Upcoming Operational Resilience regulations– what is the value for family offices?

Enhancing operational resilience in the UK Family Office sector

Operational Resilience is the ability to prevent, adapt, respond to, recover and learn from operational disruptions. Operational disruptions and the unavailability of important services have the potential to harm to those using those services.

It is the assumption that disruptions are a matter of ‘when’, and not ‘if’, that the regulators are focussing on, and FCA and PRA regulated Boards are sitting up and taking the incoming Operational Resilience regulations due at the end of this quarter very seriously. But is there anything for family offices to learn from these regulations?

This concept of operational resilience is not new and making sure family members are receiving key services as and when they need them is a top priority, and this is much wider that keeping the investment processes running smoothly. What would happen if the family office was not able fund any key purchases for 24 hours? Or communication channels (e.g. e-mail database) were down to prevent authorisation of payments? Are there alternative ways to provide the family with services and liquidity to respond to their needs? How quickly can these workarounds be put in place? Would it affect individual family members to differing levels?

The regulations have brought fresh thinking to operational resilience, starting with the concept of causing ‘intolerable harm’ – i.e. if the most important services cannot be provided for a period of time. The concept of a family member’s tolerance for lack of provision of key services will be well understood and keenly felt, but how advanced is the understanding of the level of tolerance differing by service or family member? What is required to provide that service? And critically - what are the alternative ways to provide that service if things go wrong?

Traditional continuity practices have tended to focus on how to recover individual resources the business uses, like IT systems or buildings. But the shift in thinking now starts with the service being provided, understanding what is critical to make that possible, and also understanding the various alternatives available to enable provision of that service. This paints a more holistic picture of operational resilience.

The operational resilience of the family office as a stand-alone entity is not in isolation however. The vast majority of family offices will outsource at least one key service (payroll, HR, finance, custodianship of investments), with many operating a much more complex model of outsourcing.

The question of resilience is therefore not just about the processes within the “four walls” of the family office. It is critical also to consider:

• How good is the operational resilience of the third parties used to deliver these key services?
• How quickly can they recover from their own operational failures?
• Do any of the third parties rely themselves on other parties to help deliver their services (4^th parties)?
• How long are some of those third party service chains?
• Would it be possible to find an alternative third party provider in an acceptable timeframe?

Whilst we would be the first to recognise that the majority of family offices are not required to comply with this regulation; this is one standard where a proactive approach to adapting those principles will have clear benefits to the ultimate users of the family office – the family.

By adopting the rigours of this approach, the family office can be confident that they are doing all they can to ensure ongoing stability over the provision of the services they deem to be the most important to the family (with any break of service being within tolerable, and pre-determined and agreed levels), whatever the world throws at them in 2021.