• Key areas of the risk-based approach to AML / CTF, long identified as being weak, are still found to be requiring improvement, particularly among smaller firms.
• The FCA’s continued monitoring of the application of UK AML / CTF regulations has resulted in two ‘Dear CEO’ letters, addressed to operators within the retail banking and trade finance businesses: The first highlighted ongoing weaknesses in governance and oversight, enterprise-wide risk assessments (EWRA), customer risk assessments (CRA), customer and enhanced due diligence (CDD / EDD), and transaction monitoring (TM). The second letter highlighted issues with EWRAs, as well as counterparty analysis, and transaction approval and payments.
• More recently (April 2022), the FCA has published an AML / CTF review of UK Challenger Banks, who are typically more reliant on smarter technology and IT systems for client onboarding and risk management. This report highlighted findings around CRA, CDD / EDD, Suspicious Activity Report (SAR) submissions and TM alert management. The report also identified issues with the appropriate implementation of financial crime change programmes and Challenger Banks failing to notify the FCA about any control failures as required under a Principle 11 notification.
• Since March 2022, the US, UK, and the EU, have expanded Sanctions on an unprecedented scale and scope as a result of the Russian invasion of Ukraine. These measures have had a significant impact on companies’ Sanctions risk management frameworks, compounded by the introduction of a ‘strict liability civil offence’ for Sanctions breaches under the Economic Crime Act 2022. Under these rules, there are significant fines for non-compliance and the possibility of companies being ‘named and shamed’ even when no penalty is imposed.
• The FCA’s 2022/23 Business Plan has highlighted that financial crime reduction will be achieved through an increase in authorisation rejections on the basis of non-compliance with Money Laundering Regulations (MLRs) or for financial crime reasons. This forms part of a wider focus on reducing the impact of fraud on society, which the FCA will achieve through improved supervision and proactive assessments of firms’ anti-fraud systems and controls.
• The FCA has also flagged that its efforts into supervising crypto assets firms’ compliance with the MLRs will be ongoing, and sanctions imposed swiftly, where firms are found to be posing harm to consumers or market integrity.

• Russia and Ukraine Conflict: For those organisations with direct exposure to Russia, exiting a formerly important market to comply with Sanctions may lead to substantial losses. Geopolitical uncertainty has also been a driver in the stock market sell-off that has resulted in significant recent falls in some indices. In trying to smooth over the adverse impact of Sanctions or appease shareholder expectations, firms might be incentivised to “improve” results therefore creating the risk of financial statements fraud.
• Cost of Living: High energy and commodity costs have added to the ongoing supply chain crisis, a convergence that has contributed to increasing levels of inflation. Reduced consumer spending will result in many businesses experiencing cash shortfalls. Inflation also diminishes corporate profits as the value of money decreases. Such factors heighten the risk of fraud through the fabrication of revenues, questionable forecasting, as well as insider fraud by employees whose salaries will not match the high inflation and increasing living costs.
• ISA 240 Revision: Effective December 2021, the Financial Reporting Council (FRC) issued its revised ISA 240. The updated standard seeks to clarify the external auditor’s role and objectives in identifying fraud with a focus on enhanced professional skepticism. Enhancements include more detail regarding the identification and assessment of risk, while also addressing the inherent challenges audits face particularly where management are colluding in fraud. An example includes the need for whistleblowing policies to enable employees to disclose concerns about actual or suspected fraud.
• FCA Business Plan 2022/2023: The FCA published in April 2022 its three-year strategy for 2022-2025 setting out the outcomes for consumers and markets in the UK. Positioning its strategy on three themes or focus areas, one of its commitments is on “reducing and preventing serious harm”. Amongst the outcomes it wants to achieve is in slowing the growth in investment fraud and Authorised Push Payment (APP) fraud cases. It will also deal with problem firms unable to meet its minimum standards, for instance, those with weak controls that are particularly vulnerable to fraudsters.
• Online Safety Bill: Included in the wide-ranging bill are proposals to tackle scams on user-generated platforms such as social media and search engine companies. Example content includes romance scams, fake stock market tips and other fraudulent advertising. Regulatory oversight from Ofcom will include ensuring businesses have systems in place to prevent scams and that financial promotions are only made by FCA authorised firms.

