Paul Howard provides an overview of what the PRA wants banks to focus on in 2024
As we step into the uncertainties of 2024, the Prudential Regulation Authority (PRA) has laid out crucial focus areas for the UK banking sector. In a recent letter to bank Chief Executives, the PRA emphasised reinforcing governance, risk management and controls to meet the challenges of an ever-evolving landscape.
- Governance and risk management:
The PRA underscores the importance of robust governance structures, urging boards and executives to continuously evaluate their frameworks. Highlighting the potential for sudden loss of confidence, the PRA stresses the need for proactive risk identification, assessment, and mitigation. Boards are encouraged to foster a risk culture that supports prudent decision-making, diversity, and inclusivity. That might sound like ‘so what?’, but it can be easy to forget that banking is inherently risky. The failure of two US banks in 2023, and the forced take-over of Credit Suisse by UBS, are recent lessons in that.
- Novel risks and technology:
Recognising the rapid growth in technology usage, the PRA wants firms to consider novel risks arising from technologies like distributed ledger technologies and generative AI. The emphasis is on imaginative scenario planning, including extreme tail events, to enhance risk management practices.
- Holistic risk management and controls:
Recent reviews reveal that some firms still approach risk management in silos. The PRA urges a holistic view, considering cross-business impacts. Counterparty credit risk and secured financing risks, especially with non-bank financial institutions, are highlighted. The PRA stresses the importance of firms evolving their risk management frameworks to tackle changing macro environments and emerging technologies.
- Financial resilience:
When the global macroeconomic outlook is uncertain, financial resilience becomes paramount. Firms are advised to manage their financial resilience amid factors like declining inflation, high-interest rates, and geopolitical tensions. The PRA emphasizes the importance of stress testing, realistic contingency plans, and monitoring credit portfolios. Attention is also drawn to upcoming changes such as the implementation of Basel 3.1 standards.
- Climate-related financial risks:
The PRA reiterates the growing importance of managing the financial risks associated with climate change. Firms are expected to integrate processes to identify, measure, and mitigate these risks. The PRA calls for tailored stress scenarios and enhanced efforts in aligning climate-related financial risk management with decision-making processes.
- Operational resilience:
With the deadline approaching, the PRA reminds firms of the need to meet Operational Resilience Requirements by March 2025. At that point firms must be able to demonstrate that they can remain within agreed impact tolerances for all their designated Important Business Services (“IBS”). Boards and senior management are urged to actively oversee operational resilience programs. Cyber-related disruptions are highlighted as a critical scenario to be considered in tests. The PRA emphasizes the importance of managing third-party relationships and the impact of outsourcing.
- Data risk and accurate regulatory reporting:
Submitting complete, timely, and accurate regulatory returns remains foundational. The PRA emphasizes the importance of robust data, governance, systems, and production controls related to regulatory reporting. Firms are encouraged to take remedial action based on feedback and to maintain a strong focus on regulatory reporting.
No firm should be complacent. Errors in regulatory returns continue to be a significant concern. The PRA’s ongoing skilled persons reviews of regulatory reporting across a significant sample of firms have repeatedly identified deficiencies in controls over data, governance, systems, and production controls. These deficiencies increase the risk of inaccurate reporting, which can have far-reaching implications.
In particular, errors and resubmissions may result in supervisory intervention by way of Section 166 Skilled Person Reviews. This mechanism empowers the PRA to appoint an external expert to investigate and report on specific issues within a firm, adding an additional layer of scrutiny and potential disruption. So, firms should consider correct submissions as more than just a regulatory obligation. Getting it right should be seen as a proactive measure to maintain the integrity of their reporting and mitigate the risk of supervisory intervention.
Because of the impact that errors in regulatory reporting can have, the PRA emphasizes the need for firms to consider feedback seriously and take corrective action. The targeted use of supervisory tools, including skilled persons where appropriate, reinforces the PRA’s commitment to ensuring the accuracy and reliability of regulatory reporting.
As firms navigate the complexities of 2024, addressing data risks and enhancing regulatory reporting capabilities should be a top priority. The PRA’s emphasis on this area is a clear signal that accurate and timely reporting is fundamental to the stability and resilience of the financial system.
Conclusion
In conclusion, the PRA’s 2024 priorities emphasize the critical need for adaptability, preparedness, and a comprehensive approach to risk management. As banks navigate a dynamic environment, the PRA’s guidance serves as a compass, guiding them toward a resilient and robust future. The challenges ahead necessitate a holistic view, embracing technological advancements, climate-related risks, and the ever-growing importance of operational and data resilience.
The PRA’s letter serves not only as a roadmap for the year but as a call for proactive engagement and continuous improvement within the banking sector.
Paul Howard is an Associate of the Chartered Institute of Bankers and is on the board of BACB plc as a Non Executive Director and Chairman of the Audit Committee. Paul spent much of his 40-year career as a Chief Risk Officer holding approved person status with the regulatory authorities for risk roles in the UK, USA and Middle East.