Financial Services and Markets Bill [HL]

Committee (5th Day)

Northern Ireland and Scottish legislative consent sought. Relevant document: 2nd Report from the Delegated Powers Committee.

Amendment 130

130: After Clause 22, insert the following new Clause— “Digital operational resilience of regulated firms(1) The FCA and the PRA must each make rules requiring authorised persons to meet minimum standards of digital operational resilience, including standards relating to—(a) ICT risk management frameworks appropriate to the nature, scale, and complexity of the authorised person's operations;(b) classification, reporting, and remediation of major ICT-related incidents, including cyber attacks, within timeframes to be specified by the regulator;(c) oversight and contractual requirements for third-party ICT service providers, including cloud service providers and critical technology suppliers;(d) regular digital operational resilience testing, including advanced threat-led penetration testing for systemically significant firms.(2) In making rules under subsection (1), the FCA and PRA must have regard to—(a) the need for proportionality with respect to the size and systemic importance of authorised persons;(b) international standards and frameworks, including those adopted by the European Union;(c) the need to avoid duplication with existing regulatory requirements.(3) The FCA must publish a consolidated digital operational resilience framework within 18 months of this Act coming into force, setting out how requirements under this section interact with existing obligations on authorised persons.(4) The FCA and PRA must review rules made under this section no later than every 12 months.”Member’s explanatory statement This amendment seeks to require the FCA to make rules in relation to the digital operational resilience of financial services firms.

130: After Clause 22, insert the following new Clause— “Digital operational resilience of regulated firms(1) The FCA and the PRA must each make rules requiring authorised persons to meet minimum standards of digital operational resilience, including standards relating to—(a) ICT risk management frameworks appropriate to the nature, scale, and complexity of the authorised person's operations;(b) classification, reporting, and remediation of major ICT-related incidents, including cyber attacks, within timeframes to be specified by the regulator;(c) oversight and contractual requirements for third-party ICT service providers, including cloud service providers and critical technology suppliers; (d) regular digital operational resilience testing, including advanced threat-led penetration testing for systemically significant firms.(2) In making rules under subsection (1), the FCA and PRA must have regard to—(a) the need for proportionality with respect to the size and systemic importance of authorised persons;(b) international standards and frameworks, including those adopted by the European Union;(c) the need to avoid duplication with existing regulatory requirements.(3) The FCA must publish a consolidated digital operational resilience framework within 18 months of this Act coming into force, setting out how requirements under this section interact with existing obligations on authorised persons.(4) The FCA and PRA must review rules made under this section no later than every 12 months.”Member’s explanatory statement This amendment seeks to require the FCA to make rules in relation to the digital operational resilience of financial services firms.

My Lords, it is a pleasure to open day 5 of Committee on the Financial Services and Markets Bill. In moving Amendment 130, which is in my name, I will also speak to Amendments 131 and 168. This is the latest round of AI and technology amendments to the Bill. It is a Bill that is curiously silent on these subjects. At least today there is something timely about my intervention in that, as I am on my feet, across town Sheldon Mills is launching his review into artificial intelligence in financial services—more of which presently.

Amendment 130 seeks to require financial services firms to have regard to all the issues around digital and operational resilience across all their activities. I know that the Minister in his response will refer to the cyber resilience Bill, which is coming to your Lordships’ House in a fortnight. Indeed, there is much in that Bill to commend. But in consideration of the significant impact and position of financial services in the UK economy, I believe that it would be helpful to have something about digital and operational resilience in this Bill.

We are not just talking about foreign states or negative acts from international adversaries; we are talking about issues around supply chain, third-party overreliance and concentration risk on particular providers—for example, in the cloud. Circumstances change and financial services institutions, believing that things will always be as they are, may find themselves extraordinarily exposed by the flick of a switch with perhaps only 90 minutes’ notice. I ask the Minister to consider this when he responds and state, in respect of financial service institutions’ significant contribution and place in the UK economy, whether he agrees that clauses in the Bill pertaining directly to these subjects would be helpful in our endeavours.

