Risk management and wind-down planning at e-money and payments firms – multi-firm review

Effective risk management frameworks promote financial resilience by identifying and assessing risks, and quantifying the resources needed to cover them. They allow senior managers to be better informed when making decisions. This, in turn, supports firms’ sustainable growth.

All firms have made a start at implementing our expectations, for example, embedding elements of stress testing in risk management. But frameworks are generally inadequate for the level and complexity of activities firms undertake or not mature enough to support informed decision-making. We encourage firms to review FG20/1, which outlines our expectations of good practice in risk management.

We identified 3 main areas of improvement for firms’ risk management frameworks: enterprise-wide risk management frameworks, liquidity risk management, and consideration of group risk. 

We saw that: 

Good practice

We saw elements of the following good practice, but at differing levels across firms reviewed.

Enterprise-wide risk management framework

• Embedding risk management fundamentals in FG20/1.
• Risk management frameworks that are commensurate with the complexity and scope of activities, enabling firms to identify and document material risks specific to their business model.
• Using the risk management framework to support informed decision-making.
• Establishing a risk appetite agreed at board level, reviewed at least annually, with quantitative elements calibrated through risk assessment and stress testing.
• Having an enterprise-wide view of risk, rather than a siloed approach.
• Holding financial resources that are proportionate to the activities of the firm and its risk profile, not just the minimum regulatory requirement.
• Using stress testing to understand business vulnerabilities and potential losses in relevant scenarios, as well as using stress testing to calibrate risk appetite, risk tolerances, wind-down triggers and adequate resources.

Liquidity risk management

• Explicitly considering liquidity risk in the risk management framework and using stress testing to inform liquidity risk appetite, key risk indicators, limits and adequate resources.
• Establishing a liquidity risk framework that not only models routine payments such as customer withdrawals, regular operational costs and margin payments, but also unexpected stress events. As a result, holding adequate liquidity resources considering the impact of stress events and the firm’s risk appetite.
• Including all available information about the liquidity position in the stress testing. For example, the amount of credit facilities extended to customers to cover margin calls should be captured in the stress testing.
• Establishing a contingency funding plan defining reliable funding sources and clearly delegated management actions.
• Considering the impact of a stress on uncommitted intra-group liquidity facilities when assessing liquidity adequacy.

Group risk

• Identifying and managing material group risks and tailoring group risk management policies to the firm’s specific conditions.
• Documenting conflicts of interest policy and lines of authority over intra-group arrangements, including access to shared financial resources.
• Considering the interlinkages between individual firm WDPs and group WDPs. 

Areas for improvement

Enterprise-wide risk management framework

• Having a risk management framework that is not appropriate for the current business and insufficient to support sustainable growth.
• Failing to regularly identify and quantify material risks faced by the business.
• Having a narrow, siloed view of risk, preventing senior management from managing risk across the business.
• Setting financial resource risk appetite at the minimum regulatory requirement without considering the firm's actual risk profile.
• Inadequate understanding or assessment of risks arising from new activities, preventing management from assessing resource requirements.
• Not stress testing material risks to verify that resources are proportionate to the complexity of the business model.  
• Having a risk appetite that is solely based on judgement, making no use of stress testing.
• Not having risk appetite and an appropriate risk management framework for the credit facilities extended to customers to fully or partially waive their margin calls.
• Not differentiating between capital and liquidity resources.

Liquidity risk management

• Not clearly identifying and articulating liquidity risks given the activities of the firm.
• No link between the size of credit facilities extended to customers around margin call payments and liquidity stress testing. This results in underestimating the firm’s liquidity needs in crisis.
• Lack of control and monitoring of liquidity risks.
• Relying on existing cash balances to manage a liquidity stress, without considering whether sufficient cash will be available when risks crystallise.
• Not considering the impact of a stress(es) on cash balances or on funding sources. Relying on overdrafts without considering their availability in stress.
• Not understanding all liquidity risks arising from safeguarding arrangements, including shortfalls.
• No consideration of reduced market liquidity for safeguarded assets.

Group risk

• Relying on the group risk management such as risk appetite, key risk indicators, limits or triggers without verifying the suitability for the individual firm’s specific risks.
• Crisis decision-making involving multiple layers of group governance and unclear delegated authority, slowing decision-making.
• Material intra-group dependency for operations without assessing risks of such arrangements on financial and operational resilience. 

Overall, almost all the wind-down plans (WDPs) we reviewed were disconnected from the firm’s risk management framework and needed more work to be credible and operable.

Firms should embed wind-down planning into their risk management framework, recognising that disorderly wind-down is a key driver of harm. Shortcomings in wind-down triggers sometimes indicate broader issues with firms’ risk management and risk appetite frameworks.

The WDPs we reviewed lacked sufficient detail, testing and validation.  

Plans should consider:

• operations
• treatment of residual safeguarded funds
• liquidity needs
• wind-down triggers which should be driven by the risk appetite

WDPs also need to have realistic timescales and assessments of how financial and non-financial resources are maintained while the firm exits the market.  

These considerations will result in more operable WDPs which can reduce harms to consumers and markets, if a market exit is required.

We encourage firms to review our Wind-down Planning Guide and TR22/1 to help them develop their WDPs.

Good practice

We saw elements of the following good practice, but to differing levels of maturity and completeness of coverage across firms reviewed.

• WDPs that have sufficient detail and consider all material activities, making them operable.
• Appropriate structure and documentation of WDPs, assessing stresses and quantifying resources required.
• Integration of wind-down planning with the wider risk management framework.
• Reverse stress testing to inform points of non-viability and wind-down triggers. Consideration of the impact of stresses on resources before the start of wind-down.
• Detailed modelling of resources required for wind-down including advisory fees, redundancy and employee retention costs.
• Identifying key risks to the WDP, considering how they could crystallise and putting in place mitigation measures such as holding additional resources.
• Regular testing of WDP operability via run-throughs or workshops.

Areas for improvement

• Setting wind-down triggers that are inconsistent with the risks identified in the risk management framework and that are not quantified according to risk appetite.
• Not considering triggers around safeguarding asset shortages or lapsing of safeguarding insurance, where relevant, as set out in paragraph 10.65 of our approach to payment services and electronic money (September 2017).
• Insufficient detail in the WDP about how it would work in practice, making it inoperable.
• Limited financial modelling through wind-down. No consideration of impact on capital from changes to revenues and costs, or impact on liquidity when sufficient cash may not be available to execute the plan.
• Assuming key risks would not crystallise during wind-down and not testing the impact of stresses that take place after the wind-down is started.
• Not analysing how the wind-down timeline can be delayed by issues such as safeguarding, financial crime or contacting customers. For example, not considering meeting obligations to safeguard residual customer funds for 6 years.
• Undue reliance on group wind-down plans or resources.