September 30, 2020
Prudential Regulation Authority
Financial Conduct Authority
Bank of England
Japanese Bankers Association

JBA comments on the UK Consultation Papers on strengthening the OperationalResilience
Dear Sir / Madam
The Japanese Bankers Association (JBA) appreciates the opportunity to provide comments on the UK Consultation
Papers on CP 29/19 “Operational resilience: Impact for important business services” and related CP30/19“Outsourcing and third party risk management” issued by the Prudential Regulation Authority (PRA), CP
19/32“Building operational resilience: impact tolerances for important business services” issued by the FinancialConduct Authority (FCA) and consultation papers on Operational Resilience: Central Counterparties/CentralSecurities Depositories and Recognized Payment System Operators and Specified Service Providers issued by Bankof England (BoE) 1 (collectively, the Proposals, and we hereby refer to PRA, FCA and BoE collectively as the UK
supervisory authorities).
The JBA is the leading trade association for banks, bank holding companies and bankers associations in Japan 2. Major
banking groups of our member banks have subsidiary banks and/or branches in the United Kingdom (the UKoperations), primarily engaged in the wholesale banking business. While the Proposals aim to improve the operational
resilience of the UK financial sector, the JBA recognizes that the Proposals will not only be applied to those UKoperations, but could also potentially impact on the global operations of our member banks outside of the UK as
discussed below. The JBA therefore would like to share our views on the Proposals as well as suggestions foramendments to the Proposals 3.

I. General Comments
Principles- and risk-based approach
As a general comment, the JBA supports the principles- and risk-based approach that the Proposals have taken, rather
than a prescriptive or standardized approach, considering the fact that the expected operational resilience of a bankcould vary by its type of businesses and their importance in the UK financial system. The JBA recognizes that banks
are inherently responsible for ensuring their important services be operationally resilient in view of the public natureof the banks’ business and for maintaining the banks’ credibility 4 . COVID-19 pandemic also highlighted theimportance of operational resilience. The scale and impact of the pandemic, across different geographies and sectors,
demonstrated that firms everywhere need to be prepared for disruption events. Given that operational resilience is
not merely a compliance issue, but rather all efforts made to achieve the above objectives, the frameworks for
operational resilience should give banks flexibility to their practice and approach as far as they can achieve the sameoutcome. The JBA expects that the principles- and risk-based approach be kept in mind in the actual supervisory
practices.

1

PRA: https://www.bankofengland.co.uk/prudential-regulation/publication/2018/building-the-uk-financial-sectors-operational-resilience-discussion-paper
https://www.bankofengland.co.uk/prudential-regulation/publication/2019/outsourcing-and-third-party-risk-management

FCA: https://www.fca.org.uk/publications/consultation-papers/cp-19-32-building-operational-resilience-impact-tolerances-important-business-services
BOE: https://www.bankofengland.co.uk/paper/2019/operational-resilience-of-fmis
2
As of September 30, 2020, the JBA has 117 Full Members (banks), 3 Bank Holding Company Members (bank holding companies), 72 Associate
Members (banks & bank holding company), 58 Special Members (regionally-based bankers associations) and one Sub-Associate Member for a total of251 members.
3More detailed comments on the Proposals can be found in the IIF/GFMA’s joint letter, which includes the comments by our member banks.
4For instance, Japanese banks have been improving the level of their operational resiliency through conducting regular exercises of the business
continuity plan and assessing its effectiveness. In such practice, Japanese banks (i) assume a wide range of crisis events (natural disasters, terrorist
attacks, pandemics, computer viruses, etc.), (ii) identify high-priority operations for each crisis event, and (iii) develop a business continuity plan witha target recovery period, commensurate with the level of importance of the services.

