsourcing'). A firm cannot contract out its regulatory obligations. So, for example, under Principle 3 a firm should take reasonable care to supervise the discharge of outsourced functions by its contractor.
(2) A firm should take steps to obtain sufficient information from its contractor to enable it to assess the impact of outsourcing on its systems and controls.

SYSC 3.2.5

handbook-guidance
Where it is made possible and appropriate by the nature, scale and complexity of its business, a firm should segregate the duties of individuals and departments in such a way as to reduce opportunities for financial crime or contravention of requirements and standards under the regulatory system. For example, the duties of front-office and back-office staff should be segregated so as to prevent a single individual initiating, processing and controlling transactions.

The compliance function

SYSC 3.2.7

handbook-guidance
(1) Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have a separate compliance function. The organisation and responsibilities of a compliance function should be documented. A compliance function should be staffed by an appropriate number of competent staff who are sufficiently independent to perform their duties objectively. It should be adequately resourced and should have unrestricted access to the firm's relevant records as well as ultimate recourse to its governing body.
(2) [deleted]
(3) [deleted]

Risk assessment

SYSC 3.2.10

handbook-guidance
(1) Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have a separate risk assessment function responsible for assessing the risks that the firm faces and advising the governing body and senior managers on them.
(2) The organisation and responsibilities of a risk assessment function should be documented. The function should be adequately resourced and staffed by an appropriate number of competent staff who are sufficiently independent to perform their duties objectively.
(3) The term 'risk assessment function' refers to the generally understood concept of risk assessment within a firm, that is, the function of setting and controlling risk exposure. The risk assessment function is not a controlled function itself, but is part of the systems and controls function (CF28).

Management information

SYSC 3.2.11B

handbook-guidance
(1) A firm's arrangements should be such as to furnish its governing body with the information it needs to play its part in identifying, measuring, managing and controlling risks of regulatory concern. Three factors will be the relevance, reliability and timeliness of that information.
(2) Risks of regulatory concern are those risks which relate to the safety and soundness of PRA-authorised persons.
  • 01/04/2013

SYSC 3.2.12

handbook-guidance
It is the responsibility of the firm to decide what information is required, when, and for whom, so that it can organise and control its activities and can comply with its regulatory obligations. The detail and extent of information required will depend on the nature, scale and complexity of the business.

Employees and agents

SYSC 3.2.13

handbook-guidance
A firm's systems and controls should enable it to satisfy itself of the suitability of anyone who acts for it.

SYSC 3.2.14

handbook-guidance
(1) SYSC 3.2.13 G includes assessing an individual's honesty, and competence. This assessment should normally be made at the point of recruitment. An individual's honesty need not normally be revisited unless something happens to make a fresh look appropriate.
(2) Any assessment of an individual's suitability should take into account the level of responsibility that the individual will assume within the firm. The nature of this assessment will generally differ depending upon whether it takes place at the start of the individual's recruitment, at the end of the probationary period (if there is one) or subsequently.
(3) [deleted]
(4) The requirements on firms with respect to approved persons are in Part V of the Act (Performance of regulated activities) and SUP 10.

Audit committee

SYSC 3.2.15

handbook-guidance
Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to form an audit committee. An audit committee could typically examine management's process for ensuring the appropriateness and effectiveness of systems and controls, examine the arrangements made by management to ensure compliance with requirements and standards under the regulatory system, oversee the functioning of the internal audit function (if applicable - see SYSC 3.2.16 G) and provide an interface between management and the external auditors. It should have an appropriate number of non-executive directors and it should have formal terms of reference.

Internal audit

SYSC 3.2.16

handbook-guidance
(1) Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function. An internal audit function should have clear responsibilities and reporting lines to an audit committee or appropriate senior manager, be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the firm and have appropriate access to a firm's records.
(2) The term 'internal audit function' refers to the generally understood concept of internal audit within a firm, that is, the function of assessing adherence to and the effectiveness of internal systems and controls, procedures and policies. The internal audit function is not a controlled function itself, but is part of the systems and controls function (CF28).

Business strategy

SYSC 3.2.17

handbook-guidance
A firm should plan its business appropriately so that it is able to identify, measure, manage and control risks of regulatory concern (see SYSC 3.2.11 G (2)). In some firms, depending on the nature, scale and complexity of their business, it may be appropriate to have business plans or strategy plans documented and updated on a regular basis to take account of changes in the business environment.

Remuneration policies

SYSC 3.2.18

handbook-guidance
It is possible that firms' remuneration policies will from time to time lead to tensions between the ability of the firm to meet the requirements and standards under the regulatory system and the personal advantage of those who act for it. Where tensions exist, these should be appropriately managed.

Business continuity

SYSC 3.2.19

handbook-guidance
A firm should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness.

Records

SYSC 3.2.20

handbook-rule
(1) A firm must take reasonable care to make and retain adequate records of matters and dealings (including accounting records) which are the subject of requirements and standards under the regulatory system.
(2) Subject to (3) and to any other record-keeping rule in the Handbook, the records required by (1) or by such other rule must be capable of being reproduced in the English language on paper.
(3) If a firm's records relate to business carried on from an establishment in a country or territory outside the United Kingdom, an official language of that country or territory may be used instead of the English language as required by (2).

SYSC 3.2.21

handbook-guidance
A firm should have appropriate systems and controls in place to fulfil the firm's regulatory and statutory obligations with respect to adequacy, access, periods of retention and security of records. The general principle is that records should be retained for as long as is relevant for the purposes for which they are made.

SYSC 3.2.22

handbook-guidance
Detailed record-keeping requirements for different types of firm are to be found elsewhere in the Handbook. Schedule 1 to the Handbook is a consolidated schedule of these requirements.

Export chapter as

SYSC 4

General organisational requirements

SYSC 4.1

General requirements

[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 4.1.1

handbook-rule
(1) A firm must have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems.
(2) [deleted]

[Note: article 74 (1) of CRD, article 13(5) second paragraph of MiFID, article 12(1)(a) of the UCITS Directive, and article 18(1) of AIFMD]

SYSC 4.1.2

handbook-rule
For a common platform firm, the arrangements, processes and mechanisms referred to in SYSC 4.1.1 R must be comprehensive and proportionate to the nature, scale and complexity of the risks inherent in the business model and of the common platform firm's activities and must take into account the specific technical criteria described in SYSC 4.1.7 R, SYSC 5.1.7 R, SYSC 7 and Band whichever of the following as applicable:
(1) (for a firm to which SYSC 19A applies) SYSC 19A (IFPRU Remuneration Code);
(2) (for a full-scope UK AIFM) SYSC 19B (AIFM Remuneration Code);
(3) (for a firm to which SYSC 19C applies) SYSC 19C (BIPRU Remuneration Code);
(4) (for a firm to which SYSC 19D applies) SYSC 19D (Dual-regulated firms Remuneration Code); or
(5) (for a firm to which the Remuneration part of the PRA Rulebook applies) the Remuneration part of the PRA Rulebook.
[Note: article 74 (2) of CRD]

SYSC 4.1.2A

handbook-guidance
Other firms should take account of the comprehensiveness and proportionality rule (SYSC 4.1.2 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

Mechanisms and procedures for a firm

SYSC 4.1.4

handbook-rule
A firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)) must, taking into account the nature, scale and complexity of the business of the firm, and the nature and range of the financial services and activities undertaken in the course of that business:
(1) (if it is a common platform firm or a management company) establish, implement and maintain decision-making procedures and an organisational structure which clearly and in a documented manner specifies reporting lines and allocates functions and responsibilities;
(2) establish, implement and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures at all levels of the firm;
(3) (if it is a common platform firm) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the firm; and
(4) (if it is a management company) establish, implement and maintain effective internal reporting and communication of information at all relevant levels of the management company as well as effective information flows with any third party involved.
[Note: articles 5(1) final paragraph, 5(1)(a), 5(1)(c) and 5(1)(e) of the MiFID implementing Directive and articles 4(1) final paragraph, 4(1)(a), 4(1)(c) and 4(1)(d) of the UCITS implementing Directive]

SYSC 4.1.4A

handbook-guidance
A firm that is not a common platform firm or a management company should take into account the decision-making procedures and effective internal reporting rules (SYSC 4.1.4R (1), (3) and (4)) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.1.5

handbook-rule
A MiFID investment firm and a management company must establish, implement and maintain systems and procedures that are adequate to safeguard the security, integrity and confidentiality of information, taking into account the nature of the information in question.
[Note: article 5(2) of the MiFID implementing Directive and article 4(2) of the UCITS implementing Directive]

Business continuity

SYSC 4.1.6

handbook-rule
A common platform firm must take reasonable steps to ensure continuity and regularity in the performance of its regulated activities. To this end the common platform firm must employ appropriate and proportionate systems, resources and procedures.
[Note: article 13(4) of MiFID]

SYSC 4.1.7

handbook-rule
A common platform firm and a management company must establish, implement and maintain an adequate business continuity policy aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited, the preservation of essential data and functions, and the maintenance of its regulated activities, or, in the case of a management company, its collective portfolio management activities, or, where that is not possible, the timely recovery of such data and functions and the timely resumption of those activities.
[Note: article 5(3) of the MiFID implementing Directive,annex V paragraph 13 of the Banking Consolidation Directive, article 4(3) of the UCITS implementing Directive and article 85(2) of the CRD]

SYSC 4.1.7A

handbook-guidance
Other firms should take account of the business continuity rules (SYSC 4.1.6 R and 4.1.7 R) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.1.8

handbook-guidance
The matters dealt with in a business continuity policy should include:
(1) resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
(2) the recovery priorities for the firm's operations;
(3) communication arrangements for internal and external concerned parties (including the appropriate regulator , clients and the press);
(4) escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
(5) processes to validate the integrity of information affected by the disruption; and
(6) regular testing of the business continuity policy in an appropriate and proportionate manner in accordance with SYSC 4.1.10 R.

Accounting policies

SYSC 4.1.9

handbook-rule
A common platform firm and a management company must establish, implement and maintain accounting policies and procedures that enable it, at the request of the appropriate regulator, to deliver in a timely manner to the appropriate regulator financial reports which reflect a true and fair view of its financial position and which comply with all applicable accounting standards and rules.
[Note: article 5(4) of the MiFID implementing Directive and article 4(4) of the UCITS implementing Directive]

Regular monitoring

SYSC 4.1.10

handbook-rule
A common platform firm and a management company must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with SYSC 4.1.4 R to SYSC 4.1.9 R and take appropriate measures to address any deficiencies.
[Note: article 5(5) of the MiFID implementing Directive and article 4(5) of the UCITS implementing Directive]

SYSC 4.1.10A

handbook-guidance
Other firms should take account of the regular monitoring rule (SYSC 4.1.10 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G, but ignoring the cross-reference to SYSC 4.1.5 R and 4.1.9 R.

Audit committee

SYSC 4.1.11

handbook-guidance
Depending on the nature, scale and complexity of its business, it may be appropriate for a firm to form an audit committee. An audit committee could typically examine management's process for ensuring the appropriateness and effectiveness of systems and controls, examine the arrangements made by management to ensure compliance with requirements and standards under the regulatory system, oversee the functioning of the internal audit function (if applicable) and provide an interface between management and external auditors. It should have an appropriate number of non-executive directors and it should have formal terms of reference.

Risk control: additional guidance

SYSC 4.1.13

handbook-guidance
Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

Apportionment of responsibilities: the role of the non-executive director

SYSC 4.1.14

handbook-guidance
The role undertaken by a non-executive director will vary from one firm to another. Where a non-executive director is an approved person, for example where the firm is a body corporate, his responsibility and therefore liability will be limited by the role that he undertakes.

SYSC 4.1.15

handbook-rule
(1) A firm must have in place appropriate procedures for its employees to report breaches internally through a specific, independent and autonomous channel.
(2) The channel in (1) may be provided through arrangements provided for by social partners.

[Note: article 71 (3) of CRD]
  • 01/01/2014

SYSC 4.2

Persons who effectively direct the business

SYSC 4.2.1

handbook-rule
The senior personnel of a common platform firm, a management companya full-scope UK AIFM, or of the UK branch of a non-EEA bank must be of sufficiently good repute and sufficiently experienced as to ensure the sound and prudent management of the firm.
[Note: article 9(1) of MiFID, article 7(1)(b) of the UCITS Directive article 8(1)(c) of AIFMD, article 11(1) second paragraph of the Banking Consolidation Directive and article 13(1) of the CRD]

SYSC 4.2.1A

handbook-guidance
Other firms should take account of the senior personnel rule (SYSC 4.2.1 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.2.2

handbook-rule
A common platform firm, a management company, a full-scope UK AIFM and the UK branch of a non-EEA bank must ensure that its management is undertaken by at least two persons meeting the requirements laid down in SYSC 4.2.1 R and, for a full-scope UK AIFM, SYSC 4.2.7 R.
[Note: article 9(4) first paragraph of MiFID, article 7(1)(b) of the UCITS Directive, article 8(1)(c) of AIFMD and article 13(1) of CRD]

SYSC 4.2.3

handbook-guidance
In the case of a body corporate, the persons referred to in SYSC 4.2.2 R should either be executive directors or persons granted executive powers by, and reporting immediately to, the governing body. In the case of a partnership, they should be active partners.

SYSC 4.2.4

handbook-guidance
At least two independent minds should be applied to the formulation and implementation of the policies of a common platform firm, a management company, a full-scope UK AIFM and the UK branch of a non-EEA bank. Where a firm nominates just two individuals to direct its business, the appropriate regulator will not regard them as both effectively directing the business where one of them makes some, albeit significant, decisions relating to only a few aspects of the business. Each should play a part in the decision-making process on all significant decisions. Both should demonstrate the qualities and application to influence strategy, day-to-day policy and its implementation. This does not require their day-to-day involvement in the execution and implementation of policy. It does, however, require involvement in strategy and general direction, as well as knowledge of, and influence on, the way in which strategy is being implemented through day-to-day policy.

SYSC 4.2.5

handbook-guidance
Where there are more than two individuals directing the business of a common platform firm, a management company, a full-scope UK AIFM or the UK branch of a non-EEA bank, the appropriate regulator does not regard it as necessary for all of these individuals to be involved in all decisions relating to the determination of strategy and general direction. However, at least two individuals should be involved in all such decisions. Both individuals' judgement should be engaged so that major errors leading to difficulties for the firm are less likely to occur. Similarly, each individual should have sufficient experience and knowledge of the business and the necessary personal qualities and skills to detect and resist any imprudence, dishonesty or other irregularities by the other individual. Where a single individual, whether a chief executive, managing director or otherwise, is particularly dominant in such a firm this will raise doubts about whether SYSC 4.2.2 R is met.

SYSC 4.2.6

handbook-rule
If a common platform firm, (other than a credit institution or AIFM investment firm) or the UK branch of a non-EEA bank, is:
(1) a natural person; or
(2) a legal person managed by a single natural person;
it must have alternative arrangements in place which ensure sound and prudent management of the firm.
[Note: article 9(4) second paragraph of MiFID]

SYSC 4.3

Responsibility of senior personnel

  • 01/01/2007

SYSC 4.3.1

handbook-rule
A firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)), when allocating functions internally, must ensure that senior personnel and, where appropriate, the supervisory function, are responsible for ensuring that the firm complies with its obligations under the regulatory system. In particular, senior personnel and, where appropriate, the supervisory function must assess and periodically review the effectiveness of the policies, arrangements and procedures put in place to comply with the firm's obligations under the regulatory system and take appropriate measures to address any deficiencies.
[Note: article 9(1) of the MiFID implementing Directive and articles 9(1) and 9(3) of the UCITS implementing Directive]

SYSC 4.3.2

handbook-rule
A common platform firm (with the exception of a sole trader who does not employ any person who is required to be approved under section 59 of the Act (Approval for particular arrangements)) and a management company, must ensure that:
(1) its senior personnel receive on a frequent basis, and at least annually, written reports on the matters covered by SYSC 6.1.2 R to SYSC 6.1.5 R, SYSC 6.2.1 R and SYSC 7.1.2 R, SYSC 7.1.3 R and SYSC 7.1.5 R to SYSC 7.1.7 R, indicating in particular whether the appropriate remedial measures have been taken in the event of any deficiencies; and
(2) the supervisory function, if any, receives on a regular basis written reports on the same matters.
[Note: article 9(2) and article 9(3) of the MiFID implementing Directive and articles 9(4) and 9(6) of the UCITS implementing Directive]

SYSC 4.3.2A

handbook-guidance
Other firms should take account of the written reports rule (SYSC 4.3.2 R) as if it were guidance (and as if "should" appeared in that rule instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 4.3.3

handbook-guidance
The supervisory function does not include a general meeting of the shareholders of a firm , or equivalent bodies, but could involve, for example, a separate supervisory board within a two-tier board structure or the establishment of a non-executive committee of a single-tier board structure.

SYSC 4.3A

CRR firms

  • 01/01/2014

Management body

SYSC 4.3A.1

handbook-rule
A CRR firm must ensure that the management body defines, oversees and is accountable for the implementation of governance arrangements that ensure effective and prudent management of the firm, including the segregation of duties in the organisation and the prevention of conflicts of interest. The firm must ensure that the management body:
(1) has overall responsibility for the firm;
(2) approves and oversees implementation of the firm's strategic objectives, risk strategy and internal governance;
(3) ensures the integrity of the firm's accounting and financial reporting systems, including financial and operational controls and compliance with the regulatory system.
(4) oversees the process of disclosure and communications;
(5) has responsibility for providing effective oversight of senior management.
(6) monitors and periodically assesses the effectiveness of the firm's governance arrangements and takes appropriate steps to address any deficiencies.

[Note: article 88(1) of CRD]
  • 01/01/2014

SYSC 4.3A.2

handbook-rule
A CRR firm must ensure that the chairman of the firm's management body does not exercise simultaneously the chief executive function within the same firm, unless justified by the firm and authorised by the appropriate regulator.

[Note: article 88(1)(e) of CRD]
  • 01/01/2014

SYSC 4.3A.3

handbook-rule
A CRR firm must ensure that the members of the management body of the firm:
(1) are of sufficiently good repute;
(2) possess sufficient knowledge, skills and experience to perform their duties;
(3) possess adequate collective knowledge, skills and experience to understand the firm's activities, including the main risks;
(4) reflect an adequately broad range of experiences;
(5) commit sufficient time to perform their functions in the firm; and
(6) act with honesty, integrity and independence of mind to effectively assess and challenge the decisions of senior management where necessary and to effectively oversee and monitor management decision-making.


[Note: article 91(1)-(2) and (7)-(8) of the CRD]
  • 01/01/2014

SYSC 4.3A.4

handbook-rule
A CRR firm must devote adequate human and financial resources to the induction and training of members of the management body.

[Note: article 91(3) of the CRD]
  • 01/01/2014

SYSC 4.3A.5

handbook-rule
A CRR firm must ensure that the members of the management body of the firm do not hold more directorships than is appropriate taking into account individual circumstances and the nature, scale and complexity of the firm's activities.

[Note: article 91(3) of the CRD]
  • 01/01/2014

SYSC 4.3A.6

handbook-rule
(1) A CRR firm that is significant must ensure that the members of the management body of the firm do not hold more than one of the following combinations of directorship in any organisation at the same time:
(a) one executive directorship with two non-executive directorships; and
(b) four non-executive directorships.
(2) Paragraph (1) does not apply to members of the management body that represent the United Kingdom.


[Note: article 91(3) of the CRD]
  • 01/07/2014

SYSC 4.3A.6A

handbook-guidance
In SYSC 4.3A.6 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.
  • 01/07/2014

SYSC 4.3A.6B

handbook-guidance
The limits on directorships set out in SYSC 4.3A.6 R also apply to members of the management body of the UK consolidation group or non-EEA sub group in accordance with SYSC 12.1.13 R. Individuals in any of the entities belonging to the UK consolidation group or non-EEA sub group are capable of forming part of this management body. For example, members of the management body of a non-CRR firm that is a parent financial holding company in a Member State and is a member of a UK consolidation group could be caught by the limits in SYSC 4.3A.6 R (SYSC 12.1.14 R). In particular, a person who requires approval under SUP 10B.6.2 R or SUP 10B.6.4 R because of the influence they exercise over the CRR firm is a member of the management body of the UK consolidation group or non-EEA sub group and therefore subject to the limit on directorships in SYSC 4.3A.6 R.



[Note: article 91(3) and article 109(2) of the CRD]

SYSC 4.3A.7

handbook-rule
For the purposes of SYSC 4.3A.5 R and SYSC 4.3A.6 R:
(1) directorships in organisations which do not pursue predominantly commercial objectives shall not count; and
(2) the following shall count as a single directorship:
(a) executive or non-executive directorships held within the same group; or
(b) executive or non-executive directorships held within:
(i) firms that are members of the same institutional protection scheme provided that the conditions set out in Article 113(7) of the CRR are fulfilled; or
(ii) undertakings (including non-financial entities) in which the firm holds a qualifying holding.


