COVID-19 has led to a widespread disruption of business processes as financial institutions attempt to deliver government initiatives aimed at supporting the economy through this crisis.
In particular, banks have had to implement new services and processes in a short space of time and, while welcomed by the business and retail community, such rapid response programmes can also create unexpected operational risks.
The Financial Conduct Authority (FCA) has stated: “We expect firms to manage the risks to consumers and to provide support to consumers and businesses during these challenging times.” Paul Young, a managing director in finance, risk and compliance, asks:
are you managing these risks effectively?
have you reviewed operational risk frameworks that support these new activities?
have you considered the impact they will have on your business functions, to establish effective oversight and the mitigation of any emerging or heightened risks?
Maintaining effective oversight
In a number of situations firms have moved resources from support functions – or have engaged with external providers – to assist with operational and business-related activities, to support the large volume of new lending applications, trading activities and customer debt relief initiatives. While this is a necessary and pragmatic requirement, it could impact oversight and control processes related to issues such as anti-money laundering, financial crime, market abuse, treating customers fairly (deliberate or accidental), operational infrastructure, cyber and GDPR.
The Senior Managers and Certification Regime (SM&CR) aims to mitigate these risks by ensuring critical functions are appropriately resourced. However, given the extreme situation most firms are facing, working to the letter of SM&CR may prove problematic. Recognising this, the FCA has introduced greater flexibility within SM&CR during this crisis, which could also raise governance risks and oversight challenges.
Reducing the risk of mis-selling
Government initiatives aim to provide short-term relief to customers and businesses, but without clear communication programmes and impacted resources, there is potential for deliberate or innocent mis-selling outcomes, such as: perceived unfair credit assessments, lending practices, pricing, repayment requirements and additional collateral requests.
The following initiatives have been put in place to lessen the effect of coronavirus on both consumers and businesses. However, each has the potential to result in negative outcomes for customers if not appropriately managed and communicated across the organisation:
Mortgage holidays: Banks have agreed to give customers experiencing financial difficulties mortgage holidays of up to three months. At the end of the payment holiday, borrowers will be required to agree with the lender a manageable way to make up the missed payments. Lenders are required by the FCA to ensure that there is no additional fee or charge (other than additional interest) to the customer.
Payment freeze: The FCA has placed expectations on firms to offer a temporary payment freeze for up to three months on loans and credit cards, where consumers face difficulties with their finances. The FCA requires firms to make sure that all overdraft customers are no worse off on price when compared to the prices they were charged before the recent overdraft changes came into force. Firms must also make sure consumers using any of these temporary measures should not have a negative impact on their credit rating.
Covid Corporate Financial Facility (CCFF): A joint fiscal measure from the Bank of England and the HM Treasury, CCFF is designed to support liquidity among larger firms, helping them to bridge coronavirus disruption on their cash flows through the purchase of short-term debt in the form of commercial paper.
Coronavirus Business Interruption Loan Scheme (CBILS): A scheme run by the British Business Bank, allowing eligible firms to apply through participating lenders. CBILS is intended for small and medium-sized enterprises.
Term Funding Scheme: A Bank of England scheme offering four-year funding to incentivise banks to provide credit to businesses and households to bridge them through this period of economic disruption.
To implement the above initiatives, banks should consider the following steps to mitigate the potential for the development of emerging risks:
maintain full step-by-step documentation of all credit assessments, to include all decisions taken and the supporting justification as an audit trail
establish detailed documentation to cover government schemes, and all others that amend credit assessments and facilities
implement guidelines to demonstrate how the firm has interpreted the initiatives, and how these guidelines are being applied consistently across the business
include appropriate addendums to the original credit facility
practise appropriate governance and oversight processes, with consideration of where this may need to be heightened or supplemented
review all firm activities through the lens of hindsight to ensure that actions could not be construed as mis-selling, unfair pricing, unfair credit assessments or unbalanced lending assessments
evaluate trading activities over all platforms and assess the requirement for enhanced oversight to mitigate issues as they arise
establish frequent re-reviews of valuations and model validations to ensure models are performing as intended and valuations reflect market reality
create appropriate monitoring of operational risks in support functions given additional pressures created by increased trading volumes and lending activities
develop enhanced monitoring programmes for risk, compliance and internal audit functions covering newly identified and escalated risks emanating from significant business practice changes.
What to do now?
Firms should build appropriate monitoring programmes along with resourcing plans. These could be enhanced by developing a list of key individuals, who will be supported by appropriate resources and subject matter experts, to provide effective oversight of these government programmes.
Firms should also consider:
enhanced management information mechanisms to track key performance indicators related to transaction volumes, credit assessments and debt holidays, along with customer complaints, IT and operational stresses
clear communication plans and execution actions around client take-on, vulnerable customer assessments, repayment programmes and horizon scanning using hindsight lenses placed on decisions taken now
applying enhanced monitoring techniques to reduce the risks for Market Abuse Regulation, anti-money laundering and financial crime
firms should create communication plans to instil good conduct, best practice and desired behaviour in their frontline employees, which should outline acceptable and unacceptable customer interactions
with increased risks around cyber attacks and phishing, firms should increase the frequency of their cyber monitoring to track uptake in attempted breaches and leverage penetration testing to identify vulnerabilities.
For further help and information on these issues, please contact Paul Young.