1Implementation date and consistency with the BCBS Principle
The UK requirements of operational resilience should be fully consistent with the BCBS’s principles (the BCBSPrinciple)5 and be implemented in line with the timeline of the BCBS Principles. For internationally active banks,
the UK operations are a part of the banking group and are subject to its global operational resilience policy if thebanking group has it. In such case, the JBA believes that the operational resilience of the UK operations can be more
effective and comprehensive as ensured by the group governance (group-wide approach) rather than where theoperations solely comply with the UK requirements. If the UK operations are required to comply with the UK
requirements segregated from the group policy due to the fragmentary requirements, it, in turn, could weaken theoperational resilience of UK operations and pose unreasonable regulatory burdens for the UK operations. We would
like the UK supervisory authorities to clarify that foreign bank branches are not subject to the Proposals.
In addition, if there are discrepancies between the UK requirements and the home country's regulatory andsupervisory framework based on the BCBS Principles, the supervisory framework of the home country authorities
should supersede others. The UK operations should be allowed to comply with the UK requirements by adopting theglobal policy based on the BCBS Principles as a part of the group and then addressing the gaps between the global
policy and the UK requirements. Given that the BCBS published the consultative document on principles foroperational resilience, it should be avoided to fragmentarily impose the UK requirements to the UK operations. TheJBA recommends that the UK requirements of operational resilience be fully consistent with the BCBS Principles, atleast with respect to the objectives, definition and fundamental frameworks of operational resilience. While theproposed rule is to be applied after the end of 2021, the final UK rules and guidance should allow for the necessary
flexibility in timelines, in line with the BCBS Principles so that the firms can implement the appropriate controls
and responses, taking into account the prolonged impact of the COVID -19.
Notwithstanding our general support for the overall objectives of the Proposals, the JBA believes that the UKsupervisory authorities should give further consideration to the following points, and suggests several amendments
to the Proposals to ensure that operational resilience is effective without posing undue regulatory burdens.

II. Specific comments
The principle of proportionality
The substitutability of the bank’s activities should be included in the factors to determine the proportionality. The
draft operational resilience requirements are set to be proportionate to the nature, scale and complexity of the banks’
activities as per 3.2 and 5.3 of the draft PRA rulebook. The JBA believes that the provisions are reasonable to avoid
undue burdens to the banks, particularly to banks with a limited presence in the UK financial system. It is, however,not clear whether the substitutability of the bank’s activities can be taken into account in determining the importanceof the bank’s business services and impact tolerances. Even if an operational disruption occurs, it does not necessarily
pose risks to the UK financial stability where the business services the bank provides are likely to be substituted byother banks within a reasonable time. The JBA therefore suggests explicitly including substitutability into theproportionality factors, if it is warranted by, for instance, the observations of the past operational incidents across theUK financial sector.
The firm’s safety and soundness should be separated from the factors to determine the importance of the bank’sbusiness services. The draft operational resilience requirements suggest (1) the stability of the UK financial system;or (2) the firm’s safety and soundness for the factors to determine the importance of the business services, as per
paragraph 2.3 of the draft PRA rulebook. However, the firm’s safety and soundness affected by operational incidents
have been already captured under the capital requirements for operational risk 6 where banks are required to maintainadequate capital against potential operational losses. Further, the revised capital requirements for operational risk(Basel III) will be implemented in 2023, which the Japanese banks will be required to meet at the consolidated level,including their UK operations. It seems to overlap if firm’s safety and soundness are factored in determining theimportance of the business services. Even if these factors are to be included, it should be clarified as to what kind of
5

The consultative document was published on August 6th, 2020, by the Basel Committee on Banking Supervision (BCBS) on principles for operationalresilience.
6
Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.

2

risks that are not captured under the capital requirements is intended to be captured and why.

Strategies, Processes and systems
Strategies, Processes and systems should be flexible as long as the same outcomes can be achieved. As per paragraph
3.1 of the draft PRA rulebook, banks are required to put in place sound, effective and comprehensive strategies,processes and systems; namely (1) identify its important business services, (2) set an impact tolerance for each
important business service and (3) identify and address any risks to remain within their impact tolerances by carrying
their scenario testing. While the JBA agrees that they are key attributes to ensure the operational resilience and oneof the ideal practices, the JBA believes that the process to ensure effective operational resilience is not limited to theway proposed. A number of practices already exist to ensure the operational resilience of banks, including voluntary
frameworks in view of the public nature of the business of banks and for the purposes of maintaining the banks’credibility. In some cases, the same outcomes of operational resilience may be achievable by the different processes,
such as (1’) set stress scenarios as a starting point; (2’) identify business services potentially disrupted under such
scenarios, and then (3’) mitigate potential operational disruptions. The process should therefore be flexible (shouldnot be mandatory) for banks, and a “fill-in-gap” approach between the existing practices and the requirements should
also be allowed, as long as they can assure the same degree of operational resilience. In terms of this process, we also
expect the adequate communication and coordination with authorities.