[Note: article 91(4) and (5) of the CRD]
  • 01/01/2014

Nomination Committee

SYSC 4.3A.8

handbook-rule
A CRR firm that is significant must:
(1) establish a nomination committee composed of members of the management body who do not perform any executive function in the firm;
(2) ensure that the nomination committee is able to use any forms of resources the nomination committee deems appropriate, including external advice; and
(3) ensure that the nomination committee receives appropriate funding.


[Note: article 88(2) of the CRD]
  • 01/01/2014

SYSC 4.3A.8A

handbook-guidance
In SYSC 4.3A.8 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.
  • 01/01/2014

SYSC 4.3A.9

handbook-rule
A CRR firm that has a nomination committee must ensure that the nomination committee:
(1) engage a broad set of qualities and competences when recruiting members to the management body and for that purpose puts in place a policy promoting diversity on the management body;
(2) identifies and recommends for approval, by the management body or by general meeting, candidates to fill management body vacancies, having evaluated the balance of knowledge, skills, diversity and experience of the management body;
(3) prepares a description of the roles and capabilities for a particular appointment, and assesses the time commitment required;
(4) decides on a target for the representation of the underrepresented gender in the management body and prepares a policy on how to increase the number of the underrepresented gender in the management body in order to meet that target;
(5) periodically, and at least annually, assesses the structure, size, composition and performance of the management body and makes recommendations to the management body with regard to any changes;
(6) periodically, and at least annually, assesses the knowledge, skills and experience of individual members of the management body and of the management body collectively, and reports this to the management body;
(7) periodically reviews the policy of the management body for selection and appointment of senior management and makes recommendations to the management body; and
(8) in performing its duties, and to the extent possible, on an ongoing basis, takes account of the need to ensure that the management body's decision making is not dominated by any one individual or small group of individuals in a manner that is detrimental to the interest of the firm as a whole;


[Note: article 88(2) and article 91(10) of the CRD]
  • 01/01/2014

SYSC 4.3A.10

handbook-rule
A CRR firm that does not have a nomination committee must engage a broad set of qualities and competences when recruiting members to the management body. For that purpose a CRR firm that does not have a nomination committee must put in place a policy promoting diversity on the management body.

[Note: article 91(10) of the CRD]
  • 01/01/2014

Website

SYSC 4.3A.11

handbook-rule
A CRR firm that maintains a website must explain on the website how it complies with the requirements of SYSC 4.3A.1 R to SYSC 4.3A.3 R and SYSC 4.3A.4 R to SYSC 4.3A.11 R.

[Note: article 96 of the CRD]
  • 01/01/2014

SYSC 4.4

Apportionment of responsibilities

  • 01/04/2009

Application

SYSC 4.4.1

handbook-rule
This section applies to:
(1) an authorised professional firm in respect of its non-mainstream regulated activities unless the firm is also conducting other regulated activities and has appointed approved persons to perform the governing functions with equivalent responsibilities for the firm'snon-mainstream regulated activities and other regulated activities;
(2) activities carried on by a firm whose principal purpose is to carry on activities other than regulated activities and which is:
(a) an oil market participant; or
(b) a service company; or
(c) an energy market participant; or
(d) a wholly-owned subsidiary of:
(i) a local authority; or
(ii) a registered social landlord; or
(e) a firm with permission to carry on insurance mediation activity in relation to non-investment insurance contracts but no other regulated activity;
(3) [deleted]
(4) [deleted]
(5) [deleted]
(a) [deleted]
(b) [deleted]
(6) [deleted]
(7) an incoming Treaty firm, an incoming EEA firm or a UCITS qualifier (but only SYSC 4.4.5R (2) applies for these firms); and
(8) a sole trader, but only if he employs any person who is required to be approved under section 59 of the Act (Approval for particular arrangements).

SYSC 4.4.2

handbook-guidance
This section does not apply to a common platform firm.

Maintaining a clear and appropriate apportionment

SYSC 4.4.3

handbook-rule
A firm must take reasonable care to maintain a clear and appropriate apportionment of significant responsibilities among its directors and senior managers in such a way that:
(1) it is clear who has which of those responsibilities; and
(2) the business and affairs of the firm can be adequately monitored and controlled by the directors, relevant senior managers and governing body of the firm.

Allocating functions of apportionment and oversight

SYSC 4.4.5

handbook-rule
A firm must appropriately allocate to one or more individuals, in accordance with the following table, the functions of:
(1) dealing with the apportionment of responsibilities under SYSC 4.4.3 R; and
(2) overseeing the establishment and maintenance of systems and controls under SYSC 4.1.1 R.

SYSC 4.4.6

handbook-guidance
Frequently asked questions about allocation of functions in SYSC 4.4.5 R

Export chapter as

SYSC 5

Employees, agents and other relevant persons

SYSC 5.1

Skills, knowledge and expertise

  • 01/01/2007



[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 5.1.1

handbook-rule
A firm must employ personnel with the skills, knowledge and expertise necessary for the discharge of the responsibilities allocated to them.
[Note: article 5(1)(d) of the MiFID implementing Directive, articles 12(1)(a) and 14(1)(c) of the UCITS Directive and article 5(1) of the UCITS implementing Directive]

SYSC 5.1.2

handbook-guidance
A firm's systems and controls should enable it to satisfy itself of the suitability of anyone who acts for it. This includes assessing an individual's honesty and competence. This assessment should normally be made at the point of recruitment. An individual's honesty need not normally be revisited unless something happens to make a fresh look appropriate.

SYSC 5.1.3

handbook-guidance
Any assessment of an individual's suitability should take into account the level of responsibility that the individual will assume within the firm. The nature of this assessment will generally differ depending upon whether it takes place at the start of the individual's recruitment, at the end of the probationary period (if there is one) or subsequently.

SYSC 5.1.4A

handbook-guidance
Firms which are carrying on activities that are not subject to TC may nevertheless wish to take TC into account in complying with the competence requirements in SYSC.

SYSC 5.1.5

handbook-guidance
The requirements on firms with respect to approved persons are in Part V of the Act (Performance of regulated activities) and SUP 10A and SUP 10B.

SYSC 5.1.5A

handbook-guidance
If a firm requires employees who are not subject to a qualification requirement in TC to pass a relevant examination from the list of recommended examinations maintained by the Financial Skills Partnership, the appropriate regulator will take that into account when assessing whether the firm has ensured that the employee satisfies the knowledge component of the competent employees rule.

Segregation of functions

SYSC 5.1.6

handbook-rule
A common platform firm and a management company must ensure that the performance of multiple functions by its relevant persons does not and is not likely to prevent those persons from discharging any particular functions soundly, honestly and professionally.
[Note: article 5(1)(g) of the MiFID implementing Directive and article 5(3) of the UCITS implementing Directive]

SYSC 5.1.7

handbook-rule
The senior personnel of a common platform firm must define arrangements concerning the segregation of duties within the firm and the prevention of conflicts of interest.
[Note:article 88 of the CRD and annex V paragraph 1 of the Banking Consolidation Directive]

SYSC 5.1.7A

handbook-guidance
Other firms should take account of the segregation of functions rules (SYSC 5.1.6 R and SYSC 5.1.7 R) as if they were guidance (and as if should appeared in those rules instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 5.1.8

handbook-guidance
The effective segregation of duties is an important element in the internal controls of a firm in the prudential context. In particular, it helps to ensure that no one individual is completely free to commit a firm's assets or incur liabilities on its behalf. Segregation can also help to ensure that a firm'sgoverning body receives objective and accurate information on financial performance, the risks faced by the firm and the adequacy of its systems.

SYSC 5.1.9

handbook-guidance
A firm should normally ensure that no single individual has unrestricted authority to do all of the following:
(1) initiate a transaction;
(2) bind the firm;
(3) make payments; and
(4) account for it.

SYSC 5.1.10

handbook-guidance
Where a firm is unable to ensure the complete segregation of duties (for example, because it has a limited number of staff), it should ensure that there are adequate compensating controls in place (for example, frequent review of an area by relevant senior managers).

SYSC 5.1.11

handbook-guidance
Where a common platform firm outsources its internal audit function, it should take reasonable steps to ensure that every individual involved in the performance of this service is independent from the individuals who perform its external audit. This should not prevent services from being undertaken by a firm's external auditors provided that:
(1) the work is carried out under the supervision and management of the firm's own internal staff; and
(2) potential conflicts of interest between the provision of external audit services and the provision of internal audit are properly managed.

Awareness of procedures

SYSC 5.1.12

handbook-rule
A common platform firm and a management company must ensure that its relevant persons are aware of the procedures which must be followed for the proper discharge of their responsibilities.
[Note: article 5(1)(b) of the MiFID implementing Directive and article 4(1)(b) of the UCITS implementing Directive]

SYSC 5.1.12A

handbook-guidance
Other firms should take account of the rule concerning awareness of procedures (SYSC 5.1.12 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

General

SYSC 5.1.13

handbook-rule
The systems, internal control mechanisms and arrangements established by a firm in accordance with this chapter must take into account the nature, scale and complexity of its business and the nature and range of financial services and activities undertaken in the course of that business.
[Note: article 5(1) final paragraph of the MiFID implementing Directiveand articles 4(1) final paragraph and 5(4) of the UCITS implementing Directive]

SYSC 5.1.14

handbook-rule
A common platform firm and a management company must monitor and, on a regular basis, evaluate the adequacy and effectiveness of its systems, internal control mechanisms and arrangements established in accordance with this chapter, and take appropriate measures to address any deficiencies.
[Note: article 5(5) of the MiFID implementing Directive and articles 4(5) of the UCITS implementing Directive]

SYSC 5.1.15

handbook-guidance
Other firms should take account of the rule requiring monitoring and evaluation of the adequacy and effectiveness of systems (SYSC 5.1.14 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

Export chapter as

SYSC 6

Compliance, internal audit and financial crime

SYSC 6.1

Compliance

  • 01/01/2007



[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 6.1.1

handbook-rule
A firm must establish, implement and maintain adequate policies and procedures sufficient to ensure compliance of the firm including its managers, employees and appointed representatives(or where applicable, tied agents) with its obligations under the regulatory system and for countering the risk that the firm might be used to further financial crime.
[Note: article 13(2) of MiFID and article 12(1)(a) of the UCITS Directive]

SYSC 6.1.2

handbook-rule
A common platform firm and a management company must, taking intoaccount the nature, scale and complexity of its business, and the nature and range of financial services and activities undertaken in the course of that business, establish, implement and maintain adequate policies and procedures designed to detect any risk of failure by the firm to comply with its obligations under the regulatory system, as well as associated risks, and put in place adequate measures and procedures designed to minimise such risks and to enable the appropriate regulator to exercise its powers effectively under the regulatory system and to enable any other competent authority to exercise its powers effectively under MiFID or the UCITS Directive.
[Note: article 6(1) of the MiFID implementing Directive and article 10(1) of the UCITS implementing Directive]

SYSC 6.1.2A

handbook-guidance
Other firms should take account of the adequate policies and procedures rule (SYSC 6.1.2 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 6.1.3

handbook-rule
A common platform firm and a management company must maintain a permanent and effective compliance function which operates independently and which has the following responsibilities:
(1) to monitor and, on a regular basis, to assess the adequacy and effectiveness of the measures and procedures put in place in accordance with SYSC 6.1.2 R, and the actions taken to address any deficiencies in the firm's compliance with its obligations; and
(2) to advise and assist the relevant persons responsible for carrying out regulated activities to comply with the firm's obligations under the regulatory system.

[Note: article 6(2) of the MiFID implementing Directive and article 10(2) of the UCITS implementing Directive]

SYSC 6.1.3A

handbook-guidance
(1) Other firms should take account of the compliance function rule (SYSC 6.1.3 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.
(2) Notwithstanding SYSC 6.1.3 R, as it applies under (1), depending on the nature, scale and complexity of its business, it may be appropriate for a firm to have a separate compliance function. Where a firm has a separate compliance function the firm should also take into account SYSC 6.1.3 R and SYSC 6.1.4 R as guidance.

SYSC 6.1.4

handbook-rule
In order to enable the compliance function to discharge its responsibilities properly and independently, a common platform firm and a management company must ensure that the following conditions are satisfied:
(1) the compliance function must have the necessary authority, resources, expertise and access to all relevant information;
(2) a compliance officer must be appointed and must be responsible for the compliance function and for any reporting as to compliance required by SYSC 4.3.2 R;
(3) the relevant persons involved in the compliance functions must not be involved in the performance of services or activities they monitor;
(4) the method of determining the remuneration of the relevant persons involved in the compliance function must not compromise their objectivity and must not be likely to do so.

[Note: article 6(3) first paragraph of the MiFID implementing Directive and article 10(3) of the UCITS implementing Directive]

SYSC 6.1.4-A

handbook-guidance

In setting the method of determining the remuneration of relevant persons involved in the compliance function:

(1) firms that SYSC 19A applies to will also need to comply with the Remuneration Code;
(2) BIPRU firms will also need to comply with the BIPRU Remuneration Code;
(3) firms that SYSC 19D applies to will also need to comply with the Dual-regulated firms Remuneration Code; and
(4) firms that the Remuneration part of the PRA Rulebook applies to will also need to comply with it.

SYSC 6.1.5

handbook-rule
A common platform firm and a management company need not comply with SYSC 6.1.4 R (3) or SYSC 6.1.4 R (4) if it is able to demonstrate that in view of the nature, scale and complexity of its business, and the nature and range of financial services and activities, the requirements under those rules are not proportionate and that its compliance function continues to be effective.
[Note: article 6(3) second paragraph of the MiFID implementing Directive and article 10(3) second paragraph of the UCITS implementing Directive]

SYSC 6.1.6

handbook-rule
Other firms should take account of the proportionality rule (SYSC 6.1.5 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 6.1.7

handbook-rule
(1) This rule applies to a common platform firm conducting investment services and activities from a branch in another EEA State.
(2) References to the regulatory system in SYSC 6.1.1R, SYSC 6.1.2 R and SYSC 6.1.3 R apply in respect of a firm'sbranch as if regulatory system includes a Host State's requirements under MiFID and the MiFID implementing Directive which are applicable to the investment services and activities conducted from the firm'sbranch.
[Note: article 13(2) of MiFID]

SYSC 6.2

Internal audit

  • 01/01/2007

SYSC 6.2.1

handbook-rule
A common platform firm and a management company must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of its financial services and activities, undertaken in the course of that business, establish and maintain an internal audit function which is separate and independent from the other functions and activities of the firm and which has the following responsibilities:
(1) to establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the firm's systems, internal control mechanisms and arrangements;
(2) to issue recommendations based on the result of work carried out in accordance with (1);
(3) to verify compliance with those recommendations;
(4) to report in relation to internal audit matters in accordance with SYSC 4.3.2 R.

[Note: article 8 of the MiFID implementing Directive and article 11 of the UCITS implementing Directive]

SYSC 6.2.1A

handbook-guidance
Other firms should take account of the internal audit rule (SYSC 6.2.1 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 6.2.2

handbook-guidance
The term 'internal audit function' in SYSC 6.2.1 R (and SYSC 4.1.11 G) refers to the generally understood concept of internal audit within a firm , that is, the function of assessing adherence to and the effectiveness of internal systems and controls, procedures and policies. The internal audit function is not a controlled function itself, but is part of the systems and controls function (CF28).

Export chapter as

SYSC 7

Risk control

SYSC 7.1

Risk control

  • 01/01/2007



[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 7.1.1

handbook-guidance
SYSC 4.1.1 R requires a firm to have effective processes to identify, manage, monitor and report the risks it is or might be exposed to.

SYSC 7.1.2

handbook-rule
A common platform firm must establish, implement and maintain adequate risk management policies and procedures, including effective procedures for risk assessment, which identify the risks relating to the firm's activities, processes and systems, and where appropriate, set the level of risk tolerated by the firm.
[Note: article 7(1)(a) of the MiFID implementing Directive, article 13(5) second paragraph of MiFID]

SYSC 7.1.2A

handbook-guidance
Other firms should take account of the risk management policies and procedures rule (SYSC 7.1.2 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.3

handbook-rule
A common platform firm must adopt effective arrangements, processes and mechanisms to manage the risk relating to the firm's activities, processes and systems, in light of that level of risk tolerance.
[Note: article 7(1)(b) of the MiFID implementing Directive]

SYSC 7.1.4

handbook-rule
The management body of a common platform firm must approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the firm is or might be exposed to, including those posed by the macroeconomic environment in which it operates in relation to the status of the business cycle.
[Note: article 76(1) of CRD]

SYSC 7.1.4AA

handbook-guidance

For a common platform firm included within the scope of chapter 15 of the Internal Capital Adequacy Assessment Part of the PRA Rulebook, the strategies, policies and procedures for identifying, taking up, managing, monitoring and mitigating the risks to which the firm is or might be exposed include conducting reverse stress testing in accordance with chapter 15 of the Internal Capital Adequacy Assessment Part of the PRA Rulebook. A common platform firm which falls outside the scope of chapter 15 of the Internal Capital Adequacy Assessment Part of the PRA Rulebook should consider conducting reverse stress tests on its business plan as well. This would further senior personnel’s understanding of the firm's vulnerabilities and would help them design measures to prevent or mitigate the risk of business failure.

  • 03/08/2015

SYSC 7.1.4B

handbook-guidance
Other firms should take account of the risk management rules (SYSC 7.1.3 R and SYSC 7.1.4 R) as if they were guidance (and as if "should" appeared in those rules instead of "must") as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.5

handbook-rule
A common platform firm must monitor the following:
(1) the adequacy and effectiveness of the firm's risk management policies and procedures;
(2) the level of compliance by the firm and its relevant persons with the arrangements, processes and mechanisms adopted in accordance with SYSC 7.1.3 R;
(3) the adequacy and effectiveness of measures taken to address any deficiencies in those policies, procedures, arrangements, processes and mechanisms, including failures by the relevant persons to comply with such arrangements or processes and mechanisms or follow such policies and procedures.
[Note: article 7(1)(c) of the MiFID implementing Directive]

SYSC 7.1.6

handbook-rule
A common platform firm must, where appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of the investment services and activities undertaken in the course of that business, establish and maintain a risk management function that operates independently and carries out the following tasks:
(1) implementation of the policies and procedures referred to in SYSC 7.1.2 R to SYSC 7.1.5 R; and
(2) provision of reports and advice to senior personnel in accordance with SYSC 4.3.2 R.
[Note: MiFID implementing Directive Article 7(2) first paragraph]

SYSC 7.1.7

handbook-rule
Where a common platform firm is not required under SYSC 7.1.6 R to maintain a risk management function that functions independently, it must nevertheless be able to demonstrate that the policies and procedures which it has adopted in accordance with SYSC 7.1.2 R to SYSC 7.1.5 R satisfy the requirements of those rules and are consistently effective.
[Note: article 7(2) second paragraph of the MiFID implementing Directive]

SYSC 7.1.7A

handbook-guidance
Other firms should take account of the risk management rules (SYSC 7.1.5 R to SYSC 7.1.7 R) as if they were guidance (and as if should appeared in those rules instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 7.1.7B

handbook-guidance
In setting the method of determining the remuneration of employees involved in the risk management function:
(1) firms that SYSC 19D applies to will also need to comply with the Dual-regulated firms Remuneration Code; and
(2) firms that the Remuneration part of the PRA Rulebook applies to will also need to comply with it.

SYSC 7.1.7C

handbook-guidance
Firms should also consider the additional guidance on risk-centric governance arrangements for effective risk management contained in SYSC 21.

SYSC 7.1.8

handbook-guidance
(1) [deleted]
(2) The term 'risk management function' in SYSC 7.1.6 R and SYSC 7.1.7 R refers to the generally understood concept of risk assessment within a firm , that is, the function of setting and controlling risk exposure. The risk management function is not a controlled function itself, but is part of the systems and controls function (CF28).

Additional rules for CRR firms

SYSC 7.1.17

handbook-rule
(1) The management body of a CRR firm has overall responsibility for risk management. It must devote sufficient time to the consideration of risk issues.
(2) The management body of a CRR firm must be actively involved in and ensure that adequate resources are allocated to the management of all material risks addressed in the rules implementing the CRD and in the EU CRR as well as in the valuation of assets, the use of external ratings and internal models related to those risks.
(3) A CRR firm must establish reporting lines to the management body that cover all material risks and risk management policies and changes thereof.


[Note: article 76(2) of CRD]
  • 01/01/2014

SYSC 7.1.18

handbook-rule
(1) A CRR firm that is significant must establish a risk committee composed of members of the management body who do not perform any executive function in the firm. Members of the risk committee must have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the firm.
(2) The risk committee must advise the management body on the institution's overall current and future risk appetite and assist the management body in overseeing the implementation of that strategy by senior management.
(3) The risk committee must review whether prices of liabilities and assets offered to clients take fully into account the firm's business model and risk strategy. Where prices do not properly reflect risks in accordance with the business model and risk strategy, the risk committee must present a remedy plan to the management body.