Amendments 131 and 168 are on artificial intelligence. Certainly, some of these concepts are covered in Sheldon Mills’ review. Given the proliferation and already deep penetration of artificial intelligence into financial services institutions—and, indeed, its use by not only sophisticated but retail and individual investors—will the Minister not agree that considering AI, not just in these clauses but throughout the Bill, would be beneficial to all those involved in financial services? When we say, “all those involved in financial services”, we could just as easily say “everybody”. The principles are clearly set out in Amendment 131, which takes us to the issue that I have raised on previous days around the Government’s approach to artificial intelligence. As stated, that is a domain-by-domain approach, yet there is nothing currently within this Bill.

My Lords, I was delighted when I saw that the noble Lord, Lord Holmes, had put down these amendments, because it is so apparent, as he has clearly stated, that the whole issue of digital and AI is missing from this Bill. Because of the pace of change and the impact—and strength of the impact—across all our financial services, this is an issue that has to be dealt with and grasped with some sense of urgency.

Like the noble Lord, I have been very interested in the Mills review, although, as it was published today, I have only had time to skim its summaries and some of the newspaper references to it. It is clear that, certainly from Sheldon Mills’ perspective—I think that most of us have, one way or another, dealt with Sheldon Mills over the years and very much respect his judgment—the FCA may well be short of relevant powers in dealing with AI. He noted particularly a lack of powers under the critical third-parties regime, which made sense to me. In his recommendations, he also raised issues around the regulatory perimeter, another area that we have raised on more than one occasion.

In recent years, it has not been uncommon—though I dread it—for the Government to present on Report amendments that deal with an area that has been missed from the body of a Bill in Committee. On this Bill, that would allow a period of thought and the opportunity to absorb and consider what is presented in the Mills review. Since financial services Bills do not come around that often, I very much hope that the Minister will seriously consider taking advantage of the Bill to get those kinds of protections in place. If he fails to do that, we might collectively have to come forward with something on Report. Frankly, given the intricacy, detail and complexity, this is an area where the Government coming forward with an answer would, I think, be welcomed across the House and very much, I hope, within the spirit and theme of the amendments presented by the noble Lord, Lord Holmes.

My Lords, I thank my noble friend for his comments today on AI and digital resilience and for his comments on previous days. I declare my interest as the director of South Molton Street Capital, which is regulated by the FCA.

These amendments raise an interesting point about emerging technologies, digital resilience and the use of artificial intelligence in financial services, to be covered, as we have discussed, by the Mills review and the FCA itself. We will return to this subject in a later group, when my noble friend Lord Ranger of Northwood and the Opposition Front Bench will speak to our own amendments, particularly in relation to digital assets. We will also comment on supervision in a later group.

Both digital resilience and the proper use of AI are important. However, I am not convinced that this is the right way or the right place to tackle these issues. Our concern is that this could add another layer of regulation on firms that are already subject to a substantial body of obligations in this area. Financial services firms already operate under a wide range of frameworks relevant to AI governance, digital resilience and technology risk. The consumer duty, which we have touched on already, requires firms to deliver good outcomes for retail customers. The senior managers and certification regime provides a framework for accountability and governance. The FCA senior management arrangements and controls already require firms to maintain appropriate systems, controls, governance and risk management. Firms are subject to data protection law, including rules around automated decision-making and profiling. They are subject to equality law where discriminatory outcomes arise. They are subject to operational resilience requirements, outsourcing and third-party risk expectations, and, in some contexts, more specific requirements around algorithmic trading and market conduct.

We should therefore be cautious before adding new statutory requirements on top. That is particularly important because technology develops quickly and a prescriptive regulatory framework can rapidly become out of date. It can also lead to duplication, uncertainty and compliance activity that is focused more on satisfying the form of the requirement than managing the underlying risk.

My Lords, the Government recognise that the pace and significance of the current wave of technological change is already having an effect on the whole of society. For the purposes of this discussion, I will state that it is clearly having a notable impact on the financial services sector, as mentioned, and that it is set only to continue to grow. The Chancellor set out in her Mais Lecture just a few months ago the importance of the UK grasping the opportunities presented by AI to ensure that we are at the forefront of safe adoption and innovation, so we are entirely in agreement on how important this topic is.