Impact tolerance
To remain flexibility, setting impact tolerances by recovery phase should be allowed as options. The JBA agrees thatan impact tolerance is generally represented as the maximum time for which the bank can tolerate disruption to an
important business service, given the expectation of stakeholders of banks for the recovery within a reasonable time.
In our view, however, given that the recovery is practically achieved over time by substitute operations (including
manual operations) and/or step-by-step remediation (e.g. by area or certain customer category), setting impact
tolerances by recovery phase is more realistic and practical. For instance, when full disruption of a system occurs,
impact tolerance is set as 80% recovery within 12 hours, 90% within 24 hours, and full (100%) recovery within 48hours 7. The JBA believes that this approach is in line with the objectives of the operational resilience frameworks.

Scenario testing
It should be clarified that going beyond the impact tolerances may be allowed for extreme incidents. The JBA agrees
with the view of the UK supervisory authorities that the scenario to use for the test should be “severe but plausiblescenarios”. It allows banks to focus their efforts on achieving the objectives of operational resilience without posing
undue burdens under unrealistic extreme scenarios. The JBA also supports the view that “plausibility could beconsidered by modelling incidents or near misses that have occurred within a firm’s organisation, across the financial
sector, or in other sectors and jurisdictions”. It is, however, not clear what the text “there will be extreme scenarios
where firms find they could not deliver a particular important business service within their impact tolerance” means.
The JBA believes that it is neither proportionate nor appropriate to require banks to stay within their impact tolerancein such extreme scenarios if it is solely attributable to external parties and uncontrollable for banks. The JBA therefore
requests to explicitly clarify that it is possible for boards and senior management to go beyond the impact tolerances,even if banks need to consider in advance what the bank could do in such extreme circumstances.

Outsourcing agreements
The example of “the contractual arrangements allowing the continuity of the access to the services for a transitional
period following termination” should be deleted. In Chapter 10.13 of the draft supervisory statement (SS) ofoutsourcing and third party risk management 8, banks are encouraged to “actively consider temporary measures that
can help ensure the ongoing provision of important business services following a disruption and/or a stressed exit,
even if these are not suitable long-term solutions, e.g. contractual arrangements allowing for continued use of aservice or technology for a transitional period following termination”. Given that the stressed exit is, by its definition,a circumstance where the service provider is no longer viable (failed or insolvent), the JBA believes that suchcontractual agreements would not work effectively as expected in most cases. The JBA suggests deleting the example
78The hours of impact tolerances are solely illustrative.
CP30/19 “Outsourcing and third party risk management” issued by PRA

3

of such contractual agreements in order to avoid confusion, or at the very least it should be clarified that suchagreement is not mandatory to be included in the contractual agreements with third parties.
In Chapter 9 of the draft SS of outsourcing and third party risk management expects firms to oversight complex ormaterial sub-outsourcing arrangements and Chapter 9.2 shows the examples of dependencies of service providers.
The JBA believes that the scope of sub-contractors for oversight should be limited to the sub-contractors notified byservice providers.

Intra-group outsourcing
Substitute compliance and/or mutual equivalence recognition that are confirmed between regulators should beprovided for intra-group outsourcing. For internationally active banks, there are a number of cases where the businessservices of the UK operations rely on group functions outside of the UK to some extent. The JBA is concerned that
the Proposals contain several provisions that could potentially have extraterritorial effects to those entities outside ofthe UK. For instance, Chapter 3.6 of the draft SS of outsourcing and third party risk management requires banks toensure that the outsourced service (intra-group outsourcing) is provided in compliance with the UK legal andregulatory requirements. Even if the entities outside of the UK are subject to the requirements of operational resiliencein the jurisdictions where the entities are located, it cannot be assumed that the requirements are fully consistent with
the UK requirements without any discrepancies on a line-by-line basis. While the JBA can understand the objectivesof the provisions, it should be avoided that those provisions are applied in a way to lead to market fragmentation andoperational localization in the UK. The JBA therefore recommends adding substitute compliance and/or mutual
equivalence recognition as a backstop to mitigate potential extraterritorial effects. In particular, the insourcing intragroup entities that are subject to the BCBS Principles should be regarded as entities complying with the UK
requirements.

(End)4