[Note: article 76(3) of CRD]
  • 01/01/2014

SYSC 7.1.18A

handbook-guidance
In SYSC 7.1.18 R a 'CRR firm that is significant' means a deposit-taker or designated investment firm whose size, interconnectedness, complexity and business type gives it the capacity to cause some disruption to the UK financial system (and through that to economic activity more widely) by failing or by carrying on its business in an unsafe manner.
  • 01/01/2014

SYSC 7.1.19

handbook-rule
(1) A CRR firm must ensure that the management body in its supervisory function and, where a risk committee has been established, the risk committee have adequate access to information on the risk profile of the firm and, if necessary and appropriate, to the risk management function and to external expert advice.
(2) The management body in its supervisory function and, where one has been established, the risk committee must determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive.


[Note: article 76(4) of CRD]
  • 01/01/2014

SYSC 7.1.20

handbook-rule
In order to assist in the establishment of sound remuneration policies and practices, the risk committee must, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings.

[Note: article 76(4) of CRD]
  • 01/01/2014

SYSC 7.1.21

handbook-rule
(1) A CRR firm's risk management function (SYSC 7.1.6 R) must be independent from the operational functions and have sufficient authority, stature, resources and access to the management body.
(2) The risk management function must ensure that all material risks are identified, measured and properly reported. It must be actively involved in elaborating the firm's risk strategy and in all material risk management decisions and it must be able to deliver a complete view of the whole range of risks of the firm.
(3) A CRR firm must ensure that the risk management function is able to report directly to the management body in its supervisory function, independent from senior management and that it can raise concerns and warn the management body, where appropriate, where specific risk developments affect or may affect the firm, without prejudice to the responsibilities of the management body in its supervisory and/or managerial functions pursuant to the CRD and the CRR.


[Note: article 76(5) of CRD]
  • 01/01/2014

SYSC 7.1.22

handbook-rule
The head of the risk management function must be an independent senior manager with distinct responsibility for the risk management function. Where the nature, scale and complexity of the activities of the CRR firm do not justify a specially appointed person, another senior person within the firm may fulfil that function, provided there is no conflict of interest. The head of the risk management function must not be removed without prior approval of the management body and must be able to have direct access to the management body where necessary.

[Note: article 76(5) of CRD]
  • 01/01/2014

Export chapter as

SYSC 8

Outsourcing

SYSC 8.1

General outsourcing requirements



[Note: ESMA has also issued guidelines under article 16(3) of the ESMA Regulation covering certain aspects of the MiFID compliance function requirements. See http://www.esma.europa.eu/content/Guidelines-certain-aspects-MiFID-compliance-function-requirements.]

SYSC 8.1.1

handbook-rule
A common platform firm must:
(1) when relying on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services (in this chapter "relevant services and activities") on a continuous and satisfactory basis, ensure that it takes reasonable steps to avoid undue additional operational risk;
(2) not undertake the outsourcing of important operational functions in such a way as to impair materially:
(a) the quality of its internal control; and
(b) the ability of the appropriate regulator to monitor the firm's compliance with all obligations under the regulatory system and, if different, of a competent authority to monitor the firm's compliance with all obligations under MiFID.

[Note: article 13(5) first paragraph of MiFID]

SYSC 8.1.1A

handbook-guidance
Other firms should take account of the outsourcing rule (SYSC 8.1.1 R) as if it were guidance (and as if should appeared in that rule instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 8.1.2

handbook-guidance
The application of SYSC 8.1 to relevant services and activities (see SYSC 8.1.1 R (1)) is limited by SYSC 1 Annex 1 (Part 2) (Application of the common platform requirements).

SYSC 8.1.3

handbook-guidance
SYSC 4.1.1 R requires a firm to have effective processes to identify, manage, monitor and report risks and internal control mechanisms. Except in relation to those functions described in SYSC 8.1.5 R, where a firm relies on a third party for the performance of operational functions which are not critical or important for the performance of relevant services and activities (see SYSC 8.1.1 R (1)) on a continuous and satisfactory basis, it should take into account, in a manner that is proportionate given the nature, scale and complexity of the outsourcing, the rules in this section in complying with that requirement.

SYSC 8.1.4

handbook-rule
For the purposes of this chapter an operational function is regarded as critical or important if a defect or failure in its performance would materially impair the continuing compliance of a common platform firm with the conditions and obligations of its authorisation or its other obligations under the regulatory system, or its financial performance, or the soundness or the continuity of its relevant services and activities.
[Note: article 13(1) of the MiFID implementing Directive]

SYSC 8.1.5

handbook-rule
Without prejudice to the status of any other function, the following functions will not be considered as critical or important for the purposes of this chapter:
(1) the provision to the firm of advisory services, and other services which do not form part of the relevant services and activities of the firm, including the provision of legal advice to the firm, the training of personnel of the firm, billing services and the security of the firm's premises and personnel;
(2) the purchase of standardised services, including market information services and the provision of price feeds;
[Note: article 13(2) of the MiFID implementing Directive]
(3) the recording and retention of relevant telephone conversations or electronic communications subject to COBS 11.8.

SYSC 8.1.5A

handbook-guidance
Other firms should take account of the critical functions rules (SYSC 8.1.4 R and SYSC 8.1.5 R) as if they were guidance (and as if should appeared in those rules instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 8.1.6

handbook-rule
If a firm outsources critical or important operational functions or any relevant services and activities, it remains fully responsible for discharging all of its obligations under the regulatory system and must comply, in particular, with the following conditions:
(1) the outsourcing must not result in the delegation by senior personnel of their responsibility;
(2) the relationship and obligations of the firm towards its clients under the regulatory system must not be altered;
(3) the conditions with which the firm must comply in order to be authorised, and to remain so, must not be undermined;
(4) none of the other conditions subject to which the firm'sauthorisation was granted must be removed or modified.
[Note: article 14(1) of the MiFID implementing Directive]

SYSC 8.1.7

handbook-rule
A common platform firm must exercise due skill and care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any relevant services and activities.
[Note: article 14(2) first paragraph of the MiFID implementing Directive]

SYSC 8.1.8

handbook-rule
A common platform firm must in particular take the necessary steps to ensure that the following conditions are satisfied:
(1) the service provider must have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally;
(2) the service provider must carry out the outsourced services effectively, and to this end the firm must establish methods for assessing the standard of performance of the service provider;
(3) the service provider must properly supervise the carrying out of the outsourced functions, and adequately manage the risks associated with the outsourcing;
(4) appropriate action must be taken if it appears that the service provider may not be carrying out the functions effectively and in compliance with applicable laws and regulatory requirements;
(5) the firm must retain the necessary expertise to supervise the outsourced functions effectively and to manage the risks associated with the outsourcing,and must supervise those functions and manage those risks;
(6) the service provider must disclose to the firm any development that may have a material impact on its ability to carry out the outsourced functions effectively and in compliance with applicable laws and regulatory requirements;
(7) the firm must be able to terminate the arrangement for the outsourcing where necessary without detriment to the continuity and quality of its provision of services to clients;
(8) the service provider must co-operate with the appropriate regulator and any other relevant competent authority in connection with the outsourced activities;
(9) the firm, its auditors, the appropriate regulator and any other relevant competent authority must have effective access to data related to the outsourced activities, as well as to the business premises of the service provider; and the appropriate regulator and any other relevant competent authority must be able to exercise those rights of access;
(10) the service provider must protect any confidential information relating to the firm and its clients;
(11) the firm and the service provider must establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities where that is necessary having regard to the function, service or activity that has been outsourced.
[Note: article 14(2) second paragraph of the MiFID implementing Directive]

SYSC 8.1.9

handbook-rule
A common platform firm must ensure that the respective rights and obligations of the firm and of the service provider are clearly allocated and set out in a written agreement.
[Note: article 14(3) of the MiFID implementing Directive]

SYSC 8.1.10

handbook-rule
If a common platform firm and the service provider are members of the same group, the firm may, for the purpose of complying with SYSC 8.1.7 R to SYSC 8.1.11 R and SYSC 8.2 and SYSC 8.3, take into account the extent to which the common platform firmcontrols the service provider or has the ability to influence its actions.
[Note: article 14(4) of the MiFID implementing Directive]

SYSC 8.1.11

handbook-rule
A common platform firm must make available on request to the appropriate regulator and any other relevant competent authority all information necessary to enable the appropriate regulator and any other relevant competent authority to supervise the compliance of the performance of the outsourced activities with the requirements of the regulatory system.
[Note: article 14(5) of the MiFID implementing Directive]

SYSC 8.1.11A

handbook-guidance
Other firms should take account of the outsourcing of important operational functions rules (SYSC 8.1.7 R to SYSC 8.1.11 R) as if they were guidance (and as if should appeared in those rules instead of must) as explained in SYSC 1 Annex 1.3.3 G.

SYSC 8.1.12

handbook-guidance
As SUP 15.3.8 G explains, a firm should notify the appropriate regulator when it intends to rely on a third party for the performance of operational functions which are critical or important for the performance of relevant services and activities on a continuous and satisfactory basis.
[Note: recital 20 of theMiFID implementing Directive]

Export chapter as

SYSC 9

Record-keeping

SYSC 9.1

General rules on record-keeping

  • 01/11/2007

SYSC 9.1.1

handbook-rule
A firm must arrange for orderly records to be kept of its business and internal organisation, including all services and transactions undertaken by it, which must be sufficient to enable the appropriate regulator or any other relevant competent authority under MiFID or the UCITS Directive to monitor the firm's compliance with the requirements under the regulatory system, and in particular to ascertain that the firm has complied with all obligations with respect to clients.
[Note: article 13(6) of MiFID, article 5(1)(f) of the MiFID implementing Directive, article 12(1)(a) of the UCITS Directive and article 4(1)(e) of the UCITS implementing Directive]

SYSC 9.1.2

handbook-rule
A common platform firm must retain all records kept by it under this chapter in relation to its MiFID business for a period of at least five years.
[Note: article 51 (1) of the MiFID implementing Directive]

SYSC 9.1.3

handbook-rule
In relation to its MiFID business, a common platform firm must retain records in a medium that allows the storage of information in a way accessible for future reference by the appropriate regulator or any other relevant competent authority under MiFID, and so that the following conditions are met:
(1) the appropriate regulator or any other relevant competent authority under MiFID must be able to access them readily and to reconstitute each key stage of the processing of each transaction;
(2) it must be possible for any corrections or other amendments, and the contents of the records prior to such corrections and amendments, to be easily ascertained;
(3) it must not be possible for the records otherwise to be manipulated or altered.
[Note: article 51(2) of the MiFID implementing Directive]

Guidance on record-keeping

SYSC 9.1.4

handbook-guidance
Subject to any other record-keeping rule in the Handbook, the records required under the Handbook should be capable of being reproduced in the English language on paper. Where a firm is required to retain a record of a communication that was not made in the English language, it may retain it in that language. However, it should be able to provide a translation on request. If a firm's records relate to business carried on from an establishment in a country or territory outside the United Kingdom, an official language of that country or territory may be used instead of the English language.

SYSC 9.1.5

handbook-guidance
In relation to the retention of records for non-MiFID business, a firm should have appropriate systems and controls in place with respect to the adequacy of, access to, and the security of its records so that the firm may fulfil its regulatory and statutory obligations. With respect to retention periods, the general principle is that records should be retained for as long as is relevant for the purposes for which they are made.

SYSC 9.1.6

handbook-guidance
Schedule 1 to each module of the Handbook sets out a list summarising the record-keeping requirements of that module.
[Note: article 51(3) of MiFID implementing Directive]

SYSC 9.1.7

handbook-guidance
The Committee of European Securities Regulators (CESR) has issued recommendations on the list of minimum records under Article 51(3) of the MiFID implementing Directive.

Export chapter as

SYSC 12

Group risk systems and controls requirements

SYSC 12.1

Application

  • 01/01/2007

SYSC 12.1.1

handbook-rule
Subject to SYSC 12.1.2 R to SYSC 12.1.4 R, this section applies to each of the following which is a member of a group:
(1) a firm that falls into any one or more of the following categories:
(a) a regulated entity;
(b) [deleted]
(c) an insurer;
(d) a BIPRU firm;
(e) a non-BIPRU firm that is a parent financial holding company in a Member State and is a member of a UK consolidation group; and
(f) a firm subject to the rules in IPRU(INV) Chapter 14.
(2) a UCITS firm, but only if its group contains a firm falling into (1); and
(3) the Society.

SYSC 12.1.2

handbook-rule
Except as set out in SYSC 12.1.4 R, this section applies with respect to different types of group as follows:
(1) SYSC 12.1.8 R and SYSC 12.1.10 R apply with respect to all groups, including UK-regulated EEAfinancial conglomerates, other financial conglomerates and groups dealt with in SYSC 12.1.13 R to SYSC 12.1.16 R;
(2) the additional requirements set out in SYSC 12.1.11 R and SYSC 12.1.12 R only apply with respect to UK-regulated EEAfinancial conglomerates; and
(3) the additional requirements set out in SYSC 12.1.13 R to SYSC 12.1.16 R only apply with respect to groups of the kind dealt with by whichever of those rules apply.

SYSC 12.1.3

handbook-rule
This section does not apply to:
(1) an incoming EEA firm; or
(2) an incoming Treaty firm; or
(3) a UCITS qualifier; or
(4) an ICVC; or
(5) an incoming ECA provider acting as such.

SYSC 12.1.4

handbook-rule
(1) This rule applies in respect of the following rules:
(a) SYSC 12.1.8R (2);
(b) SYSC 12.1.10R (1), so far as it relates to SYSC 12.1.8R (2);
(c) SYSC 12.1.10R (2); and
(d) SYSC 12.1.11 R to SYSC 12.1.15 R.
(2) The rules referred to in (1):
(a) only apply with respect to a financial conglomerate if it is a UK-regulated EEA financial conglomerate;
(b) (so far as they apply with respect to a group that is not a financial conglomerate) do not apply with respect to a group for which a competent authority in another EEA state is lead regulator;
(c) (so far as they apply with respect to a financial conglomerate) do not apply to a firm with respect to a financial conglomerate of which it is a member if the interest of the financial conglomerate in that firm is no more than a participation;
(d) (so far as they apply with respect to other groups) do not apply to a firm with respect to a group of which it is a member if the only relationship of the kind set out in paragraph (3) of the definition of group between it and the other members of the group is nothing more than a participation; and
(e) do not apply with respect to a third-country group.

SYSC 12.1.5

handbook-guidance
For the purpose of this section, a group is defined in the Glossary, and includes the whole of a firm's group, including financial and non-financial undertakings. It also covers undertakings with other links to group members if their omission from the scope of group risk systems and controls would be misleading. The scope of the group systems and controls requirements may therefore differ from the scope of the quantitative requirements for groups.

Purpose

SYSC 12.1.6

handbook-guidance
The purpose of this chapter is to set out how the systems and control requirements imposed by SYSC (Senior Management Arrangements, Systems and Controls) apply where a firm is part of a group. If a firm is a member of a group, it should be able to assess the potential impact of risks arising from other parts of its group as well as from its own activities.

SYSC 12.1.7

handbook-guidance
This section implements Articles 73(3) (Supervision on a consolidated basis of credit institutions) and 138 (Intra-group transactions with mixed activity holding companies) of the Banking Consolidation Directive, Article 9 of the Financial Groups Directive (Internal control mechanisms and risk management processes) and Article 8 of the Insurance Groups Directive (Intra-group transactions).

General rules

SYSC 12.1.8

handbook-rule
A firm must:
(1) have adequate, sound and appropriate risk management processes and internal control mechanisms for the purpose of assessing and managing its own exposure to group risk, including sound administrative and accounting procedures; and
(2) ensure that its group has adequate, sound and appropriate risk management processes and internal control mechanisms at the level of the group, including sound administrative and accounting procedures.

SYSC 12.1.9

handbook-guidance
For the purposes of SYSC 12.1.8 R, the question of whether the risk management processes and internal control mechanisms are adequate, sound and appropriate should be judged in the light of the nature, scale and complexity of the group's business and of the risks that the group bears. Riskmanagement processes must include the stress testing and scenario analysis required by GENPRU 1.2.42 R and GENPRU 1.2.49R (1)(b).

SYSC 12.1.10

handbook-rule
The internal control mechanisms referred to in SYSC 12.1.8 R must include:
(1) mechanisms that are adequate for the purpose of producing any data and information which would be relevant for the purpose of monitoring compliance with any prudential requirements (including any reporting requirements and any requirements relating to capital adequacy, solvency, systems and controls and large exposures):
(a) to which the firm is subject with respect to its membership of a group; or
(b) that apply to or with respect to that group or part of it; and
(2) mechanisms that are adequate to monitor funding within the group.

Financial conglomerates

SYSC 12.1.11

handbook-rule
Where this section applies with respect to a financial conglomerate, the risk management processes referred to in SYSC 12.1.8R (2) must include:
(1) sound governance and management processes, which must include the approval and periodic review by the appropriate managing bodies within the financial conglomerate of the strategies and policies of the financial conglomerate in respect of all the risks assumed by the financial conglomerate, such review and approval being carried out at the level of the financial conglomerate;
(2) adequate capital adequacy policies at the level of the financial conglomerate, one of the purposes of which must be to anticipate the impact of the business strategy of the financial conglomerate on its risk profile and on the capital adequacy requirements to which it and its members are subject;
(3) adequate procedures for the purpose of ensuring that the risk monitoring systems of the financial conglomerate and its members are well integrated into their organisation;
(4) adequate procedures for the purpose of ensuring that the systems and controls of the members of the financial conglomerate are consistent and that the risks can be measured, monitored and controlled at the level of the financial conglomerate; and
(5) arrangements in place to contribute to and develop, if required, adequate recovery and resolution arrangements and plans; a firm must update these arrangements regularly.
[Note: article 9(2) of the Financial Groups Directive]

SYSC 12.1.12

handbook-rule
Where this section applies with respect to a financial conglomerate, the internal control mechanisms referred to in SYSC 12.1.8R (2) must include:
(1) mechanisms that are adequate to identify and measure all material risks incurred by members of the financial conglomerate and appropriately relate capital in the financial conglomerate to risks; and
(2) sound reporting and accounting procedures for the purpose of identifying, measuring, monitoring and controlling intra-group transactions and risk concentrations.

CRR firms and non-CRR firms that are parent financial holding companies in a Member State

SYSC 12.1.13

handbook-rule

If this rule applies under SYSC 12.1.14 R to a firm, the firm must:

(1) comply with SYSC 12.1.8R (2) in relation to any UK consolidation group or non-EEAsub-group of which it is a member, as well as in relation to its group; and
(2) ensure that the risk management processes and internal control mechanisms at the level of any consolidation group or non-EEAsub-group of which it is a member comply with the obligations set out in the following provisions on a consolidated (or sub-consolidated) basis:
(a) SYSC 4.1.1 R and SYSC 4.1.2 R;
(b) SYSC 4.1.7 R ;
(bA) SYSC 4.3A;
(c) SYSC 5.1.7 R ;
(d) SYSC 7;
(dA) the Remuneration Code or the Dual-regulated Firms Remuneration Code, whichever is applicable;
(e) BIPRU 12.3.4 R, BIPRU 12.3.5 R, BIPRU 12.3.7A R, BIPRU 12.3.8 R , BIPRU 12.3.22A R, BIPRU 12.3.22B R, BIPRU 12.3.27 R, BIPRU 12.4.-2 R, BIPRU 12.4.-1 R, BIPRU 12.4.5A R, BIPRU 12.4.10 R, BIPRU 12.4.11 R and BIPRU 12.4.11A R;
(f) [deleted];
(g) [deleted];
(h) [deleted];

[Note: article 109(2) of CRD]
(3) ensure that compliance with the obligations in (2) enables the consolidation group or the non-EEA sub-group to have arrangements, processes and mechanisms that are consistent and well integrated and that any data relevant to the purpose of supervision can be produced.

[Note: article 109(2) of CRD]

SYSC 12.1.13A

handbook-rule

If this rule applies under SYSC 12.1.14R to a firm, the firm must:

(1) comply with SYSC 12.1.8R (2) in relation to any UK consolidation group or non-EEA sub-group of which it is a member, as well as in relation to its group; and

(2) ensure that the risk management processes and internal control mechanisms at the level of any consolidation group or non-EEA sub-group of which it is a member comply with the obligations set out in the following provisions on a consolidated (or sub-consolidated) basis:

(a) SYSC 4.1.1 R and SYSC 4.1.2 R;
(b) SYSC 4.1.7 R ;
(bA) SYSC 4.3A;
(c) SYSC 5.1.7 R ;
(d) SYSC 7;
(dA) the Remuneration Code;
(e) [deleted];
(f) [deleted];
(g) [deleted];
(h) [deleted];
[Note: article 109(2) of CRD]

(3) ensure that compliance with the obligations in (2) enables the consolidation group or non-EEA sub-group to have arrangements, processes and mechanisms that are consistent and well integrated and that any data relevant to the purpose of supervision can be produced.