Regulatory Framework Developments:

• Markets in Crypto-Assets (MiCA) is a new framework that is under development by the EU that aims to regulate crypto assets and service providers to enhance financial stability around these products. It is expected that the UK will develop a similar framework going forward. To date the BoE and FCA have issued guidance around digital assets use and several warnings around its volatility.
• Due to the nature of the assets (anonymity), Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) compliance controls are critical and which UK businesses must comply with. Most countries have a registry where entities participating in crypto activities must apply to or register. Part of the challenge within the EU is that each Member State has a different system thereby making passporting rights inaccessible for businesses. It is anticipated that MiCA will help solve this.
• To further safeguard consumers, several changes are expected in the regulation of Financial Promotions for UK businesses and how these products can be marketed.

Cryptocurrency / Digital Assets Adoption:

• The UK has announced they want to be the Technological Hub for Digital Assets (April 2022) and have stated their intention to regulate Stablecoins. It is also acknowledged that the framework would have to account for the risk that some Stablecoins pose. As such, HMRC has suggested amending the ‘FMI SAR’ to deal with failed Stablecoins (FMI SAR gives the BoE powers to oversee and direct the actions of a payment firm to ensure that their services continue in the event of a failure.  
• Two US Senators have issued a bill to establish a crypto regulatory framework, setting out that the Commodity Futures Trading Commission (CFTC) would play a primary role in regulating products.

Prudential Regulation Authority (PRA) Dear CEO Letter (March 2022):

• The letter sets out the PRA’s expectations that Banks and designated Investment firms consider the full prudential frameworks when assessing Digital Assets, along with Pillar 1 and Pillar 2 guidance. 
• The PRA proposes that firms should apply a punitive treatment to Digital Assets under the Pillar 1 framework. These firms also need to include their assessment of how crypto risks affect prudential risk categories in their Internal Capital Adequacy Assessment Process (ICAAP). 
• The letter provides a degree of short to medium term regulatory clarity for firms building a Digital Assets Strategy in advance of the finalised BASEL Committee Crypto Prudential Framework. 

Regulatory Framework Developments:

• Markets in Crypto-Assets (MiCA) is a new framework that is under development by the EU that aims to regulate crypto assets and service providers to enhance financial stability around these products. It is expected that the UK will develop a similar framework going forward. To date the BoE and FCA have issued guidance around digital assets use and several warnings around its volatility.
• Due to the nature of the assets (anonymity), Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) compliance controls are critical and which UK businesses must comply with. Most countries have a registry where entities participating in crypto activities must apply to or register. Part of the challenge within the EU is that each Member State has a different system thereby making passporting rights inaccessible for businesses. It is anticipated that MiCA will help solve this.
• To further safeguard consumers, several changes are expected in the regulation of Financial Promotions for UK businesses and how these products can be marketed.

Cryptocurrency / Digital Assets Adoption:

• The UK has announced they want to be the Technological Hub for Digital Assets (April 2022) and have stated their intention to regulate Stablecoins. It is also acknowledged that the framework would have to account for the risk that some Stablecoins pose. As such, HMRC has suggested amending the ‘FMI SAR’ to deal with failed Stablecoins (FMI SAR gives the BoE powers to oversee and direct the actions of a payment firm to ensure that their services continue in the event of a failure.  
• Two US Senators have issued a bill to establish a crypto regulatory framework, setting out that the Commodity Futures Trading Commission (CFTC) would play a primary role in regulating products.

Prudential Regulation Authority (PRA) Dear CEO Letter (March 2022):

• The letter sets out the PRA’s expectations that Banks and designated Investment firms consider the full prudential frameworks when assessing Digital Assets, along with Pillar 1 and Pillar 2 guidance. 
• The PRA proposes that firms should apply a punitive treatment to Digital Assets under the Pillar 1 framework. These firms also need to include their assessment of how crypto risks affect prudential risk categories in their Internal Capital Adequacy Assessment Process (ICAAP). 
• The letter provides a degree of short to medium term regulatory clarity for firms building a Digital Assets Strategy in advance of the finalised BASEL Committee Crypto Prudential Framework. 

