Facilitating continuity in Securities Services
Firstly, providers need to identify their important business services. These are overwhelmingly customer-facing banking activities, which if they were to go down would cause serious market-wide disruption. Richard Pounder, Global Head of Securities Services, Operational Resilience Risk at HSBC, said that within securities services, this includes global custody, sub-custody, transfer agency [TA], FX and fund services. “Custody is at the centre of securities services and it is one of our biggest product offerings. In the case of TA – outages there can have a significant effect on retail investors. Even disruption in fund servicing processes such as NAV production can have a direct client impact and adversely affect markets,” he said.
At this point, providers need to perform stress testing to determine whether or not their services and systems are resilient. Such tests, said Pounder, need to mimic severe but plausible crisis events. For example, he said a typical stress test scenario might involve dealing with a technology outage while simultaneously managing a pandemic or extreme weather conditions at a critical IT centre. “Testing is done to the nth degree and impact tolerance is tested to the limit. Providers need business continuity processes in place which are commercially sensible but operationally resilient,” he stressed. In addition to demonstrating their own internal operational resilience, regulators and clients want assurances that financial institutions have systems in place to handle failures at their outsourced providers and IT vendors. “We continuously review and test our third party providers’ resilience. We do not just accept third party assurance reports saying everything is okay. Instead, we will meet up regularly with our providers to validate that they have effective safeguards designed to mitigate any disruption,” said Peter Scrivener, director of technology risk assessment at HSBC. He added risk assessments need to factor in the possibility that an outage at a third party may last for up to several months. “Banks should think outside of the box. They need to ask themselves whether they could replicate a service from scratch using offline copies in the event of long-term downtime,” said Scrivener. This scrutiny comes following several high profile technology outages and cyber-attacks, the latter being something that has skyrocketed during the pandemic. In order to mitigate cyber-risks, Pounder noted banks are increasingly collaborating with each other and sharing intelligence threats.