[Note: article 109(2) of CRD]

  • 01/10/2015

SYSC 12.1.13B

handbook-rule
When applying SYSC 12.1.13 A, CRR firms must read references to:
(1) SYSC 4.1.1 R and SYSC 4.1.2 R as references to General Organisation Requirements 2.1 and 2.2 of the PRA Rulebook;
(2) SYSC 4.1.7 R as a reference to General Organisation Requirement 2.6 of the PRA Rulebook;
(3) SYSC 4.3A as a reference to chapters 5 and 6 of the General Organisation Requirements Part of the PRA Rulebook;
(4) SYSC 5.1.7 R as a reference to Skills, Knowledge and Expertise 3.2 of the PRA Rulebook;
(5) SYSC 7 as a reference to Chapters 2 and 3 of the Risk Control Part of the PRA Rulebook;

SYSC 12.1.14

handbook-rule
SYSC 12.1.13 R applies to a firm that is:
(1) [deleted]
(2) a CRRfirm; or
(3) anon-CRRfirm that is a parent financial holding company in a Member State and is a member of a UK consolidation group.

SYSC 12.1.15

handbook-rule
In the case of a firm that:
(1) is a CRR firm; and
(2) has a mixed-activity holding company as a parent undertaking;
the risk management processes and internal control mechanisms referred to in SYSC 12.1.8 R must include sound reporting and accounting procedures and other mechanisms that are adequate to identify, measure, monitor and control transactions between the firm'sparent undertakingmixed-activity holding company and any of the mixed-activity holding company'ssubsidiary undertakings.

Insurance undertakings

SYSC 12.1.16

handbook-rule
In the case of an insurer that has a mixed-activity insurance holding company as a parent undertaking, the risk management processes and internal control mechanisms referred to in SYSC 12.1.8 R must include sound reporting and accounting procedures and other mechanisms that are adequate to identify, measure, monitor and control transactions between the firm'sparent undertakingmixed-activity insurance holding company and any of the mixed-activity insurance holding company'ssubsidiary undertakings.

SYSC 12.1.17

handbook-guidance

Nature and extent of requirements and allocation of responsibilities within the group

SYSC 12.1.18

handbook-guidance
Assessment of the adequacy of a group's systems and controls required by this section will form part of the appropriate regulator's risk management process.

SYSC 12.1.19

handbook-guidance
The nature and extent of the systems and controls necessary under SYSC 12.1.8R (1) to address group risk will vary according to the materiality of those risks to the firm and the position of the firm within the group.

SYSC 12.1.20

handbook-guidance
In some cases the management of the systems and controls used to address the risks described in SYSC 12.1.8R (1) may be organised on a group-wide basis. If the firm is not carrying out those functions itself, it should delegate them to the group members that are carrying them out. However, this does not relieve the firm of responsibility for complying with its obligations under SYSC 12.1.8R (1). A firm cannot absolve itself of such a responsibility by claiming that any breach of that rule is caused by the actions of another member of the group to whom the firm has delegated tasks. The risk management arrangements are still those of the firm, even though personnel elsewhere in the firm'sgroup are carrying out these functions on its behalf.

SYSC 12.1.21

handbook-guidance
SYSC 12.1.8R (1) deals with the systems and controls that a firm should have in respect of the exposure it has to the rest of the group. On the other hand, the purpose of SYSC 12.1.8R (2) and the rules in this section that amplify it is to require groups to have adequate systems and controls. However a group is not a single legal entity on which obligations can be imposed. Therefore the obligations have to be placed on individual firms. The purpose of imposing the obligations on each firm in the group is to make sure that the appropriate regulator can take supervisory action against any firm in a group whose systems and controls do not meet the standards in this section. Thus responsibility for compliance with the rules for group systems and controls is a joint one.

SYSC 12.1.22

handbook-guidance
If both a firm and its parent undertaking are subject to SYSC 12.1.8R (2), the appropriate regulator would not expect systems and controls to be duplicated. In this case, the firm should assess whether and to what extent it can rely on its parent's group risk systems and controls.

Export chapter as

SYSC 13

Operational risk: systems and controls for insurers

SYSC 13.1

Application

  • 31/12/2006

SYSC 13.1.1

handbook-guidance
SYSC 13 applies to an insurer unless it is:
(1) a non-directive friendly society; or
(2) an incoming EEA firm; or
(3) an incoming Treaty firm.

SYSC 13.1.2

handbook-guidance
SYSC 13 applies to:
(1) an EEA-deposit insurer; and
(2) a Swiss general insurer;


only in respect of the activities of the firm carried on from a branch in the United Kingdom.

SYSC 13.1.3

handbook-guidance
SYSC 13 applies to a UK ISPV.

SYSC 13.1.4

handbook-guidance
SYSC 13 does not apply to an incoming ECA provider acting as such.

SYSC 13.2

Purpose

  • 31/12/2006

SYSC 13.2.1

handbook-guidance
SYSC 13 provides guidance on how to interpret SYSC 3.1.1 R and SYSC 3.2.6 R, which deal with the establishment and maintenance of systems and controls, in relation to the management of operational risk. Operational risk has been described by the Basel Committee on Banking Supervision as "the risk of loss, resulting from inadequate or failed internal processes, people and systems, or from external events". This chapter covers systems and controls for managing risks concerning any of a firm's operations, such as its IT systems and outsourcing arrangements. It does not cover systems and controls for managing credit, market, liquidity and insurance risk.

SYSC 13.2.2

handbook-guidance
Operational risk is a concept that can have a different application for different firms. A firm should assess the appropriateness of the guidance in this chapter in the light of the scale, nature and complexity of its activities as well as its obligations as set out in Principle 3, to organise and control its affairs responsibly and effectively.

SYSC 13.2.3

handbook-guidance
A firm should take steps to understand the types of operational risk that are relevant to its particular circumstances, and the operational losses to which they expose the firm. This should include considering the potential sources of operational risk addressed in this chapter: people; processes and systems; external events.

SYSC 13.2.4B

handbook-guidance
Operational risk can affect, amongst other things, a firm's solvency. A firm should consider all operational risk events that may affect these matters in establishing and maintaining its systems and controls.
  • 01/04/2013

SYSC 13.3

Other related Handbook sections

  • 31/12/2006

SYSC 13.3.1B

handbook-guidance
The following is a non-exhaustive list of rules and guidance in the Handbook that are relevant to a firm's management of operational risk:
(1) SYSC 14 and INSPRU 5.1 contain specific rules and guidance for the establishment and maintenance of operational risk systems and controls.
  • 01/04/2013

SYSC 13.4

Requirements to notify the appropriate regulator

SYSC 13.4.1

handbook-guidance
Under Principle 11 and SUP 15.3.1 R, a firm must notify the appropriate regulator immediately of any operational risk matter of which the appropriate regulator would reasonably expect notice. SUP 15.3.8 G provides guidance on the occurrences that this requirement covers, which include a significant failure in systems and controls and a significant operational loss.

SYSC 13.4.2

handbook-guidance
Regarding operational risk, matters of which the appropriate regulator would expect notice under Principle 11 include:
(1) any significant operational exposures that a firm has identified;
(2) the firm's invocation of a business continuity plan; and
(3) any other significant change to a firm's organisation, infrastructure or business operating environment.

SYSC 13.5

Risk management terms

  • 31/12/2006

SYSC 13.5.1

handbook-guidance
In this chapter, the following interpretations of risk management terms apply:
(1) a firm's risk culture encompasses the general awareness, attitude and behaviour of its employees and appointed representativesor, where applicable, its tied agents,to risk and the management of risk within the organisation;
(2) operational exposure means the degree of operational risk faced by a firm and is usually expressed in terms of the likelihood and impact of a particular type of operational loss occurring (for example, fraud, damage to physical assets);
(3) a firm's operational risk profile describes the types of operational risks that it faces, including those operational risks within a firm that may have an adverse impact upon the quality of service afforded to its clients, and its exposure to these risks.

SYSC 13.6

People

  • 31/12/2006

SYSC 13.6.1

handbook-guidance
A firm should consult SYSC 3.2.2 G to SYSC 3.2.5 G for guidance on reporting lines and delegation of functions within a firm and SYSC 3.2.13 G to SYSC 3.2.14 G for guidance on the suitability of employees and appointed representatives or, where applicable, its tied agents. This section provides additional guidance on management of employees and other human resources in the context of operational risk.

SYSC 13.6.2

handbook-guidance
A firm should establish and maintain appropriate systems and controls for the management of operational risks that can arise from employees. In doing so, a firm should have regard to:
(1) its operational risk culture, and any variations in this or its human resource management practices, across its operations (including, for example, the extent to which the compliance culture is extended to in-house IT staff);
(2) whether the way employees are remunerated exposes the firm to the risk that it will not be able to meet its regulatory obligations (see SYSC 3.2.18 G). For example, a firm should consider how well remuneration and performance indicators reflect the firm's tolerance for operational risk, and the adequacy of these indicators for measuring performance;
(3) whether inadequate or inappropriate training of client-facing services exposes clients to risk of loss or unfair treatment including by not enabling effective communication with the firm;
(4) the extent of its compliance with applicable regulatory and other requirements that relate to the welfare and conduct of employees;
(5) its arrangements for the continuity of operations in the event of employee unavailability or loss;
(6) the relationship between indicators of 'people risk' (such as overtime, sickness, and employee turnover levels) and exposure to operational losses; and
(7) the relevance of all the above to employees of a third party supplier who are involved in performing an outsourcing arrangement. As necessary, a firm should review and consider the adequacy of the staffing arrangements and policies of a service provider.

Employee responsibilities

SYSC 13.6.3

handbook-guidance
A firm should ensure that all employees are capable of performing, and aware of, their operational risk management responsibilities, including by establishing and maintaining:
(1) appropriate segregation of employees' duties and appropriate supervision of employees in the performance of their responsibilities (see SYSC 3.2.5 G);
(2) appropriate recruitment and subsequent processes to review the fitness and propriety of employees (see SYSC 3.2.13 G and SYSC 3.2.14 G);
(3) clear policy statements and appropriate systems and procedures manuals that are effectively communicated to employees and available for employees to refer to as required. These should cover, for example, compliance, IT security and health and safety issues;
(4) training processes that enable employees to attain and maintain appropriate competence; and
(5) appropriate and properly enforced disciplinary and employment termination policies and procedures.

SYSC 13.6.4

handbook-guidance
A firm should have regard to SYSC 13.6.3 G in relation to approved persons, people occupying positions of high personal trust (for example, security administration, payment and settlement functions); and people occupying positions requiring significant technical competence (for example, derivatives trading and technical security administration). A firm should also consider the rules and guidance for approved persons in other parts of the Handbook (including APER and SUP) and the rules and guidance on senior manager responsibilities in SYSC 2.1 (Apportionment of Responsibilities).

SYSC 13.7

Processes and systems

  • 31/12/2006

SYSC 13.7.1

handbook-guidance
A firm should establish and maintain appropriate systems and controls for managing operational risks that can arise from inadequacies or failures in its processes and systems (and, as appropriate, the systems and processes of third party suppliers, agents and others). In doing so a firm should have regard to:
(1) the importance and complexity of processes and systems used in the end-to-end operating cycle for products and activities (for example, the level of integration of systems);
(2) controls that will help it to prevent system and process failures or identify them to permit prompt rectification (including pre-approval or reconciliation processes);
(3) whether the design and use of its processes and systems allow it to comply adequately with regulatory and other requirements;
(4) its arrangements for the continuity of operations in the event that a significant process or system becomes unavailable or is destroyed; and
(5) the importance of monitoring indicators of process or system risk (including reconciliation exceptions, compensation payments for client losses and documentation errors) and experience of operational losses and exposures.

Internal documentation

SYSC 13.7.2

handbook-guidance
Internal documentation may enhance understanding and aid continuity of operations, so a firm should ensure the adequacy of its internal documentation of processes and systems (including how documentation is developed, maintained and distributed) in managing operational risk.

External documentation

SYSC 13.7.3

handbook-guidance
A firm may use external documentation (including contracts, transaction statements or advertising brochures) to define or clarify terms and conditions for its products or activities, its business strategy (for example, including through press statements), or its brand. Inappropriate or inaccurate information in external documents can lead to significant operational exposure.

SYSC 13.7.4

handbook-guidance
A firm should ensure the adequacy of its processes and systems to review external documentation prior to issue (including review by its compliance, legal and marketing departments or by appropriately qualified external advisers). In doing so, a firm should have regard to:
(1) compliance with applicable regulatory and other requirements;
(2) the extent to which its documentation uses standard terms (that are widely recognised, and have been tested in the courts) or non-standard terms (whose meaning may not yet be settled or whose effectiveness may be uncertain);
(3) the manner in which its documentation is issued; and
(4) the extent to which confirmation of acceptance is required (including by customer signature or counterparty confirmation).

IT systems

SYSC 13.7.5

handbook-guidance
IT systems include the computer systems and infrastructure required for the automation of processes, such as application and operating system software; network infrastructure; and desktop, server, and mainframe hardware. Automation may reduce a firm's exposure to some 'people risks' (including by reducing human errors or controlling access rights to enable segregation of duties), but will increase its dependency on the reliability of its IT systems.

SYSC 13.7.6

handbook-guidance
A firm should establish and maintain appropriate systems and controls for the management of its IT system risks, having regard to:
(1) its organisation and reporting structure for technology operations (including the adequacy of senior management oversight);
(2) the extent to which technology requirements are addressed in its business strategy;
(3) the appropriateness of its systems acquisition, development and maintenance activities (including the allocation of responsibilities between IT development and operational areas, processes for embedding security requirements into systems); and
(4) the appropriateness of its activities supporting the operation of IT systems (including the allocation of responsibilities between business and technology areas).

Information security

SYSC 13.7.7

handbook-guidance
Failures in processing information (whether physical, electronic or known by employees but not recorded) or of the security of the systems that maintain it can lead to significant operational losses. A firm should establish and maintain appropriate systems and controls to manage its information security risks. In doing so, a firm should have regard to:
(1) confidentiality: information should be accessible only to persons or systems with appropriate authority, which may require firewalls within a system, as well as entry restrictions;
(2) integrity: safeguarding the accuracy and completeness of information and its processing;
(3) availability and authentication: ensuring that appropriately authorised persons or systems have access to the information when required and that their identity is verified;
(4) non-repudiation and accountability: ensuring that the person or system that processed the information cannot deny their actions.

SYSC 13.7.8

handbook-guidance
A firm should ensure the adequacy of the systems and controls used to protect the processing and security of its information, and should have regard to established security standards such as ISO17799 (Information Security Management).

Geographic location

SYSC 13.7.9

handbook-guidance
Operating processes and systems at separate geographic locations may alter a firm's operational risk profile (including by allowing alternative sites for the continuity of operations). A firm should understand the effect of any differences in processes and systems at each of its locations, particularly if they are in different countries, having regard to:
(1) the business operating environment of each country (for example, the likelihood and impact of political disruptions or cultural differences on the provision of services);
(2) relevant local regulatory and other requirements regarding data protection and transfer;
(3) the extent to which local regulatory and other requirements may restrict its ability to meet regulatory obligations in the United Kingdom (for example, access to information by the appropriate regulator and local restrictions on internal or external audit); and
(4) the timeliness of information flows to and from its headquarters and whether the level of delegated authority and the risk management structures of the overseas operation are compatible with the firm's head office arrangements.

SYSC 13.8

External events and other changes

  • 31/12/2006

SYSC 13.8.1

handbook-guidance
The exposure of a firm to operational risk may increase during times of significant change to its organisation, infrastructure and business operating environment (for example, following a corporate restructure or changes in regulatory requirements). Before, during, and after expected changes, a firm should assess and monitor their effect on its risk profile, including with regard to:
(1) untrained or de-motivated employees or a significant loss of employees during the period of change, or subsequently;
(2) inadequate human resources or inexperienced employees carrying out routine business activities owing to the prioritisation of resources to the programme or project;
(3) process or system instability and poor management information due to failures in integration or increased demand; and
(4) inadequate or inappropriate processes following business re-engineering.

SYSC 13.8.2

handbook-guidance
A firm should establish and maintain appropriate systems and controls for the management of the risks involved in expected changes, such as by ensuring:
(1) the adequacy of its organisation and reporting structure for managing the change (including the adequacy of senior management oversight);
(2) the adequacy of the management processes and systems for managing the change (including planning, approval, implementation and review processes); and
(3) the adequacy of its strategy for communicating changes in systems and controls to its employees.

Unexpected changes and business continuity management

SYSC 13.8.3

handbook-guidance
SYSC 3.2.19 G provides high level guidance on business continuity. This section provides additional guidance on managing business continuity in the context of operational risk.

SYSC 13.8.4A

handbook-guidance
The high level requirement for appropriate systems and controls at SYSC 3.1.1 R applies at all times, including when a business continuity plan is invoked. However, the appropriate regulator recognises that, in an emergency, a firm may be unable to comply with a particular rule and the conditions for relief are outlined in Chapter 2 of the General Provisions Part of the PRA Rulebook.
  • 02/04/2015

SYSC 13.8.5

handbook-guidance
A firm should consider the likelihood and impact of a disruption to the continuity of its operations from unexpected events. This should include assessing the disruptions to which it is particularly susceptible (and the likely timescale of those disruptions) including through:
(1) loss or failure of internal and external resources (such as people, systems and other assets);
(2) the loss or corruption of its information; and
(3) external events (such as vandalism, war and "acts of God").

SYSC 13.8.6

handbook-guidance
A firm should implement appropriate arrangements to maintain the continuity of its operations. A firm should act to reduce both the likelihood of a disruption (including by succession planning, systems resilience and dual processing); and the impact of a disruption (including by contingency arrangements and insurance).

SYSC 13.8.7

handbook-guidance
A firm should document its strategy for maintaining continuity of its operations, and its plans for communicating and regularly testing the adequacy and effectiveness of this strategy. A firm should establish:
(1) formal business continuity plans that outline arrangements to reduce the impact of a short, medium or long-term disruption, including:
(a) resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
(b) the recovery priorities for the firm's operations; and
(c) communication arrangements for internal and external concerned parties (including the appropriate regulator, clients and the press);
(2) escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
(3) processes to validate the integrity of information affected by the disruption;
(4) processes to review and update (1) to (3) following changes to the firm's operations or risk profile (including changes identified through testing).

SYSC 13.8.8

handbook-guidance
The use of an alternative site for recovery of operations is common practice in business continuity management. A firm that uses an alternative site should assess the appropriateness of the site, particularly for location, speed of recovery and adequacy of resources. Where a site is shared, a firm should evaluate the risk of multiple calls on shared resources and adjust its plans accordingly.

SYSC 13.9

Outsourcing

  • 31/12/2006

SYSC 13.9.1

handbook-guidance
As SYSC 3.2.4 G explains, a firm cannot contract out its regulatory obligations and should take reasonable care to supervise the discharge of outsourced functions. This section provides additional guidance on managing outsourcing arrangements (and will be relevant, to some extent, to other forms of third party dependency) in relation to operational risk. Outsourcing may affect a firm's exposure to operational risk through significant changes to, and reduced control over, people, processes and systems used in outsourced activities.

SYSC 13.9.2

handbook-guidance
Firms should take particular care to manage material outsourcing arrangements and, as SUP 15.3.8 G (1)(e) explains, a firm should notify the appropriate regulator when it intends to enter into a material outsourcing arrangement.

SYSC 13.9.3

handbook-guidance
A firm should not assume that because a service provider is either a regulated firm or an intra-group entity an outsourcing arrangement with that provider will, in itself, necessarily imply a reduction in operational risk.

SYSC 13.9.4

handbook-guidance
Before entering into, or significantly changing, an outsourcing arrangement, a firm should:
(1) analyse how the arrangement will fit with its organisation and reporting structure; business strategy; overall risk profile; and ability to meet its regulatory obligations;
(2) consider whether the agreements establishing the arrangement will allow it to monitor and control its operational risk exposure relating to the outsourcing;
(3) conduct appropriate due diligence of the service provider's financial stability and expertise;
(4) consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement (including what will happen on the termination of the contract); and
(5) consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms.

SYSC 13.9.5

handbook-guidance
In negotiating its contract with a service provider, a firm should have regard to:
(1) reporting or notification requirements it may wish to impose on the service provider;
(2) whether sufficient access will be available to its internal auditors, external auditors or actuaries (see section 341 of the Act) and to the appropriate regulator (see SUP 2.3.5 R (Access to premises) and SUP 2.3.7 R (Suppliers under material outsourcing arrangements);
(3) information ownership rights, confidentiality agreements and Chinese walls to protect client and other information (including arrangements at the termination of the contract);
(4) the adequacy of any guarantees and indemnities;
(5) the extent to which the service provider must comply with the firm's policies and procedures (covering, for example, information security);
(6) the extent to which a service provider will provide business continuity for outsourced operations, and whether exclusive access to its resources is agreed;
(7) the need for continued availability of software following difficulty at a third party supplier;
(8) the processes for making changes to the outsourcing arrangement (for example, changes in processing volumes, activities and other contractual terms) and the conditions under which the firm or service provider can choose to change or terminate the outsourcing arrangement, such as where there is:
(a) a change of ownership or control (including insolvency or receivership) of the service provider or firm; or
(b) significant change in the business operations (including sub-contracting) of the service provider or firm; or
(c) inadequate provision of services that may lead to the firm being unable to meet its regulatory obligations.