• The Markets in Financial Instruments Regulation (MiFIR) has now been in effect since 2018 but resulted in significant changes on transaction reporting, including expanding the volume of in-scope instruments as well as expanding the number of data fields, to the extent that some firms are still finding it challenging over four years later. 
• The European Securities and Markets Authority (ESMA) issued a statement outlining some planned changes to their validation rules in Q2 2022, and although the FCA is not planning to follow suit there is the possibility that this may change in the future. The FCA regularly provide updates on issues related to transaction reporting via their Market Watch publications, which provides additional information on their concerns in this space and highlights areas upon which  firms should focus.

The UK Government published its highly anticipated consultation on its Review of Solvency II during April 2022. The proposals form part of wider changes proposed by the Government to the UK’s financial services regulatory framework, and broadly aim to achieve two key objectives – 1. free up Insurers’ capital to enable investment in green infrastructure and projects and 2. maintain the UK’s competitiveness by going “further and faster to capitalise on the UK’s Brexit freedoms and level up the country”. The Prudential Regulation Authority (PRA) has also published its own discussion paper (DP2/22 – Potential Reforms to Risk Margin (RM) and Matching Adjustment (MA) within Solvency II) complementing the Government’s proposal. The PRA is seeking the industry’s views around the reform options for RM and in particular, the calibration of the fundamental spread (FS) within the MA. The Government’s proposed reforms aim to unlock significant investment by Insurers into UK infrastructure, venture capital and growth equity, and other long-term productive assets, as well as investment consistent with the Government’s climate change objectives. This is one of the ways the Government is capitalising on its post-Brexit freedom, ensuring that UK regulations are tailored to the needs of the UK economy, rather than the needs of 28 countries across the European Union (EU).

The consultation sets out detail on the proposed reforms, including:

• A substantial reduction in the RM of around 60-70 percent for long-term Life Insurers based on a cost of capital approach;
• A reassessment of the FS used in the calculation of the MA;
• An additional Credit Risk Premium (CRP) to the FS to capture the uncertainty around the expected loss within FS;
• More flexibility to MA eligibility rules for both the asset universe and the liabilities to which an MA can be applied;
• A reduction in the EU-derived regulations which make up the current reporting and administrative burden; and
• The combined impact of the RM and FS reforms has been estimated by the PRA to result in a release of up to 10-15 percent capital currently held by Life Insurers.

The PRA’s Discussion Paper (DP) outlines its assessment of the proposed reforms for RM and the MA and discusses the potential combinations of reforms to the FS and RM in line with statutory objectives. Both the PRA’s DP and the UK Government’s consultation closed for responses on 21 July 2022. While the consultation and DP continue to remain largely silent on the impact of these changes on the Solvency CR to materially change as a result of the FS changes. The PRA has launched a Data Collection Exercise to further explore this. The PRA also hints that a move to a new calculation mechanism may be phased in over a period of time giving firms and the PRA more time to reflect any required changes within the Internal Model.

With such large RM reductions on the horizon, Life Insurers should consider re-evaluating their approach to:

• Product strategy and pricing – certain products may now be more economically viable to write (particularly in conjunction with proposed changes to MA liability eligibility), enabling more favourable pricing for policyholders;
• Deploying the capital released from the RM reductions – the Government is keen that this is used to support further investment in long-term assets and growth in the insurance market, rather than increasing dividends;
• Hedging – driven by the change in the sensitivity of the RM and consequentially the balance sheet to movements in interest rates;
• Reinsurance strategies and risk appetite – demand for longevity risk transfer could reduce or there could be a shift in reinsurance strategies towards the greater use of fully funded reinsurance; and
• Risk mitigation to maintain policyholder protection – there is a need for firms to employ appropriate risk mitigation techniques. This is in line with current practice where firms are required to conform to the Prudent Person Principle (PPP).

The first key regulatory deadline has now passed as of 31 March 2022 - Operational Resilience should remain a key priority and an area of focus for Internal Audit. Firms need to demonstrate that a full assessment of their Operational Resilience has been completed, vulnerabilities have been identified, and there is a focus on the remediation activities to complete in order to demonstrate that Important Business Services can operate within their impact tolerance by no later than 31 March 2025.

