First, we plan next year to enhance the Security Requirements in the CRM to align to the globally recognised National Institute of Standards and Technology (NIST) Cybersecurity Framework.8 The new requirements would align with NIST’s principles of Identify, Protect, Detect, Respond and Recover, and will be more outcome focused, balanced with prescriptive requirements when necessary. This will increasingly enable Direct Participants with different resources and business models to apply their own methodology to comply, thus supporting our strategy to allow a diverse range of financial institutions to use CHAPS. Second, the CHAPS rulebook clearly defines the Bank’s expectations around Direct Participants’ incident management approaches and reporting obligations. As I mentioned earlier, the FCA has observed a significant increase in technology-related outages across the financial industry. And for the first eight months of 2019, there were around half a dozen CHAPS Direct Participant incidents a month. The CHAPS rulebook provides an effective and timely means to manage risks through a focused root cause analysis, assignment of appropriate remediation plans and trend analysis to inform our assessment of the risks to the end-to-end CHAPS system. In line with the FCA’s analysis of incident reports,9 we have found that weaknesses in how changes are managed is a key driver behind nearly half of all CHAPS participant incidents. We are therefore revising the controls that Direct Participants should have in place in order to target areas that have contributed to incidents, for example, single-input of static data.

We actively support the design of, and participate in, a number of market wide exercises to explore coordination in the unlikely event of a major outage to the retail systems, or participants’ connections to the retail systems. SIMEX16 focused on a multi-day outage to RTGS and SIMEX18 focused on a protracted operational outage of a Global Systemically Important Bank; a summary report of SIMEX18 was published last month.15 Next month, we will participate in a desktop exercise to explore the impact of large scale rerouting of payments between CHAPS and Faster Payments. These exercises are sponsored by a Cross Market Operational Resilience Group which is co-chaired by UK Finance and the PRA. The Bank and Pay.UK are also exploring a potential solution for allowing batches of critical retail payments to settle directly over the renewed RTGS infrastructure, whilst ensuring critical wholesale payments are not impacted. This solution could help the FPC’s pilot impact tolerance be met for retail payments in the unlikely event of a major outage to the retail systems. Providing additional channels for retail payments to settle in a contingency situation increases the resiliency of the whole financial system, making it even less likely that users will experience a delay to their salaries, pensions, or other time sensitive payments. The Bank is planning to introduce ISO 20022, an international standard for financial messaging, for CHAPS. Pay.UK also plan to introduce ISO 20022 in their New Payments Architecture: together we are developing what is known as a Common Credit Message.