SYSC 13.9.6

handbook-guidance
In implementing a relationship management framework, and drafting the service level agreement with the service provider, a firm should have regard to:
(1) the identification of qualitative and quantitative performance targets to assess the adequacy of service provision, to both the firm and its clients, where appropriate;
(2) the evaluation of performance through service delivery reports and periodic self certification or independent review by internal or external auditors; and
(3) remedial action and escalation processes for dealing with inadequate performance.

SYSC 13.9.7

handbook-guidance
In some circumstances, a firm may find it beneficial to use externally validated reports commissioned by the service provider, to seek comfort as to the adequacy and effectiveness of its systems and controls. The use of such reports does not absolve the firm of responsibility to maintain other oversight. In addition, the firm should not normally have to forfeit its right to access, for itself or its agents, to the service provider's premises.

SYSC 13.9.8

handbook-guidance
A firm should ensure that it has appropriate contingency arrangements to allow business continuity in the event of a significant loss of services from the service provider. Particular issues to consider include a significant loss of resources at, or financial failure of, the service provider, and unexpected termination of the outsourcing arrangement.

SYSC 13.10

Insurance

  • 31/12/2006

SYSC 13.10.1

handbook-guidance
Whilst a firm may take out insurance with the aim of reducing the monetary impact of operational risk events, non-monetary impacts may remain (including impact on the firm's reputation). A firm should not assume that insurance alone can replace robust systems and controls.

SYSC 13.10.2

handbook-guidance
When considering utilising insurance, a firm should consider:
(1) the time taken for the insurer to pay claims (including the potential time taken in disputing cover) and the firm's funding of operations whilst awaiting payment of claims;
(2) the financial strength of the insurer, which may determine its ability to pay claims, particularly where large or numerous small claims are made at the same time; and
(3) the effect of any limiting conditions and exclusion clauses that may restrict cover to a small number of specific operational losses and may exclude larger or hard to quantify indirect losses (such as lost business or reputational costs).

Export chapter as

SYSC 14

Risk management and associated systems and controls for insurers

SYSC 14.1

Application

  • 31/12/2006

SYSC 14.1.1

handbook-rule
This section applies to an insurer unless it is:
(1) a non-directive friendly society; or
(2) an incoming EEA firm; or
(3) an incoming Treaty firm.

SYSC 14.1.2

handbook-rule
This section applies to:
(1) an EEA-deposit insurer; and
(2) a Swiss general insurer;
only in respect of the activities of the firm carried on from a branch in the United Kingdom.

SYSC 14.1.2A

handbook-rule
This section does not apply to an incoming ECA provider acting as such.

Purpose

SYSC 14.1.3

handbook-guidance
This section sets out some rules and guidance on the establishment and maintenance of systems and controls for the management of a firm's prudential risks. A firm's prudential risks are those that can reduce the adequacy of its financial resources, and as a result may adversely affect its safety and soundness or prejudice policyholders. Some key prudential risks are credit, market, liquidity, operational, insurance and group risk.

SYSC 14.1.4

handbook-guidance
The purpose of this section is to serve the PRA's statutory objectives of promoting the safety and soundness of PRA-authorised persons and contributing to the securing of an appropriate degree of protection for those who are, or may become, policyholders.In particular, this section aims to reduce the risk that a firm may pose a threat to these statutory objectives , either because it is not prudently managed, or because it has inadequate systems to permit appropriate senior management oversight and control of its business.

SYSC 14.1.5

handbook-guidance
Both adequate financial resources and adequate systems and controls are necessary for the effective management of prudential risks. A firm may hold financial resources to help alleviate the financial consequences of minor weaknesses in its systems and controls (to reflect possible impairments in the accuracy or timing of its identification, measurement, monitoring and control of certain risks, for example). However, financial resources cannot adequately compensate for significant weaknesses in a firm's systems and controls that could fundamentally undermine its ability to control its affairs effectively.

How to interpret this section

SYSC 14.1.6

handbook-guidance
This section is designed to amplify the requirement that a firm must organise and control its affairs responsibly and effectively, and have effective risk strategies and adequate risk management systems. This section is also designed to be complementary to SYSC 2, SYSC 3 and SYSC 13 in that it contains some additional rules and guidance on senior management arrangements and associated systems and controls for firms that could have a significant impact on the PRA's objectives.

SYSC 14.1.7

handbook-guidance
In addition to supporting SYSC 2, SYSC 3 and SYSC 13, this section lays the foundations for the more specific rules and guidance on the management of credit, market, liquidity, operational, insurance and group risks that are in SYSC 11, SYSC 12, SYSC 15, SYSC 16 and INSPRU 5.1. Many of the elements raised here in general terms are expanded upon in these sections.

SYSC 14.1.8

handbook-guidance
Appropriate systems and controls for the management of prudential risk will vary from firm to firm. Therefore, most of the material in this section is guidance. In interpreting this guidance, a firm should have regard to its own particular circumstances. Following from SYSC 3.1.2 G, this should include considering the nature, scale and complexity of its business, which may be influenced by factors such as:
(1) the diversity of its operations, including geographical diversity;
(2) the volume and size of its transactions; and
(3) the degree of risk associated with each area of its operation.

SYSC 14.1.9

handbook-guidance
The guidance contained within this section is not designed to be exhaustive. When establishing and maintaining its systems and controls a firm should have regard not only to other parts of the Handbook, but also to material that is issued by other industry or regulatory bodies.

The role of systems and controls

SYSC 14.1.10

handbook-guidance
A firm's systems and controls should provide its senior management with an adequate means of managing the firm. As such, they should be designed and maintained to ensure that senior management is able to make and implement integrated business planning and risk management decisions on the basis of accurate information about the risks that the firm faces and the financial resources that it has.

The prudential responsibilities of senior management and the apportionment of those responsibilities

SYSC 14.1.11

handbook-guidance
Ultimate responsibility for the management of prudential risks rests with a firm'sgoverning body and relevant senior managers, and in particular with those individuals that undertake the firm'sgoverning functions and the apportionment and oversight function. In particular, these responsibilities should include:
(1) overseeing the establishment of an appropriate business plan and risk management strategy;
(2) overseeing the development of appropriate systems for the management of prudential risks;
(3) establishing adequate internal controls; and
(4) ensuring that the firm maintains adequate financial resources.

The delegation of responsibilities within the firm

SYSC 14.1.12

handbook-guidance
Although authority for the management of a firm's prudential risks is likely to be delegated, to some degree, to individuals at all levels of the organisation, overall responsibility for this activity should not be delegated from its governing body and relevant senior managers.

SYSC 14.1.13

handbook-guidance
Where delegation does occur, a firm should ensure that appropriate systems and controls are in place to allow its governing body and relevant senior managers to participate in and control its prudential risk management activities. The governing body and relevant senior managers should approve and periodically review these systems and controls to ensure that delegated duties are being performed correctly.

Firms subject to risk management on a group basis

SYSC 14.1.14

handbook-guidance
Some firms organise the management of their prudential risks on a stand-alone basis. In some cases, however, the management of a firm's prudential risks may be entirely or largely subsumed within a whole group or sub-group basis.
(1) The latter arrangement may still comply with the PRA's policyon systems and controls if the firm'sgoverning body formally delegates the functions that are to be carried out in this way to the persons or bodies that are to carry them out. Before doing so, however, the firm'sgoverning body should have explicitly considered the arrangement and decided that it is appropriate and that it enables the firm to meet the PRA's policy on systems and controls. The firm should notify the PRA if the management of its prudential risks is to be carried out in this way.
(2) Where the management of a firm's prudential risks is largely, but not entirely, subsumed within a whole group or sub-group basis, the firm should ensure that any prudential issues that are specific to the firm are:
(a) identified and adequately covered by those to whom it has delegated certain prudential risk management tasks; or
(b) dealt with by the firm itself.

SYSC 14.1.15

handbook-guidance
Any delegation of the management of prudential risks to another part of a firm'sgroup does not relieve it of responsibility for complying with the PRA's policy on systems and controls. A firm cannot absolve itself of such a responsibility by claiming that any breach of the PRA's policy on systems and controls is effected by the actions of a third party firm to whom the firm has delegated tasks. The risk management arrangements are still those of the firm, even though personnel elsewhere in the firm'sgroup are carrying out these functions on its behalf. Thus any references in GENPRU, INSPRU or SYSC to what a firm, its personnel and its management should and should not do still apply, and do not need any adjustment to cover the situation in which risk management functions are carried out on a group-wide basis.

SYSC 14.1.16

handbook-guidance
Where it is stated in GENPRU, INSPRU or SYSC that a particular task in relation to a firm's systems and controls should be carried out by a firm'sgoverning body this task should not be delegated to another part of its group. Furthermore, even where the management of a firm's prudential risks is delegated as described in SYSC 14.1.14 G, responsibility for its effectiveness and for ensuring that it remains appropriate remains with the firm'sgoverning body. The firm'sgoverning body should therefore keep any delegation under review to ensure that delegated duties are being performed correctly.

Business planning and risk management

SYSC 14.1.17

handbook-guidance
Business planning and risk management are closely related activities. In particular, the forward-looking assessment of a firm's financial resources needs, and of how business plans may affect the risks that it faces, are important elements of prudential risk management. A firm's business planning should also involve the creation of specific risk policies which will normally outline a firm's strategy and objectives for, as appropriate, the management of its market, credit, liquidity, operational, insurance and group risks and the processes that it intends to adopt to achieve these objectives. SYSC 14.1.18 R to SYSC 14.1.25 G set out some rules and guidance relating to business planning and risk management (see also SYSC 3.2.17 G, which states that a firm should plan its business appropriately).

SYSC 14.1.18

handbook-rule
A firm must take reasonable steps to ensure the establishment and maintenance of a business plan and appropriate systems for the management of prudential risk.

SYSC 14.1.19

handbook-rule
When establishing and maintaining its business plan and prudential risk management systems, a firm must document:
(1) an explanation of its overall business strategy, including its business objectives;
(2) a description of, as applicable, its policies towards market, credit (including provisioning), liquidity, operational, insurance and group risk (that is, its risk policies), including its appetite or tolerance for these risks and how it identifies, measures or assesses, monitors and controls these risks;
(3) the systems and controls that it intends to use in order to ensure that its business plan and risk policies are implemented correctly;
(4) a description of how the firm accounts for assets and liabilities, including the circumstances under which items are netted, included or excluded from the firm's balance sheet and the methods and assumptions for valuation;
(5) appropriate financial projections and the results of its stress testing and scenario analysis (see GENPRU 1.2 (Adequacy of financial resources)); and
(6) details of, and the justification for, the methods and assumptions used in financial projections and stress testing and scenario analysis.

SYSC 14.1.20

handbook-guidance
The prudential risk management systems referred to in SYSC 14.1.18 R and SYSC 14.1.19 R are the means by which a firm is able to:
(1) identify the prudential risks that are inherent in its business plan, operating environment and objectives, and determine its appetite or tolerance for these risks;
(2) measure or assess its prudential risks;
(3) monitor its prudential risks; and
(4) control or mitigate its prudential risks.


INSPRU 4.1.63 E is an evidential provision relating to SYSC 14.1.18 R concerning risk management systems in respect of liquidity risk arising from substantial exposures in foreign currencies.

SYSC 14.1.21

handbook-guidance
A firm should consider the relationship between its business plan, risk policies and the financial resources that it has available (or can readily access), recognising that decisions made in respect of one element may have consequences for the other two.

SYSC 14.1.22

handbook-guidance
A firm's business plan and risk management systems should be:
(1) effectively communicated so that all employees and contractors understand and adhere to the procedures related to their own responsibilities;
(2) regularly updated and revised, in particular when there is significant new information or when actual practice or performance differs materially from the documented strategy, policy or systems.

SYSC 14.1.23

handbook-guidance
The level of detail in a firm's business plan and its approach to the design of its risk management systems should be appropriate to the scale and complexity of its operations, and the nature and degree of risk that it faces.

SYSC 14.1.24

handbook-guidance
A firm's business plan and systems documentation should be accessible to the firm's management in line with their respective responsibilities and, upon request, to the PRA .

SYSC 14.1.25

handbook-guidance
SYSC 14.1.19R (5) requires a firm to document its financial projections and the results of its stress testing and scenario analysis. Such financial projections, stress tests and scenario analysis should be used by a firm'sgoverning body and relevant senior managers when deciding upon how much risk the firm is willing to accept in pursuit of its business objectives and how risk limits should be set. Further rules and guidance on stress testing and scenario analysis are outlined in GENPRU 1.2 (Adequacy of financial resources) and SYSC 11 (Liquidity risk systems and controls).

Internal controls: introduction

SYSC 14.1.26

handbook-guidance
Internal controls should provide a firm with reasonable assurance that it will not be hindered in achieving its objectives, or in the orderly and legitimate conduct of its business, by events that may reasonably be foreseen. More specifically, internal controls should be concerned with ensuring that a firm's business plan and risk management systems are operating as expected and are being implemented as intended. The following rule (SYSC 14.1.27 R) reflects the importance of internal controls.

SYSC 14.1.27

handbook-rule
A firm must take reasonable steps to establish and maintain adequate internal controls.

SYSC 14.1.28

handbook-guidance
The precise role and organisation of internal controls can vary from firm to firm. However, a firm'sinternal controls should normally be concerned with assisting its governing body and relevant senior managers to participate in ensuring that it meets the following objectives:
(1) safeguarding both the assets of the firm and its customers, as well as identifying and managing liabilities;
(2) maintaining the efficiency and effectiveness of its operations;
(3) ensuring the reliability and completeness of all accounting, financial and management information; and
(4) ensuring compliance with its internal policies and procedures as well as all applicable laws and regulations.

SYSC 14.1.29

handbook-guidance
When determining the adequacy of its internal controls, a firm should consider both the potential risks that might hinder the achievement of the objectives listed in SYSC 14.1.28 G, and the extent to which it needs to control these risks. More specifically, this should normally include consideration of:
(1) the appropriateness of its reporting and communication lines (see SYSC 3.2.2 G);
(2) how the delegation or contracting of functions or activities to employees, appointed representatives or, where applicable, its tied agents or other third parties (for example outsourcing) is to be monitored and controlled (see SYSC 3.2.3 G to SYSC 3.2.4 G, SYSC 14.1.12 G to SYSC 14.1.16 G and SYSC 14.1.33 G; additional guidance on the management of outsourcing arrangements is also provided in SYSC 13.9);
(3) the risk that a firm'semployees or contractors might accidentally or deliberately breach a firm's policies and procedures (see SYSC 13.6.3 G);
(4) the need for adequate segregation of duties (see SYSC 3.2.5 G and SYSC 14.1.30 G to SYSC 14.1.33 G);
(5) the establishment and control of risk management committees (see SYSC 14.1.34 G to SYSC 14.1.37 G);
(6) the need for risk assessment and the establishment of a risk assessment function (seeSYSC 3.2.10 G and SYSC 14.1.38 G to SYSC 14.1.41 G);
(7) the need for internal audit and the establishment of an internal audit function and audit committee (see SYSC 3.2.15 G to SYSC 3.2.16 G and SYSC 14.1.42 G to SYSC 14.1.45 G).

Internal controls: segregation of duties

SYSC 14.1.30

handbook-guidance
The effective segregation of duties is an important internal control. In particular, it helps to ensure that no one individual is completely free to commit a firm's assets or incur liabilities on its behalf. Segregation can also help to ensure that a firm'sgoverning body receives objective and accurate information on financial performance, the risks faced by the firm and the adequacy of its systems. In this regard, a firm should ensure that there is adequate segregation of duties between employees involved in:
(1) taking on or controlling risk (which could involve risk mitigation);
(2) risk assessment (which includes the identification and analysis of risk); and
(3) internal audit.

SYSC 14.1.31

handbook-guidance
In addition, a firm should normally ensure that no single individual has unrestricted authority to do all of the following:
(1) initiate a transaction;
(2) bind the firm;
(3) make payments; and
(4) account for it.

SYSC 14.1.32

handbook-guidance
Where a firm is unable to ensure the complete segregation of duties (for example, because it has a limited number of staff), it should ensure that there are adequate compensating controls in place (for example, frequent review of an area by relevant senior managers).

SYSC 14.1.33

handbook-guidance
Where a firm outsources a controlled function, such as internal audit, it should take reasonable steps to ensure that every individual involved in the performance of this service is independent from the individuals who perform its external audit. This should not prevent services from being undertaken by a firm's external auditors provided that:
(1) the work is carried out under the supervision and management of the firm's own internal staff; and
(2) potential conflicts of interest between the provision of external audit services and the provision of controlled functions are properly managed.

Internal controls: risk management committees

SYSC 14.1.34

handbook-guidance
In many firms, especially if there are multiple business lines, it is common for the governing body to delegate some tasks related to risk control and management to committees such as asset and liability committees (ALCO), credit risk committees and market risk committees.

SYSC 14.1.35

handbook-guidance
Where a firm decides to create one or more risk management committee(s), adequate internal controls should be put in place to ensure that these committees are effective and that their actions are consistent with the objectives outlined in SYSC 14.1.28 G. This should normally include consideration of the following:
(1) setting clear terms of reference, including membership, reporting lines and responsibilities of each committee;
(2) setting limits on their authority;
(3) agreeing routine reporting and non-routine reporting escalation procedures;
(4) agreeing the minimum frequency of committee meetings; and
(5) reviewing the performance of these risk management committees.

SYSC 14.1.36

handbook-guidance
The decision to delegate risk management tasks, along with the terms of reference of the committees and their performance, should be reviewed periodically by the firm'sgoverning body and revised as appropriate.

SYSC 14.1.37

handbook-guidance
The effective use of risk management committees can help to enhance a firm'sinternal controls. In establishing and maintaining its risk management committees, a firm should consider:
(1) their membership, which should normally include relevant senior managers (such as the head of group risk, head of legal, and the heads of market, credit, liquidity and operational risk, etc.), business line managers, risk management personnel and other appropriately skilled people, for example, actuaries, lawyers, accountants, IT specialists, etc.;
(2) using these committees to:
(i) inform the decisions made by a firm'sgoverning body regarding its appetite or tolerance for risk taking;
(ii) highlight risk management issues that may require attention by the governing body;
(iii) consider risk at the firm-wide level and, within delegated limits, to determine the allocation of risk limits and financial resources across business lines; and
(iv) consider how exposures may be unwound, hedged, or otherwise mitigated, as appropriate.

Internal controls: risk assessment

SYSC 14.1.38

handbook-guidance
Risk assessment is the process through which a firm identifies and analyses (using both qualitative and quantitative methodologies) the risks that it faces. A firm's risk assessment activities should normally include consideration of:
(1) its total exposure to risk at the firm-wide level (that is, its exposure across business lines and risk categories);
(2) capital allocation and the need to calculate risk weighted returns for different business lines;
(3) the potential correlations that can exist between the risks in different business lines; this should also include looking for risks to which a firm's business plan is particularly sensitive, such as interest rate risk, or multiple dealings with the same counterparty;
(4) the use of stress tests and scenario analysis;
(5) whether there are risks inherent in the firm's business that are not being addressed adequately;
(6) the risk adjusted return that the firm is achieving; and
(7) the adequacy and timeliness of management information on market, credit, insurance, liquidity, operational and group risks from the business lines, including risk limit utilisation.

SYSC 14.1.39

handbook-guidance
(1) In accordance with SYSC 3.2.10 G a firm should consider whether it needs to set up a separate risk assessment function (or functions) that is responsible for assessing the risks that the firm faces and advising its governing body and senior managers on them.
(2) The term 'risk assessment function' refers to the generally understood concept of risk assessment within a firm, that is, the function of setting and controlling risk exposure. The risk assessment function is not a controlled function itself, but is part of the systems and controls function (CF28).

SYSC 14.1.40

handbook-guidance
Where a firm does decide that it needs a separate risk assessment function, the employees or contractors that carry out this function should not normally be involved in risk taking activities such as business line management (see SYSC 14.1.30 G to SYSC 14.1.33 G on the segregation of duties).

SYSC 14.1.41

handbook-guidance
A summary of the results of the analysis undertaken by a firm's risk assessment function in accordance with SYSC 14.1.39 G (including, where necessary, an explanation of any assumptions that were adopted) should normally be reported to relevant senior managers as well as to the firm'sgoverning body.

Internal audit

SYSC 14.1.42

handbook-guidance
A firm should ensure that it has appropriate mechanisms in place to assess and monitor the appropriateness and effectiveness of its systems and controls. This should normally include consideration of:
(1) adherence to and effectiveness of, as appropriate, its market, credit, liquidity, operational, insurance, and group risk policies;
(2) whether departures and variances from its documented systems and controls and risk policies have been adequately documented and appropriately reported, including whether appropriate pre-clearance authorisation has been sought for material departures and variances;
(3) adherence to and effectiveness of its accounting policies, and whether accounting records are complete and accurate;
(4) adherence to and effectiveness of its management reporting arrangements, including the timeliness of reporting, and whether information is comprehensive and accurate; and
(5) adherence to PRA rules and regulatory prudential standards.