Amongst the broader suite of activity required to continue on the Operational Resilience journey, the following areas are likely to be key focus and challenge for Boards and senior management over the next three years:

• Scenario Stress Testing: Testing is likely to be the key area of Operational Resilience policy expectations which continue to evolve throughout the period up to 31 March 2025, as firms gain experience in the stress testing necessary, and the Regulators assess and feedback on the approaches being followed.
• Third Party Risk Management: Third party dependencies pose a significant threat to a firm’s operational resilience. Visibility, oversight, and assurance is imperative to adequately understand and manage the risks posed by third party and outsourced arrangements (including technology giants and those responsible for providing IT services). Boards and senior management cannot outsource their ultimate accountability and responsibility for their Operational Resilience and therefore need to gain assurance over the risks posed by the web of third and fourth parties in the service chain, especially when the service being provided is critical in providing a firm’s Important Business Service.
• Transition to Business As Usual (BAU): As firms look to build longevity in their Operational Resilience framework and transversal capabilities, embedding Operational Resilience across the organisation will transform meeting the 2025 policy requirements and expectations into sustainable BAU activity.

Where smaller businesses are not required to currently comply with Operational Resilience-related regulatory requirements, some businesses are challenging themselves on how Operational Resilience is achieved through existing controls in place, with proportionate enhancements taking place to identify important business services and map this to resources in place, e.g. technology, data, people, processes, suppliers and facilities.

Artificial Intelligence (AI) is becoming increasingly common in business processes throughout the Financial Services (FS) sector. FS firms deploy AI across multiple service lines and are now harnessing its power in areas such as compliance, fraud detection, resume screening, credit scoring, product pricing and product recommendations, to name a few. Despite its growing use, we have seen that senior management is often unaware of exactly where and how and also the nature and extent of the risks faced by their organisation in relation to the use of AI. Moreover, Regulators are becoming increasingly active in their efforts to protect consumers from algorithmic harms such as bias that leads to discriminatory or unfair outcomes, outputs that mislead consumers or distort competition, and the collection of personal data that infringes on privacy rights. Thus, the growing use of AI systems in the FS sector requires an increased awareness of the risks inherent in those systems and an improved ability to manage those risks. This requires formalising an AI risk management framework and ensuring that teams in the Second and Third Lines of Defence have the required skills, knowledge and experience to be able to independently assess and provide assurance over the effectiveness of the AI control framework.

• The UK Government published its ten-year strategy on AI during September 2021. The strategy has three main pillars:
  1. Investing in and planning for the long-term needs of the UK’s AI ecosystem.
  2. Supporting diffusion of AI throughout the UK economy.
  3. Ensuring that the UK adopts an appropriate approach to the regulatory and governance framework for AI.
• On 8 December 2022, the Centre for Data Ethics and Innovation (CDEI) published its roadmap to an effective AI assurance ecosystem outlining their vision for AI assurance. The CDEI will publish an AI assurance guide to accompany the roadmap which will focus in more detail on the delivery of AI assurance and support practitioners using or providing AI assurance services. The CDEI will also partner with professional bodies and Regulators to set out requirements for AI systems and establish an AI Standards Hub, focused on global digital technical standards.
• The development of AI assurance is further supported by the Information Commissioner’s Office (ICO). The ICO is developing an AI Auditing Framework (AIAF) which is intended to help AI assurance practitioners with tools and procedures for their assurance work. They are also planning to issue guidance on AI and data protection to assist organisations with their understanding of AI.
• The ICO, the Financial Conduct Authority (FCA), the Competition and Market Authority (CMA) and the Office of Communications (Ofcom) have joined forces in the Digital Regulation Cooperation Forum (DRCF) to address concerns about a lack of consistency and the overlapping nature of regulatory mandates and to promote dialogue on the types and sources of algorithmic harms, provide policy recommendations for AI systems auditing and assurance, and coordinate the supervision of AI systems.
• In October 2020, the Bank of England and the FCA launched the AI Public Private Forum (AIPPF) to facilitate dialogue between the public and private sectors to understand better the use and impact of AI in FS and on 17 February 2022, the AIPPF’s final report was published, focusing on the role of data, model risk and governance in the adoption and use of AI in FS.