The Bank of England has fined Vocalink £11,900,000 for compliance failures under section 196 of the Banking Act 2009.
This is the first time the Bank has fined a financial market infrastructure firm. Vocalink has been regulated by the Bank since April 2018 as a specified service provider, a type of financial market infrastructure firm involved in the operation of UK payments systems.
Vocalink was required by the Bank to remediate a number of identified systems and controls issues. Vocalink implemented a remediation programme in response and had until 28th February 2022 to comply with the requirements. However, the Bank of England says an ineffective risk management framework, combined with weaknesses in its controls, governance arrangements and escalation processes meant that it failed to comply in full with the requirements by the deadline.
The Bank’s investigation identified the root cause of Vocalink’s non-compliance was the failure to have in place a sufficiently integrated risk management framework. This would have ensured that risks facing the programme could be properly understood, monitored and shared amongst the three lines of defence (and external assurance providers). It also found there were failures to escalate key risks and information to senior committees. The Bank considers Vocalink’s governance arrangements fell below the standards expected of a financial market infrastructure firm.
The firm has since invested significantly in remediating the issues and co-operated throughout the investigation, resulting in a 15% reduction to the penalty. Vocalink agreed to resolve the matter and therefore qualified for a further 30% reduction in the fine. Without these reductions, the fine imposed by the Bank would have been £20,000,000.
Sarah Breeden, deputy governor for financial stability at the Bank of England, said: “Vocalink fell short of its obligation to have adequate risk management and governance arrangements when responding to the Bank’s direction. Its failure to comply with that direction in full has resulted in a significant fine.”
James Dickie, financial services partner with law firm CMS, commented: “This is the first instance of the Bank fining a financial market infrastructure firm and shows the increased regulatory focus on raising the standards of third parties critical to UK markets. The Bank has sought to focus on the greatest exposures to systemic risk and expects key firms to have robust controls in place to mitigate the likelihood of disruption to the vital payment, settlement, and clearing services they provide.”