SYSC 14.1.43

handbook-guidance
(1) In accordance with SYSC 3.2.15 G and SYSC 3.2.16 G, a firm should consider whether it needs to set up a dedicated internal audit function.
(2) The term 'internal audit function' refers to the generally understood concept of internal audit within a firm, that is, the function of assessing adherence to and the effectiveness of internal systems and controls, procedures and policies. The internal audit function is not a controlled function itself, but is part of the systems and controls function (CF28).

SYSC 14.1.44

handbook-guidance
Where a firm decides to set up an internal audit function, this function should provide independent assurance to its governing body, audit committee or an appropriate senior manager of the integrity and effectiveness of its systems and controls.

SYSC 14.1.45

handbook-guidance
In forming its judgements, the person performing the internal audit function should test the practical operation of a firm's systems and controls as well as its accounting and risk policies. This should include examining the adequacy of supporting records.

Management information

SYSC 14.1.46

handbook-guidance
Many individuals, at various levels of a firm, need management information relating to their activities. However, SYSC 14.1.47 G to SYSC 14.1.50 G concentrates on the management information that should be available to those at the highest level of a firm, that is, the firm'sgoverning body and relevant senior managers. In so doing SYSC 14.1.47 G to SYSC 14.1.50 G amplify SYSC 3.2.11 G and SYSC 3.2.12 G (which outline the PRA's high level policy on senior management information) by providing some additional guidance on the management information that should be available.

SYSC 14.1.47

handbook-guidance
The role of management information should be to help a firm'sgoverning body and senior managers to understand risk at a firm-wide level. In so doing, it should help them to:
(1) determine whether a firm is prudently managed with adequate financial resources;
(2) make the decisions that fall within their ambit (for example, the high level business plans, strategy and risk tolerances of the firm); and
(3) oversee the execution of tasks for which they are responsible.

SYSC 14.1.48

handbook-guidance
A firm should consider what information needs to be made available to its governing body and senior managers. Some possible examples include:
(1) firm-wide information such as the overall profitability and value of a firm and its total exposure to risk;
(2) reports from committees to which the governing body has delegated risk management tasks, if applicable;
(3) reports from a firm'sinternal audit and risk assessment functions (see SYSC 14.1.43 G and SYSC 14.1.39 G), if applicable, including exception reports, where risk limits and policies have been breached or systems circumvented;
(4) financial projections under expected and abnormal (that is, stressed) conditions;
(5) reconciliation of actual profit and loss to previous financial projections and an analysis of any significant variances;
(6) matters which require a decision from the governing body or senior managers, for example a significant variation to a business plan, amendments to risk limits, the creation of a new business line, etc;
(7) compliance with PRA rules and regulatory prudential standards;
(8) risk weighted returns; and
(9) liquidity and funding requirements.

SYSC 14.1.49

handbook-guidance
The management information that is provided to a firm'sgoverning body and senior managers should have the following characteristics:
(1) it should be timely, its frequency being determined by factors such as:
(a) the volatility of the business in which the firm is engaged (that is, the speed at which its risks can change);
(b) any time constraints on when action needs to be taken; and
(c) the level of risk that the firm is exposed to, compared to its available financial resources and tolerance for risk;
(2) it should be reliable, having regard to the fact that it may be necessary to sacrifice a degree of accuracy for timeliness; and
(3) it should be presented in a manner that highlights any relevant issues on which those undertaking governing functions should focus particular attention.

SYSC 14.1.50

handbook-guidance
The production of management and other information may require the collation of data from a variety of separate manual and automated systems. In such cases, responsibility for the integrity of the information may be spread amongst a number of operational areas. A firm should ensure that it has appropriate processes to validate the integrity of its information.

Record keeping

SYSC 14.1.51

handbook-guidance
SYSC 3.2.20 R requires a firm to take reasonable care to make and retain adequate records. The following policy on record keeping supplements SYSC 3.2.20 R by providing some additional rules and guidance on record keeping. The purpose of this policy is to:
(1) facilitate the prudential supervision of a firm by ensuring that adequate information is available regarding its past/current financial situation and business activities (which includes the design and implementation of systems and controls); and
(2) help the PRA to satisfy itself that a firm is operating in a prudent manner and is not prejudicing its safety and soundness or the interests of policyholders.

SYSC 14.1.52

handbook-guidance
In addition to the record keeping requirements in GENPRU, INSPRU and SYSC, a firm should remember that it may be obliged, under other applicable laws or regulations, to keep similar or additional records.

SYSC 14.1.53

handbook-rule
(1) A firm must make and regularly update accounting and other records that are sufficient to enable the firm to demonstrate to the PRA :
(a) that the firm is financially sound and has appropriate systems and controls;
(b) the firm's financial position and exposure to risk (to a reasonable degree of accuracy); and
(c) the firm's compliance with the rules in GENPRU, INSPRU and SYSC.
(2) The records in (1) must be retained for a minimum of three years, or longer as appropriate.

SYSC 14.1.54

handbook-guidance
A firm should be able to make available the records described in SYSC 14.1.53 R within a reasonable timeframe when requested to do so by the PRA .

SYSC 14.1.55

handbook-guidance
The PRA recognises that not all records are specific to a particular point in time. As such, while it may be appropriate to update some records on a daily or continuous basis, for example expenditure and details of certain transactions, it may not be appropriate to update other records as regularly as this, for example those relating to its business plan and risk policies. A firm should decide how regularly it should update particular records.

SYSC 14.1.56

handbook-guidance
A firm should decide which records it needs to hold, noting that compliance with SYSC 14.1.53 R does not require it to hold records on every single aspect of its activities. Some specific guidance on the types of records that a firm should hold is set out in each of the risk specific sections on systems and controls (see SYSC 11, SYSC 12, SYSC 14.1.65 G, SYSC 15 to SYSC 17 and INSPRU 5.1).

SYSC 14.1.57

handbook-guidance
In deciding which records to hold, a firm should also take into account that failure to keep adequate records could make it harder for it to satisfy the PRA that it is compliant with the rules in GENPRU, INSPRU or SYSC, and to defend any enforcement action taken against it.

SYSC 14.1.58

handbook-guidance
A firm should keep the records required in GENPRU, INSPRU and SYSC in an appropriate format and language (in terms of format this could include holding them on paper or in electronic or some other form). However, whatever format or language a firm chooses, SYSC 3.2.20 R requires that records be capable of being reproduced on paper and in English (except where they relate to business carried on from an establishment situated in a country where English is not an official language).

SYSC 14.1.59

handbook-guidance
In accordance with SYSC 3.2.20 R, a firm should retain the records that it needs to comply with SYSC 14.1.53 R for as long as they are relevant for the purposes for which they were made.

SYSC 14.1.60

handbook-rule
A firm must keep the records required in SYSC 14.1.53 R in the United Kingdom, except where:
(1) they relate to business carried on from an establishment in a country or territory that is outside the United Kingdom; and
(2) they are kept in that country or territory.

SYSC 14.1.61

handbook-rule
When a firm keeps the records required in SYSC 14.1.53 R outside the United Kingdom, it must periodically send an adequate summary of those records to the United Kingdom.

SYSC 14.1.62

handbook-guidance
Where a firm outsources the storage of some or all of its records to a third party service provider, it should ensure that these records are readily accessible and can be reproduced within a reasonable time period. The firm should also ensure that these records are stored in compliance with the rules and guidance on record keeping in GENPRU, INSPRU or SYSC. Additional guidance on the management of outsourcing agreements is provided in SYSC 13.

SYSC 14.1.63

handbook-guidance
A firm may rely on records that have been produced by a third party (for example, another group company or an external agent, such as an outsource service provider). However where the firm does so it should ensure that these records are readily accessible and can be reproduced within a reasonable time period. The firm should also ensure that these records comply with the rules and guidance on record keeping in GENPRU, INSPRU or SYSC.

SYSC 14.1.64

handbook-guidance
In accordance with SYSC 3.2.21 G, a firm should have adequate systems and controls for maintaining the security of its records so that they are reasonably safeguarded against loss, unauthorised access, alteration or destruction.

Operational risk

SYSC 14.1.65

handbook-guidance
As well as covering other types of risk, the rules and guidance set out in this chapter deal with a firm's approach to operational risk. In particular:
(1) SYSC 14.1.18 R requires a firm to take reasonable steps to ensure that the risk management systems put in place to identify, assess, monitor and control operational risk are adequate for that purpose;
(2) SYSC 14.1.19R (2) requires a firm to document its policy for operational risk, including its risk appetite and how it identifies, assesses, monitors and controls that risk; and
(3) SYSC 14.1.27 R requires a firm to take reasonable steps to establish and maintain adequate internal controls to enable it to assess and monitor the effectiveness and implementation of its business plan and prudential risk management systems.

Export chapter as

SYSC 15

Credit risk management systems and controls for insurers

SYSC 15.1

Application

  • 31/12/2006

SYSC 15.1.1

handbook-guidance
SYSC 15.1 applies to an insurer unless it is:
(1) a non-directive friendly society; or
(2) an incoming EEA firm; or
(3) an incoming Treaty firm.

SYSC 15.1.2

handbook-guidance
SYSC 15.1 applies to:
(1) an EEA-deposit insurer; and
(2) a Swiss general insurer;


only in respect of the activities of the firm carried on from a branch in the United Kingdom.

SYSC 15.1.2A

handbook-guidance
This section does not apply to an incoming ECA provider acting as such.

Purpose

SYSC 15.1.3

handbook-guidance
This section provides guidance on how to interpret SYSC 14 insofar as it relates to the management of credit risk.

SYSC 15.1.4

handbook-guidance
Credit risk is incurred whenever a firm is exposed to loss if another party fails to perform its financial obligations to the firm, including failing to perform them in a timely manner. It arises from both on and off balance sheet items. For contracts for traded financial instruments, for example the purchase and sale of securities or over the counterderivatives, risks may arise if the firm'scounterparty does not honour its side of the contract. This constitutes counterparty risk, which can be considered a subset of credit risk. Another risk is issuer risk, which could potentially result in a firm losing the full price of a market instrument since default by the issuer could result in the value of its bonds or stocks falling to nil. In insurance firms, credit risk can arise from premium debtors, where cover under contracts of insurance may either commence before premiums become due or continue after their non-payment. Credit risk can also arise if a reinsurer fails to fulfil its financial obligation to repay a firm upon submission of a claim.

SYSC 15.1.5

handbook-guidance
Credit risk concerns the PRA because inadequate systems and controls for credit risk management can create a threat to the statutory objectives of promoting the safety and soundness of PRAauthorised persons and contributing to the securing of an appropriate degree of protection for those who are or may become policyholders by:
(1) the erosion of a firm's capital due to excessive credit losses thereby threatening its viability as a going concern;
(2) an inability of a firm to meet its own obligations to depositors, policyholders or other market counterparties due to its capital erosion.

SYSC 15.1.6

handbook-guidance
Appropriate systems and controls for the management of credit risk will vary with the scale, nature and complexity of the firm's activities. Therefore the material in this section is guidance. A firm should assess the appropriateness of any particular item of guidance in the light of the scale, nature and complexity of its activities as well as its obligation to organise and control its affairs responsibly and effectively.

Requirements

SYSC 15.1.7

handbook-guidance
High level requirements for prudential systems and controls, including those for credit risk, are set out in SYSC 14. In particular:
(1) SYSC 14.1.19R (2) requires a firm to document its policy for credit risk, including its risk appetite and how it identifies, measures, monitors and controls that risk;
(2) SYSC 14.1.19R (2) requires a firm to document its provisioning policy. Documentation should describe the systems and controls that it intends to use to ensure that the policy is correctly implemented;
(3) SYSC 14.1.18 R requires it to establish and maintain risk management systems to identify, measure, monitor and control credit risk (in accordance with its credit risk policy), and to take reasonable steps to ensure that its systems are adequate for that purpose; or
(4) in line with SYSC 14.1.11 G, the ultimate responsibility for the management of credit risk should rest with a firm'sgoverning body. Where delegation of authority occurs the governing body and relevant senior managers should approve and periodically review systems and controls to ensure that delegated duties are being performed correctly.

Credit risk policy

SYSC 15.1.8

handbook-guidance
SYSC 14.1.18 R requires a firm to establish, maintain and document a business plan and risk policies. They should provide a clear indication of the amount and nature of credit risk that the firm wishes to incur. In particular, they should cover for credit risk:
(1) how, with particular reference to its activities, the firm defines and measures credit risk;
(2) the firm's business aims in incurring credit risk including:
(a) identifying the types and sources of credit risk to which the firm wishes to be exposed (and the limits on that exposure) and those to which the firm wishes not to be exposed (and how that is to be achieved, for example how exposure is to be avoided or mitigated);
(b) specifying the level of diversification required by the firm and the firm's tolerance for risk concentrations (and the limits on those exposures and concentrations); and
(c) drawing the distinction between activities where credit risk is taken in order to achieve a return (for example, lending) and activities where credit exposure arises as a consequence of pursuing some other objective (for example, the purchase of a derivative in order to mitigate market risk);
(3) how credit risk is assessed both when credit is granted or incurred and subsequently, including how the adequacy of any security and other risk mitigation techniques is assessed;
(4) the detailed limit structure for credit risk which should:
(a) address all key risk factors, including intra-group exposures and indirect exposures (for example, exposures held by related and subsidiary undertakings);
(b) be commensurate with the volume and complexity of activity; and
(c) be consistent with the firm's business aims, historical performance, and its risk appetite;
(5) procedures for:
(a) approving new or additional exposures to counterparties;
(b) approving new products and activities that give rise to credit risk;
(c) regular risk position and performance reporting;
(d) limit exception reporting and approval; and
(e) identifying and dealing with the problem exposures caused by the failure or downgrading of a counterparty;
(6) the methods and assumptions used for the stress testing and scenario analysis required by GENPRU 1.2 (Adequacy of financial resources), including how these methods and assumptions are selected and tested; and
(7) the allocation of responsibilities for implementing the credit risk policy and for monitoring adherence to, and the effectiveness of, the policy.

Counterparty assessment

SYSC 15.1.9

handbook-guidance
The firm should make a suitable assessment of the risk profile of the counterparty. The factors to be considered will vary according to both the type of credit and the counterparty being considered. This may include:
(1) the purpose of the credit, the duration of the agreement and the source of repayment;
(2) an assessment and continuous monitoring of the credit quality of the counterparty;
(3) an assessment of the claims payment record where the counterparty is a reinsurer;
(4) an assessment of the nature and amount of risk attached to the counterparty in the context of the industrial sector or geographical region or country in which it operates, as well as the potential impact on the counterparty of political, economic and market changes; and
(5) the proposed terms and conditions attached to the granting of credit, including ongoing provision of information by the counterparty, covenants attached to the facility as well as the adequacy and enforceability of collateral, security and guarantees.

SYSC 15.1.10

handbook-guidance
It is important that sound and legally enforceable documentation is in place for each agreement that gives rise to credit risk as this may be called upon in the event of a default or dispute. A firm should therefore consider whether it is appropriate for an independent legal opinion to be sought on documentation used by the firm. Documentation should normally be in place before the firm enters into a contractual obligation or releases funds.

SYSC 15.1.11

handbook-guidance
Where premium payments are made via brokers or intermediaries, the firm should describe how it monitors and controls its exposure to those brokers and intermediaries. In particular, the policy should identify whether the risk of default by the broker or intermediary is borne by the firm or the policyholder.

SYSC 15.1.12

handbook-guidance
Any variation from the usual credit policy should be documented.

SYSC 15.1.13

handbook-guidance
A firm involved in loan syndications or consortia should not rely on other parties' assessment of the credit risks involved. It will remain responsible for forming its own judgement on the appropriateness of the credit risk thereby incurred with reference to its stated credit risk policy. Similarly a firm remains responsible for assessing the credit risk associated with any insurance or reinsurance placed on its behalf by other parties.

SYSC 15.1.14

handbook-guidance
Where a credit scoring approach or other counterparty assessment process is used, the firm should periodically assess the particular approach taken in the light of past and expected future counterparty performance and ensure that any statistical process is adjusted accordingly to ensure that the business written complies with the firm's risk appetite.

SYSC 15.1.15

handbook-guidance
In assessing its contingent exposure to a counterparty, the firm should identify the amount which would be due from the counterparty if the value, index or other factor upon which that amount depends were to change.

Credit risk measurement

SYSC 15.1.16

handbook-guidance
A firm should measure its credit risk using a robust and consistent methodology which should be described in its credit risk policy; the appropriate method of measurement will depend upon the nature of the credit product provided. The firm should consider whether the measurement methodologies should be backtested and the frequency of such backtesting.

SYSC 15.1.17

handbook-guidance
A firm should also be able to measure its credit exposure across its entire portfolio or within particular categories such as exposures to particular industries, economic sectors or geographical areas.

SYSC 15.1.18

handbook-guidance
Where a firm is a member of a group that is subject to consolidated reporting, the group should be able to monitor credit exposures on a consolidated basis. See SYSC 12, INSPRU 6.1 and GENPRU 3.

SYSC 15.1.19

handbook-guidance
A firm should have the capability to measure its credit exposure to individual counterparties on at least a daily basis.

Risk monitoring

SYSC 15.1.20

handbook-guidance
A firm should implement an effective system for monitoring its credit risk which should be described in its credit risk policy.

SYSC 15.1.21

handbook-guidance
A firm should have a system of management reporting which provides clear, concise, timely and accurate credit risk reports to relevant functions within the firm. The reports could cover exceptions to the firm's credit risk policy, non-performing exposures and changes to the level of credit risk within the firm's credit portfolio. A firm should have procedures for taking appropriate action according to the information within the management reports, such as a review of counterparty limits, or of the overall credit policy.

SYSC 15.1.22

handbook-guidance
Individual credit facilities and overall limits should be periodically reviewed in order to check their appropriateness for both the current circumstances of the counterparty and the firm's current internal and external economic environment. The frequency of review should be appropriate to the nature of the facility.

SYSC 15.1.23

handbook-guidance
A firm should utilise appropriate stress testing and scenario analysis of credit exposures to examine the potential effects of economic or industry downturns, market events, changes in interest rates, changes in foreign exchange rates, changes in liquidity conditions and changes in levels of insurance losses where relevant.

Problem exposures

SYSC 15.1.24

handbook-guidance
A firm should have systematic processes for the timely identification, management and monitoring of problem exposures. These processes should be described in the credit risk policy.

SYSC 15.1.25

handbook-guidance
A firm should have adequate procedures for recovering exposures in arrears or that have had provisions made against them. A firm should allocate responsibility, either internally or externally, for its arrears management and recovery.

Provisioning

SYSC 15.1.26

handbook-guidance
SYSC 14.1.19R (2) requires a firm to document its provisioning policy. A firm's provisioning policy can be maintained either as a separate document or as part of its credit risk policy.

SYSC 15.1.27

handbook-guidance
At intervals that are appropriate to the nature, scale and complexity of its activities a firm should review and update its provisioning policy and associated systems.

SYSC 15.1.28

handbook-guidance
In line with SYSC 15.1.6 G, the PRA recognises that the frequency with which a firm reviews its provisioning policy once it has been established will vary from firm to firm. However, the PRA expects a firm to review at least annually whether its policy remains appropriate for the business it undertakes and the economic environment in which it operates.

SYSC 15.1.29

handbook-guidance
In line with SYSC 14.1.12 G, the provisioning policy referred to in SYSC 15.1.26 G must be approved by the firm'sgoverning body or another appropriate body to which the firm'sgoverning body has delegated this responsibility.

SYSC 15.1.30

handbook-guidance
In line with SYSC 14.1.24 G, the PRA may request a firm to provide it with a copy of its current provisioning policy.

SYSC 15.1.31

handbook-guidance
Provisions may be general (against the whole of a given portfolio), specific (against particular exposures identified as bad or doubtful) or both. The PRA expects contingent liabilities (for example guarantees) and anticipated losses to be recognised in accordance with accepted accounting standards at the relevant time, such as those embodied in the Financial Reporting Standards issued by the Accounting Standards Board.

Risk mitigation

SYSC 15.1.32

handbook-guidance
A firm may choose to use various credit risk mitigation techniques including the taking of collateral, the use of letters of credit or guarantees, or counterpartynetting agreements to manage and control their counterparty exposures. The use of such techniques does not obviate the need for thorough credit analysis and procedures. The reliance placed by a firm on risk mitigation should be described in the credit risk policy.

SYSC 15.1.33

handbook-guidance
A firm should consider the legal and financial ability of a guarantor to fulfil the guarantee if called upon to do so.

SYSC 15.1.34

handbook-guidance
A firm should monitor the validity and enforceability of its collateral arrangements.

SYSC 15.1.35

handbook-guidance
The firm should analyse carefully the protection afforded by risk mitigants such as netting agreements or credit derivatives, to ensure that any residual risk is identified, measured, monitored and controlled.

Record keeping

SYSC 15.1.36

handbook-guidance
Prudential records made under SYSC 14.1.53 R should include appropriate records of:
(1) credit exposures, including aggregations of credit exposures, as appropriate, by:
(a) groups of connected counterparties; or
(b) types of counterparty as defined, for example, by the nature or geographical location of the counterparty;
(2) credit decisions, including details of the decision and the facts or circumstances upon which it was made; and
(3) information relevant to assessing current counterparty and risk quality.

