Guidance

SS1/21 – Operational resilience: Impact tolerances for important business services

Chapter

Groups

Printed on: 12/09/2024

Rulebook at: 31/03/2022

9

Groups

9.1

The PRA expects CRR consolidation entities (in the case of UK banking groups) or an insurer (in the case of UK insurance groups) to identify a proportionate number of important group business services and respective impact tolerances at the level of the group.[35] Taking a group level view of operational resilience ensures the risks arising in parts of the group that are not subject to the individual requirements, are taken into account.

  • 35. CRR consolidation must comply with Operational Resilience Part Rules 8.6 to 8.13 by no later than Thursday 30 June 2022.
  • 31/03/2022

9.2

When identifying important group business services, the PRA expects CRR consolidation entities and insurers to consider disruption to services in other entities within the group which could transmit risk directly to the safety and soundness of the CRR firm (or CRR firms) or insurer, or alternatively could transmit risk to the safety and soundness of the CRR firm (or CRR firms) or the insurer via the group. This includes, for example, where the relevant group has a subsidiary outside the UK providing a service to customers, which could, if disrupted, pose a risk to:

  • for CRR consolidation entities, the safety and soundness of any CRR firm in the CRR consolidation entity’s consolidation group or, where relevant, UK financial stability;
  • for insurers, the firm’s safety and soundness, policyholder protection or, where relevant, UK financial stability.
  • 31/03/2022

9.3

Impact tolerances should be set in the same way as they are for an individual firm[36]. Boards and senior management should consider the level of disruption that would represent a threat to the CRR firm or insurer, for example, via a threat to the viability of the group and therefore pose a risk to financial stability of the UK, a firm’s safety and soundness, or (in the case of PRA-regulated insurers) there being an appropriate degree of protection for those who are or may become the firm’s policyholders.

  • 36. The PRA expectations regarding the setting of impact tolerances are detailed in Chapter 3 of this SS.
  • 31/03/2022

9.4

The PRA expects that, in complying with the Operational Resilience Part[37], the CRR consolidation entity would have regular dialogue with other members of its group so the CRR firm (or CRR firms) can take account of any additional risks to their safety and soundness when assessing their ability to remain within impact tolerance for their own important business services.

  • 37. Operational Resilience 8.8
  • 31/03/2022

9.5

The PRA expects firms to work with other members of their group to take action, should it be likely that a relevant important group business service could not be delivered within its impact tolerance. Firms are required to cover analysis of risks arising from elsewhere in the group in their self-assessments.

  • 31/03/2022