For regulated firms, a key question is whether any precautionary measures (e.g. office absences or travel restrictions) or other practical consequences (e.g. supply chain disruptions) arising from the novel coronavirus will affect business continuity and the firm’s ability to comply with regulatory requirements.
Key points to consider are:
- whether the firm’s business continuity plan appropriately caters for the disruption, e.g. by reallocating relevant responsibilities between employees and setting out procedures for remote working. This may need to include an alternative key man policy where appropriate to address the risk of individuals discontinuing their functions for prolonged periods;
- whether the firm is equipped to manage any technology risk that may arise from the precautionary measures, e.g. where a large number of employees work remotely;
- whether there is any impact on the firm’s ability to service customers (e.g. due to the absence of employees in customer-facing functions), and if so, whether customers should be notified;
- whether the firm’s order execution policy is equipped to handle liquidity shortfalls in the market (e.g. due to stock exchange closures), e.g. by redirecting the execution of orders and settlement of transactions to alternative venues;
- whether the firm’s prudential and conduct risk management framework appropriately addresses any recalibration of the firm’s business focus (e.g. towards hedging activities for clients and own account). Banks should also consider whether to build up their reserves to protect against shocks;
- whether the firm’s relevant exposures (e.g. to Chinese credits, transport stocks, and other balance-sheet items which may be affected by supply-chain disruptions) successfully withstand stress-testing, based on a range of pandemic-based scenarios. For retail banks, these may need to include the scenario of limited access to ATMs and tellers, leading to cash liquidity shortfalls and payment defaults;
- whether any changes to the firm’s operations trigger an obligation to notify the regulator (e.g. if they have a material adverse impact on the ability of the firm to conduct its business, or result in notifiable staff changes).
To the extent that the above factors are not adequately addressed in the firm’s existing control framework, it is advisable for additional measures and processes to be agreed upon at board / senior management level, and where appropriate, documented in a risk-appropriate contingency plan.
We are continuing to monitor the impact of the novel coronavirus on the financial sector and will provide further updates on material developments as appropriate.