SYSC 15.1.37

handbook-guidance
Credit records should be retained as long as they are needed for the purpose described in SYSC 15.1.36 G (subject to the minimum three year retention period). In particular, a firm should consider whether it is appropriate to retain information regarding counterparty history such as a record of credit events as well as a record indicating how credit decisions were taken.

Export chapter as

SYSC 16

Market risk management systems and controls for insurers

SYSC 16.1

Application

  • 31/12/2006

SYSC 16.1.1

handbook-guidance
SYSC 16.1 applies to an insurer unless it is:
(1) a non-directive friendly society; or
(2) an incoming EEA firm; or
(3) an incoming Treaty firm.

SYSC 16.1.2

handbook-guidance
SYSC 16.1 applies to:
(1) an EEA-deposit insurer; and
(2) a Swiss general insurer;


only in respect of the activities of the firm carried on from a branch in the United Kingdom.

SYSC 16.1.2A

handbook-guidance
This section does not apply to an incoming ECA provider acting as such.

SYSC 16.1.3

handbook-guidance
Firms should also see GENPRU 1.2 (GENPRU 1.2.64G to GENPRU 1.2.78G) and INSPRU 3.1.

Purpose

SYSC 16.1.4

handbook-guidance
(1) The purpose of this section is to amplify SYSC 14 insofar as it relates to market risk.
(2) Market risk includes equity, interest rate, foreign exchange (FX), commodity risk and interest rate risk on long-term insurance contracts. The price of financial instruments may also be influenced by other risks such as spread risk, basis risk, correlation, specific risk and volatility risk.
(3) This section does not deal with the risk management of market risk in a group context. A firm that is a member of a group should also read SYSC 12 (Group risk systems and controls) which outlines the PRA's requirements for the risk management of market risk within a group.
(4) Appropriate systems and controls for the management of market risk will vary with the scale, nature and complexity of the firm's activities. Therefore the material in this section is guidance. A firm should assess the appropriateness of any particular item of guidance in the light of the scale, nature and complexity of its activities as well as its obligations to organise and control its affairs responsibly and effectively.

Requirements

SYSC 16.1.5

handbook-guidance
High level requirements for prudential systems and controls, including those for market risk, are set out in SYSC 14. In particular:
(1) SYSC 14.1.19R (2) requires a firm to document its policy for market risk, including its risk appetite and how it identifies, measures, monitors and controls that risk;
(2) SYSC 14.1.19R (4) requires a firm to document its asset and liability recognition policy. Documentation should describe the systems and controls that it intends to use to comply with the policy;
(3) SYSC 14.1.19 R requires a firm to establish and maintain risk management systems to identify, measure, monitor and control market risk (in accordance with its market risk policy), and to take reasonable steps to establish systems adequate for that purpose; and
(4) In line with SYSC 14.1.11 G, the ultimate responsibility for the management of market risk should rest with a firm'sgoverning body. Where delegation of authority occurs the governing body and relevant senior managers should approve and adequately review systems and controls to check that delegated duties are being performed correctly.

Market risk policy

SYSC 16.1.6

handbook-guidance
SYSC 14 requires a firm to establish, maintain and document a business plan and risk policies. They should provide a clear indication of the amount and nature of market risk that the firm wishes to incur. In particular, they should cover for market risk:
(1) how, with particular reference to its activities, the firm defines and measures market risk;
(2) the firm's business aims in incurring market risk including:
(a) identifying the types and sources of market risk to which the firm wishes to be exposed (and the limits on that exposure) and those to which the firm wishes not to be exposed (and how that is to be achieved, for example how exposure is to be avoided or mitigated); and
(b) specifying the level of diversification required by the firm and the firm's tolerance for risk concentrations (and the limits on those exposures and concentrations).

SYSC 16.1.7

handbook-guidance
The market risk policy of a firm should be endorsed by the firm'sgoverning body and implemented by its senior management, who should take adequate steps to disseminate the policy and train the relevant staff such that they can effectively implement the policy.

SYSC 16.1.8

handbook-guidance
The market risk policy of a firm should enforce the risk management and control principles and include detailed information on:
(1) the financial instruments, commodities, assets and liabilities (and mismatches between assets and liabilities) that a firm is exposed to and the limits on those exposures;
(2) the firm's investment strategy as applicable between each insurance fund;
(3) activities that are intended to hedge or mitigate market risk including mismatches caused by for example differences in the assets and liabilities and maturity mismatches; and
(4) the methods and assumptions used for measuring linear, non-linear and geared market risk including the rationale for selection, ongoing validation and testing. Methods might include stress testing and scenario analysis, asset/liability analysis, correlation analysis, Value-at-Risk (VaR) and options such as delta, gamma, vega, rho and theta. Exposure to non-linear or geared market risk is typically through the use of derivatives.

Risk identification

SYSC 16.1.9

handbook-guidance
A firm should have in place appropriate risk reporting systems that enable it to identify the types and amount of market risk to which it is, and potentially could be, exposed. The information that systems should capture may include but is not limited to:
(1) position information which may include a description of individual financial instruments and their cash flows; and
(2) market data which may consist of raw time series of market rates, index levels and prices and derived time series of benchmark yield curves, spreads, implied volatilities, historical volatilities and correlations.

Risk measurement

SYSC 16.1.10

handbook-guidance
Having identified the market risk that the firm is exposed to on at least a daily basis, a firm should be able to measure and manage that market risk on a consistent basis. This may be achieved by:
(1) regularly stress testing all or parts of the firm's portfolio to estimate potential economic losses in a range of market conditions including abnormal markets. Corporate level stress test results should be discussed regularly by risk monitors, senior management and risk takers, and should guide the firm'smarket risk appetite (for example, stress tests may lead to discussions on how best to unwind or hedge a position), and influence the internal capital allocation process;
(2) measuring the firm's exposure to particular categories of market risk (for example, equity, interest rate, foreign exchange and commodities) as well as across its entire portfolio of market risks;
(3) analysing the impact that new transactions or businesses may have on its market risk position on an on-going basis; and
(4) regularly backtesting realised results against internal model generated market risk measures in order to evaluate and assess its accuracy. For example, a firm should keep a database of daily risk measures such as VaR and options such as delta, gamma, vega, rho and theta, and use these to back test predicted profit and loss against actual profit and loss for all trading desks and business units, and monitor the number of exceptions from agreed confidence bands.

Valuation

SYSC 16.1.11

handbook-guidance
A firm should take reasonable steps to establish systems and control procedures such that the firm complies with the requirements of GENPRU 1.3 (Valuation).

SYSC 16.1.12

handbook-guidance
The systems and controls referred to in SYSC 16.1.11 G should include the following:
(1) the department responsible for the validation of the value of assets and liabilities should be independent of the business trading area, and should be adequately resourced by suitably qualified staff. The department should report to a suitably qualified individual, independent from the business trading area, who has sufficient authority to enforce the systems and controls policies and any alterations to valuation treatments where necessary;
(2) all valuations should be checked and validated at appropriate intervals. Where a firm has chosen not to validate all valuations on a daily basis this should be agreed by senior management;
(3) a firm should establish a review procedure to check that the valuation procedures are followed and are producing valuations in compliance with the requirements in this section. The review should be undertaken by suitably qualified staff independent of the business trading area, on a regular and ad hoc basis. In particular, this review procedure should include:
(a) the quality and appropriateness of the price sources used;
(b) valuation reserves held; and
(c) the valuation methodology employed for each product and consistent adherence to that methodology;
(4) where a valuation is disputed and the dispute cannot be resolved in a timely manner it should be reported to senior management. It should continue to be reported to senior management until agreement is reached;
(5) where a firm is marking positions to market it should take reasonable steps to establish a price source that is reliable and appropriate to enable compliance with the provisions in this section on an ongoing basis;
(6) a firm should document its policies and procedures relating to the entire valuation process. In particular, the following should be documented:
(a) the valuation methodologies employed for all product categories;
(b) details of the price sources used for each product;
(c) the procedures to be followed where a valuation is disputed;
(d) the valuation adjustment and reserving policies;
(e) the level at which a difference between a valuation assigned to an asset or liability and the valuation used for validation purposes will be reported on an exceptions basis and investigated;
(f) where a firm is using its own internal estimate to produce a valuation, it should document in detail the process followed in order to produce the valuation; and
(g) the review procedures established by a firm in relation to the requirements of this section should be adequately documented and include the rationale for the policy;
(7) a firm should maintain records which demonstrate:
(a) senior management's approval of the policies and procedures established; and
(b) management sign-off of the reviews undertaken in accordance with SYSC 16.1.11 G.

Risk monitoring

SYSC 16.1.13

handbook-guidance
Risk monitoring is the operational process by which a firm monitors compliance with defined policies and procedures of the market risk policy. The firm's risk monitoring system should be independent of the employees who are responsible for exposing the firm to market risk.

SYSC 16.1.14

handbook-guidance
The market risk policy of a firm may require the production of market risk reports at various levels within the firm. These reports should provide sufficiently accurate market risk data to relevant functions within the firm, and should be timely enough to allow any appropriate remedial action to be proposed and taken, for example:
(1) at a firm wide level, a market risk report may include information:
(a) summarising and commenting on the total market risk that a firm is exposed to and market risk concentrations by business unit, asset class and country;
(b) on VaR reports against risk limits by business unit, asset class and country;
(c) commenting on significant risk concentrations and market developments; and
(d) on market risk in particular legal entities and geographical regions;
(2) at the business unit level, a market risk report may include information summarising market risk by currency, trading desk, maturity or duration band, or by instrument type;
(3) at the trading desk level, a market risk report may include detailed information summarising market risk by individual trader, instrument, position, currency, or maturity or duration band; and
(4) all risk data should be readily reconcilable back to the prime books of entry with a fully documented audit trail.

SYSC 16.1.15

handbook-guidance
Risk monitoring may also include information on:
(1) the procedures for taking appropriate action in response to the information within the market risk reports;
(2) ensuring that there are controls and procedures for identifying and reporting trades and positions booked at off-market rates;
(3) the process for new product approvals;
(4) the process for dealing with situations (authorised and unauthorised) where particular market risk exposures exceed predetermined risk limits and criteria; and
(5) the periodic review of the risk monitoring process in order to check its suitability for both current market conditions and the firm's overall risk appetite.

SYSC 16.1.16

handbook-guidance
Risk monitoring should be subject to periodic independent review by suitably qualified staff.

Risk control

SYSC 16.1.17

handbook-guidance
Risk control is the independent monitoring, assessment and supervision of business units within the defined policies and procedures of the market risk policy. This may be achieved by:
(1) setting an appropriate market risk limit structure to control the firm's exposure to market risk; for example, by setting out a detailed market risk limit structure at the corporate level, the business unit level and the trading desk level which addresses all the key market risk factors and is commensurate with the volume and complexity of activity that the firm undertakes;
(2) setting limits on risks such as price or rate risk, as well as those factors arising from options such as delta, gamma, vega, rho and theta;
(3) setting limits on net and gross positions, market risk concentrations, the maximum allowable loss (also called "stop-loss"), VaR, potential risks arising from stress testing and scenario analysis, gap analysis, correlation, liquidity and volatility; and
(4) considering whether it is appropriate to set intermediate (early warning) thresholds that alert management when limits are being approached, triggering review and action where appropriate.

Record keeping

SYSC 16.1.18

handbook-guidance
High level requirements for record keeping are set out in SYSC 14.

SYSC 16.1.19

handbook-guidance
In relation to market risk, a firm should retain appropriate prudential records of:
(1) off and on market trades in financial instruments;
(2) the nature and amounts of off and on balance sheet exposures, including the aggregation of exposures;
(3) trades in financial instruments and other assets and liabilities; and
(4) methods and assumptions used in stress testing and scenario analysis and in VaR models.

SYSC 16.1.20

handbook-guidance
A firm should keep a data history to enable it to perform back testing of methods and assumptions used for stress testing and scenario analysis and for VaR models.

Export chapter as

SYSC 17

Insurance risk systems and controls

SYSC 17.1

Application

  • 31/12/2006

SYSC 17.1.1

handbook-guidance
SYSC 17.1 applies to an insurer unless it is:
(1) a non-directive friendly society; or
(2) an incoming EEA firm; or
(3) an incoming Treaty firm.

SYSC 17.1.2

handbook-guidance
SYSC 17.1 applies to:
(1) an EEA-deposit insurer; and
(2) a Swiss general insurer;


only in respect of the activities of the firm carried on from a branch in the United Kingdom.

SYSC 17.1.2A

handbook-guidance
This section does not apply to an incoming ECA provider acting as such.

Purpose

SYSC 17.1.3

handbook-guidance
This section provides guidance on how to interpret SYSC 14 (Risk management and associated systems and controls) in so far as it relates to the management of insurance risk. Insurance risk refers to fluctuations in the timing, frequency and severity of insured events, relative to the expectations of the firm at the time of underwriting. Insurance risk can also refer to fluctuations in the timing and amount of claim settlements. For general insurance business some specific examples of insurance risk include variations in the amount or frequency of claims or the unexpected occurrence of multiple claims arising from a single cause. For long-term insurance business examples include variations in the mortality and persistency rates of policyholders, or the possibility that guarantees could acquire a value that adversely affects the finances of a firm and its ability to treat its policyholders fairly consistent with the firm's obligations under the FCA's Principle 6. More generally, insurance risk includes the potential for expense overruns relative to pricing or provisioning assumptions.

SYSC 17.1.4

handbook-guidance
Insurance risk concerns the PRA because inadequate systems and controls for its management can create a threat to the statutory objectives of promoting the safety and soundness of PRA-authorised person and contributing to the securing of an appropriate degree of protection for those who are or may become policyholders. Inadequately managed insurance risk may result in:
(1) the inability of a firm to meet its contractual insurance liabilities as they fall due; and
(2) the inability of a firm to treat its policyholders fairly consistent with the firm's obligations under the FCA's Principle 6 (for example, in relation to bonus payments).

SYSC 17.1.5

handbook-guidance
Guidance on the application of this section to a firm that is a member of a group is provided in SYSC 12 (Group risk systems and controls).

SYSC 17.1.6

handbook-guidance
The guidance contained within this section should be read in conjunction with the rest of SYSC.

SYSC 17.1.7

handbook-guidance
Appropriate systems and controls for the management of insurance risk will vary with the scale, nature and complexity of a firm's activities. Therefore, the material in this section is guidance. A firm should assess the appropriateness of any particular item of guidance in the light of the scale, nature and complexity of its activities as well as its obligations, to organise and control its affairs responsibly and effectively.

General requirements

SYSC 17.1.8

handbook-guidance
High level rules and guidance for prudential systems and controls for insurance risk are set out in SYSC 14. In particular:
(1) SYSC 14.1.18 R requires a firm to take reasonable steps to establish and maintain a business plan and appropriate risk management systems;
(2) SYSC 14.1.19R (2) requires a firm to document its policy for insurance risk, including its risk appetite and how it identifies, measures, monitors and controls that risk; and
(3) SYSC 14.1.27 R requires a firm to take reasonable steps to establish and maintain adequate internal controls to enable it to assess and monitor the effectiveness and implementation of its business plan and prudential risk management systems.

Insurance risk policy

SYSC 17.1.9

handbook-guidance
A firm's insurance risk policy should outline its objectives in carrying out insurance business, its appetite for insurance risk and its policies for identifying, measuring, monitoring and controlling insurance risk. The insurance risk policy should cover any activities that are associated with the creation or management of insurance risk. For example, underwriting, claims management and settlement, assessing technical provisions in the balance sheet, risk mitigation and risk transfer, record keeping and management reporting. Specific matters that should normally be in a firm's insurance risk policy include:
(1) a statement of the firm's willingness and capacity to accept insurance risk;
(2) the classes and characteristics of insurance business that the firm is prepared to accept;
(3) the underwriting criteria that the firm intends to adopt, including how these can influence its rating and pricing decisions;
(4) its approach to limiting significant aggregations of insurance risk, for example, by setting limits on the amount of business that can be underwritten in one region or with one policyholder;
(5) where relevant, the firm's approach to pricing long-term insurance contracts, including the determination of the appropriate level of any reviewable premiums;
(6) the firm's policy for identifying, monitoring and managing risk when it has delegated underwriting authority to another party (additional guidance on the management of outsourcing arrangements is provided in SYSC 13.9);
(7) the firm's approach to managing its expense levels, including acquisition costs, recurring costs, and one-off costs, taking account of the margins available in both the prices for products and in the technical provisions in the balance sheet;
(8) the firm's approach to the exercise of any discretion (e.g. on charges or the level of benefits payable) that is available in its long-term insurance contracts, in the context also of the legal and regulatory constraints existing on the application of this discretion;
(9) the firm's approach to the inclusion of options within new long-term insurance contracts and to the possible exercise by policyholders of options on existing contracts;
(10) the firm's approach to managing persistency risk;
(11) the firm's approach to managing risks arising from timing differences in taxation or from changes in tax laws;
(12) the firm's approach to the use of reinsurance or the use of some other means of risk transfer;
(13) how the firm intends to assess the effectiveness of its risk transfer arrangements and manage the residual or transformed risks (for example, how it intends to handle disputes over contract wordings, potential payout delays and counterparty performance risks);
(14) a summary of the data and information to be collected and reported on underwriting, claims and risk control (including internal accounting records), management reporting requirements and external data for risk assessment purposes;
(15) the risk measurement and analysis techniques to be used for setting underwriting premiums, technical provisions in the balance sheet, and assessing capital requirements; and
(16) the firm's approach to stress testing and scenario analysis, as required by GENPRU 1.2 (Adequacy of financial resources), including the methods adopted, any assumptions made and the use that is to be made of the results.

SYSC 17.1.10

handbook-guidance
Further, more detailed, guidance is given in SYSC 17.1.11 G to SYSC 17.1.37 G on the identification, measurement, monitoring and control (including the use of reinsurance and other forms of risk transfer) of insurance risk. A firm should consider what additional material to that set out above should be included in its insurance risk policy on each of these for its various activities.

Risk identification

SYSC 17.1.11

handbook-guidance
A firm should seek to identify the causes of fluctuations in the occurrence, amount and timing of its insurance liabilities. A firm should also seek to identify aggregations of risk that may give rise to large single or multiple claims.

SYSC 17.1.12

handbook-guidance
The identification of insurance risk should normally include:
(1) in connection with the firm's business plan:
(a) processes for identifying the types of insurance risks that may be associated with a new product and for comparing the risk types that are present in different classes of business (in order to identify possible aggregations in particular insurance risks); and
(b) processes for identifying business environment changes (for example landmark legal rulings) and for collecting internal and external data to test and modify business plans;
(2) at the point of sale, processes for identifying the underwriting risks associated with a particular policyholder or a group of policyholders (for example, processes for collecting information on the claims histories of policyholders, including whether they have made any potentially false or inaccurate claims, to identify possible adverse selection or moral hazard problems);
(3) after the point of sale, processes for identifying potential and emerging claims for the purposes of claims management and claims provisioning; this could include:
(a) identifying possible judicial rulings;
(b) keeping up to date with developments in market practice; and
(c) collecting information on industry wide initiatives and settlements.

SYSC 17.1.13

handbook-guidance
A firm should also identify potential pricing risks, where the liabilities or costs arising from the sale of a product may not be as expected.

Risk measurement

SYSC 17.1.14

handbook-guidance
A firm should have in place appropriate systems for collecting the data it needs to measure insurance risk. At a minimum this data should be capable of allowing a firm to evaluate the types of claims experienced, claims frequency and severity, expense levels, persistency levels and, where relevant, potential changes in the value of guarantees and options in long-term insurance contracts.

SYSC 17.1.15

handbook-guidance
A firm should ensure that the data it collects and the measurement methodologies that it uses are sufficient to enable it to evaluate, as appropriate:
(1) its exposure to insurance risk at all relevant levels, for example, by contract, policyholder, product line or insurance class;
(2) its exposure to insurance risk across different geographical areas and time horizons;
(3) its total, firm-wide, exposure to insurance risk and any other risks that may arise out of the contracts of insurance that it issues;
(4) how changes in the volume of business (for example via changes in premium levels or the number of new contracts that are underwritten) may influence its exposure to insurance risk;
(5) how changes in policy terms may influence its exposure to insurance risk; and
(6) the effects of specific loss scenarios on the insurance liabilities of the firm.

SYSC 17.1.16

handbook-guidance
A firm should hold data in a manner that allows for it to be used in a flexible way. For example, data should be sufficiently detailed and disaggregated so that contract details may be aggregated in different combinations to assess different risks.

SYSC 17.1.17

handbook-guidance
A firm should be able to justify its choice of measurement methodologies. This justification should normally be documented.

SYSC 17.1.18

handbook-guidance
A firm should periodically review the appropriateness of the measurement methodologies that it uses. This could, for example, include back testing (that is, by comparing actual versus expected results) and updating for changes in market practice.

SYSC 17.1.19

handbook-guidance
A firm should ensure that it has access to the necessary skills and resources that it needs to measure insurance risk using its chosen methodology.

SYSC 17.1.20

handbook-guidance
When measuring its insurance risks, a firm should consider how emerging experience could be used to update its underwriting process, in particular in relation to contract terms and pricing and also its assessment of the technical provisions in the balance sheet.

