Dear CEO Letter - Change Management and Resourcing

The FCA view on Change Management

Recently, we have seen the FCA focus more heavily on firms’ approach to operational resilience, and the appropriate resourcing allocated to regulatory change activity. In the FCA’s most recent Portfolio Letter, addressed to CEOs, the FCA repeated their concerns in this space.

In this letter, the FCA discussed the potential harm to both consumers and market integrity from operational disruption and, after their engagement in 2023 on compliance with PS21/3 Building Operational Resilience, reiterated key observations relating to weaknesses in mapping of impact tolerances and risk identification, and ongoing testing for each important business service.

Key points to note:

1.      The FCA has acknowledges that firms are likely facing challenges from the large amount of regulatory change initiatives that are current and planned. They also note that several firms are starting cost-cutting programmes to remediate falling AUM (both attracting new and retaining).

2.      The FCA notes that cost cutting programmes create a risk of firms being inadequately resourced to manage transformation programmes, strategic developments (e.g. M&A) on top of the busy regulatory change agenda – which is their key priority for consumer protection and market integrity.

3.      The FCA will be assessing how firms’ governance and resourcing of change programmes have considered and mitigated this risk (particular reference to Sustainable Disclosure Requirements [SDR] implementation and preparation for complying with PS21/3 Building Operational Resilience) to establish how firms are prepared. The aim is to ensure firms appropriately address potential harms to investors and markets.

The FCA acknowledges that Policy changes should lead to good consumer outcomes and that the implementation of such significant regulatory initiatives (e.g., SDR, and the Overseas Funds Regime) will be observed by the FCA as test cases.

Key dates:

In relation to PS21/3, by the 31^st of March 2025, in-scope firms must have performed mapping and testing which demonstrates they can remain within impact tolerances for each of their ‘important business services’. In addition, they must evidence the necessary investment to enable their firm to operate consistently within such impact tolerances.

So, what does this mean for firms?

1.      It’s your responsibility: The FCA acknowledges that firms may be struggling to balance P&L due to market conditions, but there is no slack being given where firms do not adequately resource their regulatory change initiatives. Firms should consider that each programme is resourced appropriately, and any risk of delivery failure should be assessed, managed, and mitigated – the Board require effective oversight of these programmes and risks.

2.      Assess your risk: Whilst cost-cutting may have an impact on the overall programme of change activity, the FCA still have a strong expectation that regulatory programmes are delivered appropriately. Any risk of delivery failure should be assessed, managed, and mitigated – the Board require effective oversight of these programmes and risks. A structured exercise should be considered and reported to the Board.

3.      The SDR test-case: The largest regulatory development, aside from the ongoing embedding of Consumer Duty, will be the introduction of SDR – the UK’s sustainable finance regime. Even where firms do not have sustainable products, there is still a requirement to assess and adhere to the new Rules. We expect that the FCA will engage with firms through supervisory activity to assess the progress of SDR delivery. Firms should pay particular attention to ensuring that a robust impact assessment has been conducted, programme governance is appropriate, and the board has clarity on delivery targets.

4.      Operational Resilience is ongoing: The requirement to ‘live and breathe’ operational resilience has not gone away, and firms should be spending time on ensuring that the next deliverables for PS21/3 are met by the May 2025 deadline. Given the breadth of the requirements, this is not a small undertaking and planning should be undertaken as soon as possible!

Our key takeaway:

Firms need to be aware of the FCA’s ongoing monitoring of change activity and be able to evidence that good consumer outcomes are being met.

We believe that firms should consider the FCA’s Dear CEO letter and conduct a review of current change activity, change resourcing, and any risks, mitigations, and actions. Boards should be provided with evidence relating to change activity aligned to the review. The report should be used to evidence that key activities are being not neglected due to cost cutting exercises, or other strategic developments.

Further information:

The IA published a guide on “Operational Resilience: Severe but plausible scenarios” in March 2024, which considers how firms can effectively calibrate their operational resilience scenario testing. They are further conducting a benchmarking survey, closing 31st May 2024, in lieu of the 31^st of March 2025 deadline to comply with PS21/3.

How can Devlin Mambo help?

We have been working with our clients to effectively deliver change programmes of various size and complexities. By considering our clients’ unique business models and initiatives we design and plan change roadmaps that ensure consistency across delivery workstreams, clear resource requirements, and assist in minimising budget uncertainty.