On Amendment 130, the Government are committed to ensuring the operational resilience of the UK’s financial sector. Operational disruptions harm consumers and markets and have the potential to affect financial stability. That is why the FCA and the PRA have powers to ensure that firms have robust plans in place to deliver important business services, no matter the disruption.

The noble Lord, Lord Holmes, asked me if the Government agree that the sector requires an operational resilience framework. I do, but I do not think that the regulator should be required to set the rules on this. Given the rapidly evolving information and communication technology landscape, it is important that the FCA and PRA are able to maintain the flexibility afforded them by their existing powers to ensure that requirements and threat-led penetration testing keep pace with the changing risks. The regulators have shown that we can trust them to get this right by creating an operational resilience framework for the UK financial sector. This framework supports the sector to prevent, adapt and respond to, and recover and learn from, operational risk and disruption. It includes rules and supervisory expectations on operational resilience; third-party risk management for financial service firms; incident reporting requirements; advanced tools to assess firms’ cyber security and resilience, including threat-led penetration testing for systemically important firms; and a new regime for third parties providing critical services to the financial sector.

The noble Lord, Lord Holmes, asked me if the Government agree that the sector requires an operational resilience framework. I do, but I do not think that the regulator should be required to set the rules on this. Given the rapidly evolving information and communication technology landscape, it is important that the FCA and PRA are able to maintain the flexibility afforded them by their existing powers to ensure that requirements and threat-led penetration testing keep pace with the changing risks. The regulators have shown that we can trust them to get this right by creating an operational resilience framework for the UK financial sector. This framework supports the sector to prevent, adapt and respond to, and recover and learn from, operational risk and disruption. It includes rules and supervisory expectations on operational resilience; third-party risk management for financial service firms; incident reporting requirements; advanced tools to assess firms’ cyber security and resilience, including threat-led penetration testing for systemically important firms; and a new regime for third parties providing critical services to the financial sector.

On Amendment 131, I agree that the regulatory system needs to reflect the change and challenge brought on by the significant increase in the use of artificial intelligence in the financial services sector. There are huge opportunities afforded by AI and we are committed to securing them for the benefit of the UK, but we also need to be aware of the risks that technology can present to both consumers and financial stability, and we are working closely with our regulators to monitor them. Amendment 131 would require the FCA to make specific rules for AI to manage a range of risks associated with the use of technology. The Government welcome the FCA’s proactive approach to the Mills review and we will work closely with the FCA to determine the next steps on that report. However, I am worried that the amendment would mean that the FCA would have to draw up a range of new rules that would replicate many of its current rules, including in relation to bias and discrimination.

Our approach to regulating AI within the existing regulatory frameworks ensures that firms have clarity about how to meet the requirements relating to AI use, ensures that the high standards that can apply across financial services also apply to the use of AI within them, and allows the rules to apply flexibility over time as these technologies and their applications inevitably evolve, sometimes rapidly. Requiring the FCA to regulate use separately would remove that flexibility and agility from our approach.

On Amendment 168 and the proposal for an AI officer, the Government are committed to ensuring that financial services firms are alive to the potential risks associated with the use of AI, and their governance and accountability mechanisms must reflect the new challenges presented by the technology. That is why, under the senior managers and certification regime, firms are already required to allocate clear responsibility to senior managers for the activities and risks within their business. That includes risks arising from the use of AI, which falls within the responsibilities for the relevant senior managers across the firm. The responsibility needs to sit with the senior managers responsible for the underlying activities. The Bill makes targeted reforms to the senior managers and certification regime to reduce the unnecessary burdens, but those do not affect the underlying requirement for firms to ensure clear accountability for risks, including those arising from emerging technologies such as AI.

The Government are conscious of the risks associated with cyber resilience and AI and have been proactive with the regulators to ensure that the financial services sector is appropriately managing those risks for consumers and financial stability. I hope I have provided some reassurance that the Government and the regulators are alive to the risks identified and taking proactive steps to manage them. I ask the noble Lord to withdraw his amendment.

The Government are conscious of the risks associated with cyber resilience and AI and have been proactive with the regulators to ensure that the financial services sector is appropriately managing those risks for consumers and financial stability. I hope I have provided some reassurance that the Government and the regulators are alive to the risks identified and taking proactive steps to manage them. I ask the noble Lord to withdraw his amendment.