SYSC 17.1.21

handbook-guidance
A firm should have the capability to measure its exposure to insurance risk on a regular basis. In deciding on the frequency of measurement, a firm should consider:
(1) the time it takes to acquire and process all necessary data;
(2) the speed at which exposures could change; and
(3) that it may need to measure its exposure to certain types of insurance risk on a daily basis (for example, weather catastrophes).

Risk monitoring

SYSC 17.1.22

handbook-guidance
A firm should provide regular and timely information on its insurance risks to the appropriate level of management. This could include providing reports on the following:
(1) a statement of the firm's profits or losses for each class of business that it underwrites (with an associated analysis of how these have arisen for any long-term insurance contracts), including a variance analysis detailing any deviations from budget or changes in the key performance indicators that are used to assess the success of its business plan for insurance;
(2) the firm's exposure to insurance risk at all relevant levels (see SYSC 17.1.15G (1)), as well as across different geographical areas and time zones (see SYSC 17.1.15G (2)), also senior management should be kept informed of the firm's total exposure to insurance risk (see SYSC 17.1.15G (3));
(3) an analysis of any internal or external trends that could influence the firm's exposure to insurance risk in the future (e.g. new weather patterns, socio-demographic changes, expense overruns etc);
(4) any new or emerging developments in claims experience (e.g. changes in the type of claims, average claim amounts or the number of similar claims);
(5) the results of any stress testing or scenario analyses;
(6) the amount and details of new business written and the amount of business that has lapsed or been cancelled;
(7) identified fraudulent claims;
(8) a watch list, detailing, for example, material/catastrophic events that could give rise to significant numbers of new claims or very large claims, contested claims, client complaints, legal and other developments;
(9) the performance of any reinsurance/risk transfer arrangements; and
(10) progress reports on matters that have previously been referred under escalation procedures (see SYSC 17.1.23 G).

SYSC 17.1.23

handbook-guidance
A firm should establish and maintain procedures for the escalation of appropriate matters to the relevant level of management. Such matters may include:
(1) any significant new exposures to insurance risk, including for example any landmark rulings in the courts;
(2) a significant increase in the size or number of claims;
(3) any breaches of the limits set out in SYSC 17.1.27 G and SYSC 17.1.28 G, in particular senior management should be informed where any maximum limits have been breached (see SYSC 17.1.29 G); and
(4) any unauthorised deviations from its insurance risk policy (including those by a broker, appointed representative or other delegated authority).

SYSC 17.1.24

handbook-guidance
A firm should regularly monitor the effectiveness of its analysis techniques for setting provisions for claims on general insurance contracts.

SYSC 17.1.25

handbook-guidance
A firm should have appropriate procedures in place to allow managers to monitor the application (and hence the effect) of its reinsurance programme. This would include, for a general insurer, procedures for monitoring how its reinsurance programme affects the gross provisions that it makes for outstanding claims (including claims that are incurred but not reported).

Risk control

SYSC 17.1.26

handbook-guidance
A firm should take appropriate action to ensure that it is not exposed to insurance risk in excess of its risk appetite. In so doing, the firm should be both reactive, responding to actual increases in exposure, and proactive, responding to potential future increases. Being proactive should involve close co-ordination between the processes of risk control, risk identification and risk measurement, as potential future exposures need to be identified and understood before effective action can be taken to control them.

SYSC 17.1.27

handbook-guidance
A firm should consider setting limits for its exposure to insurance risk, which trigger action to be taken to control exposure. Periodically these limits should be amended in the light of new information (e.g. on the expected number or size of claims). For example, limits could be set for:
(1) the firm's aggregate exposure to a single source of insurance risk or for events that may be the result of a number of different sources;
(2) the firm's exposure to specific geographic areas or any other groupings of risks whose outcomes may be positively correlated;
(3) the number of fraudulent claims;
(4) the number of very large claims that could arise;
(5) the number of unauthorised deviations from its insurance risk policy;
(6) the amount of insurance risk than can be transferred to a particular reinsurer;
(7) the level of expenses incurred in respect of each relevant business area; and
(8) the level of persistency by product line or distribution channel.

SYSC 17.1.28

handbook-guidance
A firm should also consider setting individual underwriting limits for all employees and agents that have the authority to underwrite insurance risk. This could include both monetary limits and limits on the types of risk that they can underwrite. Where individual underwriting limits are set, the firm should ensure that they are adhered to.

SYSC 17.1.29

handbook-guidance
In addition to setting some 'normal' limits for insurance risk, a firm should consider setting some maximum limits, beyond which immediate, emergency action should be taken. These maximum limits could be determined through stress testing and scenario analysis.

SYSC 17.1.30

handbook-guidance
A firm should pay close attention to the wording of its policy documentation to ensure that these wordings do not expose it to more, or higher, claims than it is expecting. In so doing, the firm should consider:
(1) whether it has adequate in-house legal resources;
(2) the need for periodic independent legal review of policy documentation;
(3) the use of standardised documentation and referral procedures for variation of terms;
(4) reviewing the documentation used by other insurance companies;
(5) revising documentation for new policies in the light of past experience; and
(6) the operation of law in the jurisdiction of the policyholder.

SYSC 17.1.31

handbook-guidance
A firm should ensure that it has appropriate systems and controls for assessing the validity of claims. This could involve consideration of the evidence that will be required from policyholders and how this evidence is to be tested as well as procedures to determine when experts such as loss adjusters, lawyers or accountants should be used.

SYSC 17.1.32

handbook-guidance
Particular care should be taken to ensure that a firm has appropriate systems and controls to deal with large claims or large groups of claims that could significantly deplete its financial resources. This should include systems to ensure that senior management (that is, the governing body and relevant senior managers) is involved in the processing of such claims from the outset.

SYSC 17.1.33

handbook-guidance
A firm should consider how it intends to use reinsurance or some other form of insurance risk transfer agreement to help to control its exposure to insurance risk. Additional guidance on the use of reinsurance/risk transfer is provided below.

Reinsurance and other forms of risk transfer

SYSC 17.1.34

handbook-guidance
Before entering into or significantly changing a reinsurance agreement, or any other form of insurance risk transfer agreement, a firm should:
(1) analyse how the proposed reinsurance/risk transfer agreement will affect its exposure to insurance risk, its underwriting strategy and its ability to meet its regulatory obligations;
(2) ensure there are adequate legal checking procedures in respect of the draft agreement;
(3) conduct an appropriate due diligence of the reinsurer's financial stability (that is, solvency) and expertise; and
(4) understand the nature and limits of the agreement (particular attention should be given to the wording of contracts to ensure that all of the required risks are covered, that the level of available cover is appropriate, and that all the terms, conditions and warranties are unambiguous and understood).

SYSC 17.1.34A

handbook-guidance
A firm should analyse regularly the full effect of all its reinsurance agreements and other risk transfer agreements (both current and proposed), including any related agreements or side-letters, on both its current and potential future financial position, and ensure that:
(1) all significant risks related to these agreements, and the residual risks borne by the firm, have been identified; and
(2) appropriate risk mitigation techniques have been applied to manage and control the risks.

SYSC 17.1.35

handbook-guidance
In managing its reinsurance agreements, or any other form of insurance risk transfer agreement, a firm should have in place appropriate systems that allow it to maintain its desired level of cover. This could involve systems for:
(1) monitoring the risks that are covered (that is, the scope of cover) by these agreements and the level of available cover;
(2) keeping underwriting staff informed of any changes in the scope or level of cover;
(3) properly co-ordinating all reinsurance/risk transfer activities so that, in aggregate, the desired level and scope of cover is maintained;
(4) ensuring that the firm does not become overly reliant on any one reinsurer or other risk transfer provider; or
(5) conducting regular stress testing and scenario analysis to assess the resilience of its reinsurance and risk transfer programmes to catastrophic events that may give rise to large and or numerous claims.

SYSC 17.1.36

handbook-guidance
In making a claim on a reinsurance contract (that is, its reinsurance recoveries) or some other risk transfer contract a firm should ensure:
(1) that it is able to identify and recover any money that it is due in a timely manner; and
(2) that it makes adequate financial provision for the risk that it is unable to recover any money that it expected to be due, as a result of either a dispute with or a default by the reinsurer/risk transfer provider. Additional guidance on credit risk in reinsurance/risk transfer contracts is provided in INSPRU 2.1 (Credit risk in insurance).

SYSC 17.1.37

handbook-guidance
Where the planned level or scope of cover from a reinsurance/risk transfer contract is not obtained, a firm should consider revising its underwriting strategy.

Record keeping

SYSC 17.1.38

handbook-guidance
The PRA's high level rules and guidance for record keeping are outlined in SYSC 3.2.20 R (Records). Additional rules and guidance are set out in SYSC 14.1.51 G to SYSC 14.1.64 G. In complying with these rules and guidance, a firm should retain an appropriate record of its insurance risk management activities. This may, for example, include records of:
(1) each new risk that is underwritten (noting that these records may be held by agents or cedants, rather than directly by the firm provided that the firm has adequate access to those records);
(2) any material aggregation of exposure to risk from a single source, or of the same kind or to the same potential catastrophe or event;
(3) each notified claim including the amounts notified and paid, precautionary notices and any re-opened claims;
(4) policy and contractual documents and any relevant representations made to policyholders;
(5) other events or circumstances relevant to determining the risks and commitments that arise out of contracts of insurance (including discretionary benefits and charges under any long-term insurance contracts);
(6) the formal wordings of reinsurance contracts; and
(7) any other relevant information on the firm'sreinsurance or other risk-transfer arrangements, including the extent to which they:
(a) have been exhausted by recoveries on paid claims; and
(b) will be exhausted by recoveries on reported claims and, to the extent known, on incurred but not reported claims.

SYSC 17.1.39

handbook-guidance
A firm should retain its underwriting and claims histories for as long as they may be needed to inform pricing or provisioning decisions.

Export chapter as

SYSC 20

Reverse stress testing

SYSC 20.1

Application and purpose

  • 14/12/2010

Application

SYSC 20.1.1

handbook-rule
  1. (1) SYSC 20 applies to:
    1. (a) [deleted]:
      1. (i) [deleted]; or
      2. (ii) [deleted]; or
      3. (iii) [deleted]; and
    2. (b) an insurer unless it is:
      1. (i) a non-directive friendly society; or
      2. (ii) a Swiss general insurer; or
      3. (iii) an EEA-deposit insurer; or
      4. (iv) an incoming EEA firm; or
      5. (v) an incoming Treaty firm.
  2. (2) [deleted]:
    1. (a) [deleted]; or
    2. (b) [deleted]; or
    3. (c) [deleted].
  3. (3) [deleted].
  4. (4) [deleted].

Purpose

SYSC 20.1.3

handbook-guidance
This chapter contains rules on reverse stress testing, which require a firm to identify and assess events and circumstances that would cause its business model to become unviable. This chapter also requires the firm's senior management or governing body to review and approve the results of the reverse stress testing exercise. This should help the firm's senior management to identify the firm's vulnerabilities and design a strategy to prevent or mitigate the risk of business failure.

SYSC 20.1.4

handbook-guidance
The reverse stress testing requirements are an integral component of a firm's business planning and risk management under SYSC and the Risk Control Part of the PRA Rulebook. For firms referred to in SYSC 20.1.1R (1)(a), this chapter amplifies Risk Control in the PRA Rulebook. For insurers as referred to in SYSC 20.1.1R (1)(b), this chapter amplifies SYSC 14.1.17 G to SYSC 14.1.25 G on business planning and risk management.

SYSC 20.1.4A

handbook-guidance

The reverse stress testing requirements are an integral component of a firm's business planning and risk management under SYSC. For insurers as referred to in SYSC 20.1.1R (1)(b), this chapter amplifies SYSC 14.1.17 G to SYSC 14.1.25 G on business planning and risk management.

  • 03/08/2015

SYSC 20.2

Reverse stress testing requirements

  • 14/12/2010

SYSC 20.2.1

handbook-rule
As part of its business planning and risk management obligations under SYSC, a firm must reverse stress test its business plan; that is, it must carry out stress tests and scenario analyses that test its business plan to failure. To that end, the firm must:
(1) identify a range of adverse circumstances which would cause its business plan to become unviable and assess the likelihood that such events could crystallise; and
(2) where those tests reveal a risk of business failure that is unacceptably high when considered against the firm's risk appetite or tolerance, adopt effective arrangements, processes, systems or other measures to prevent or mitigate that risk.

SYSC 20.2.2

handbook-rule
Where the firm is a member of:
(1) an insurance group, in respect of which it is required to maintain group capital;
(2) a UK consolidation group; or
(3) a non-EEA sub-group;
it must conduct the reverse stress test on a solo basis as well as on a consolidated basis in relation to the insurance group, the UK consolidation group or the non-EEA sub-group, as the case may be.

SYSC 20.2.3

handbook-rule
The design and results of a firm's reverse stress test must be documented and reviewed and approved at least annually by the firm's senior management or governing body. A firm must update its reverse stress test more frequently if it is appropriate to do so in the light of substantial changes in the market or in macroeconomic conditions.

SYSC 20.2.4

handbook-guidance
(1) Business plan failure in the context of reverse stress testing should be understood as the point at which the market loses confidence in a firm and this results in the firm no longer being able to carry out its business activities. Examples of this would be the point at which all or a substantial portion of the firm's counterparties are unwilling to continue transacting with it or seek to terminate their contracts, or the point at which the firm's existing shareholders are unwilling to provide new capital. Such a point may be reached well before the firm's financial resources are exhausted.
(2) The appropriate regulator may request a firm to quantify the level of financial resources which, in the firm's view, would place it in a situation of business failure should the identified adverse circumstances crystallise.
(3) In carrying out the stress tests and scenario analyses required by SYSC 20.2.1 R, a firm should at least take into account each of the sources of risk identified in accordance with GENPRU 1.2.30R (2).

SYSC 20.2.5

handbook-guidance
Reverse stress testing should be appropriate to the nature, size and complexity of the firm's business and of the risks it bears. Where reverse stress testing reveals that a firm's risk of business failure is unacceptably high, the firm should devise realistic measures to prevent or mitigate the risk of business failure, taking into account the time that the firm would have to react to these events and implement those measures. As part of these measures, a firm should consider if changes to its business plan are appropriate. These measures, including any changes to the firm's business plan, should be documented as part of the results referred to in SYSC 20.2.3 R.

SYSC 20.2.6

handbook-guidance
In carrying out its reverse stress testing, a firm should consider scenarios in which the failure of one or more of its major counterparties or a significant market disruption arising from the failure of a major market participant, whether or not combined, would cause the firm's business to fail.

SYSC 20.2.7

handbook-guidance
(1) The appropriate regulator may request a firm to submit the design and results of its reverse stress tests and any subsequent updates as part of its risk assessment.
(2) In the light of the results of a firm's reverse stress tests, the appropriate regulator may require the firm to implement specific measures to prevent or mitigate the risk of business failure where that risk is not sufficiently mitigated by the measures adopted by the firm in accordance with SYSC 20.2.1 R, and the firm's potential failure poses an unacceptable risk to the appropriate regulator's statutory objectives.
(3) The appropriate regulator recognises that not every business failure is driven by lack of financial resources and will take this into account when reviewing a firm's reverse stress test design and results.

Export chapter as

SYSC 21

Risk control: additional guidance

SYSC 21.1

Risk control: guidance on governance arrangements

  • 01/05/2011

Additional guidance on governance arrangements

SYSC 21.1.1A

handbook-guidance
References to “firm” in SYSC 21 should be read as excluding CRR firms (other than incoming firms)

Chief Risk Officer

SYSC 21.1.2

handbook-guidance
(1) A Chief Risk Officer should:
(a) be accountable to the firm'sgoverning body for oversight of firm-wide risk management;
(b) be fully independent of a firm's individual business units;
(c) have sufficient authority, stature and resources for the effective execution of his responsibilities;
(d) have unfettered access to any parts of the firm's business capable of having an impact on the firm's risk profile;
(e) ensure that the data used by the firm to assess its risks are fit for purpose in terms of quality, quantity and breadth;
(f) provide oversight and challenge of the firm's systems and controls in respect of risk management;
(g) provide oversight and validation of the firm's external reporting of risk;
(h) ensure the adequacy of risk information, risk analysis and risk training provided to members of the firm's governing body;
(i) report to the firm's governing body on the firm's risk exposures relative to its risk appetite and tolerance, and the extent to which the risks inherent in any proposed business strategy and plans are consistent with the governing body's risk appetite and tolerance. The Chief Risk Officer should also alert the firm's governing body to and provide challenge on, any business strategy or plans that exceed the firm's risk appetite and tolerance;
(j) provide risk-focused advice and information into the setting and individual application of the firm's remuneration policy (Where the Remuneration Code applies, see in particular SYSC 19A.3.15 E. Where the BIPRU Remuneration Code applies, see in particular SYSC 19C.3.15 E). Where the Dual-regulated Remuneration Code applies, see in particular SYSC 19D.2.16E. Where the Remuneration part of the PRA Rulebook applies, see the PRA’s Supervisory Statement on Remuneration).
(2) Firms will need to seek the appropriate regulator's approval for a Chief Risk Officer to perform the systems and controls function (see SUP 10 (Approved persons)).
(3) The appropriate regulator expects that where a firm is part of a group it will structure its arrangements so that a Chief Risk Officer at an appropriate level within the group will exercise functions in (1) taking into account group-wide risks.

[Note: The PRA’s Supervisory Statement on remuneration is available on the PRA website at http://www.bankofengland.co.uk/pra/Pages/default.aspx.]

Reporting lines of Chief Risk Officer

SYSC 21.1.3

handbook-guidance
(1) The Chief Risk Officer should be accountable to a firm'sgoverning body.
(2) The appropriate regulator recognises that in addition to the Chief Risk Officers primary accountability to the governing body, an executive reporting line will be necessary for operational purposes. Accordingly, to the extent necessary for effective operational management, the Chief Risk Officer should report into a very senior executive level in the firm. In practice, the appropriate regulator expects this will be to the chief executive, the chief finance officer or to another executive director.

Appointment of Chief Risk Officer

SYSC 21.1.4

handbook-guidance
(1) Firms should ensure that a Chief Risk Officers remuneration is subject to approval by the firm'sgoverning body, or an appropriate sub-committee.
(2) Firms should also ensure that the Chief Risk Officer may not be removed from that role without the approval of the firm'sgoverning body.

Governing body risk committee

SYSC 21.1.5

handbook-guidance
(1) The appropriate regulator considers that, while the firm'sgoverning body is ultimately responsible for risk governance throughout the business, firms should consider establishing a governing body risk committee to provide focused support and advice on risk governance.
(2) Where a firm has established a governing body risk committee, its responsibilities will typically include:
(a) providing advice to the firm'sgoverning body on risk strategy, including the oversight of current risk exposures of the firm, with particular, but not exclusive, emphasis on prudential risks;
(b) development of proposals for consideration by the governing body in respect of overall risk appetite and tolerance, as well as the metrics to be used to monitor the firm's risk management performance;
(c) oversight and challenge of the design and execution of stress and scenario testing;
(d) oversight and challenge of the day-to-day risk management and oversight arrangements of the executive;
(e) oversight and challenge of due diligence on risk issues relating to material transactions and strategic proposals that are subject to approval by the governing body;
(f) provide advice to the firm'sremuneration committee on risk weightings to be applied to performance objectives incorporated in the incentive structure for the executive;
(g) providing advice, oversight and challenge necessary to embed and maintain a supportive risk culture throughout the firm.
(3) Where a governing body risk committee is established, its chairman should be a non-executive director, and while its membership should predominantly be non-executive it may be appropriate to include senior executives such as the chief finance officer.

SYSC 21.1.6

handbook-guidance
In carrying out their risk governance responsibilities, a firm'sgoverning body and governing body risk committee should have regard to any relevant advice from its audit committee or internal audit function concerning the effectiveness of its current control framework. In addition, they should remain alert to the possible need for expert advice and support on any risk issue, taking action to ensure that they receive such advice and support as may be necessary to meet their responsibilities effectively.

Export chapter as

Transitional Provisions and Schedules

SYSC TP 2

Firms other than common platform firms, insurers, managing agents and the Society

SYSC Sch 1

Record keeping requirements

  • 01/12/2004

SYSC Sch 1.1

handbook-guidance

SYSC Sch 1.2

handbook-guidance

SYSC Sch 2

Notification requirements

  • 01/12/2004

SYSC Sch 2.1

handbook-guidance

SYSC Sch 3

Fees and other required payments

  • 01/12/2004

SYSC Sch 3.1

handbook-guidance

SYSC Sch 6

Rules that can be waived

  • 01/12/2004

SYSC Sch 6.1B

handbook-guidance
As a result of section 138A of the Act (Modification or waiver of rules) the PRA has power to waive all its rules, other than rules made under section 137O (Threshold condition code). However, if the rules incorporate requirements laid down in European directives, it will not be possible for the PRA to grant a waiver that would be incompatible with the United Kingdom's responsibilities under those directives.
  • 01/04/2013

Export chapter as

Back to top