FSB updates the guidance on arrangements to support operational continuity in resolution

Since the original publication of the guidance in 2016, the topic of digitalisation has become increasingly important, which is why the Financial Stability Board is adding a section to the guidance in this regard.

During the digitalisation of the financial services sector, financial institutions have increased their dependence on third-party providers to support critical services in recent years. In this context, the Finance Stability Board (FSB) conducted a review in 2023 to assess the application of the guidance on arrangements to support operational continuity in resolution in a digital context where financial institutions are increasingly reliant on third-party providers.

The results of the review showed that the existing requirements continue to be appropriate in principle. However, the increasing use of digital services could pose particular problems for financial institutions when implementing Operational Continuity and Resolution (OCIR) arrangements.

The FSB notes that banks' increasing reliance on third-party providers and the digitalisation of services may cause a disruption of critical services to trigger resolution or impede the resolution process itself.

Financial institutions should be sufficiently familiar with and monitor the services provided by third parties. In line with the guidance, measures to improve operational continuity in connection with the digitalisation of services should take into account both the impact on business continuity and on resolution.

The FSB cautions that greater use of third-party providers and a further spread of digital services could lead to greater complexity in terms of OCIR.

Data storage: Data storage may increasingly be shared between several firms, e.g. when using cloud services. In a resolution scenario, this can lead to uncertainties regarding the ownership of the data or uncertainties regarding access to the data.

Supply chains: Services may involve more complex and increasingly specialised supply chains, as some third-party providers are in turn dependent on other IT providers. This could significantly increase the complexity of service models, leading to additional potential challenges in the case of resolution.

The more complex structure of third-party providers means that switching service providers is more difficult. As a result, contractual terms and conditions are increasingly important, not only for third-party providers but also for the entire network of service providers. Institutions should, for example, be aware of the connections between several subcontractors and also take them into account for OCIR.

Due to increasingly complex systems and simultaneously simplified digital networks, there are fewer, larger service providers on the market. This makes it more difficult to substitute services, which can have an impact on costs. This effect is amplified by tailored solutions.

Institutions should analyse which systems are difficult to substitute and ensure the operational continuation of these systems in the event of resolution.

Similarly, access to data held by third-party providers or service providers (either locally or in the cloud) should also be ensured in the event of resolution. To this end, potential restrictions on access rights should also be analysed, taken into account and, if necessary, circumvented in order to be able to access critical systems and data during resolution.

For further details, please refer to FSB’s press release.

If you have any questions, please contact our experts.

Tim Schabert

Alexander Schiller

Bernhard Pechlaner