UK FCA findings on firms' resilience to systemic risk

The UK Financial Conduct Authority (FCA) has published a new webpage setting out findings from its Defence, Security, and Resilience (DSR) Lab, a joint initiative with the Ministry of Defence, that brought together around 120 leaders from financial services, government and defence. Participants were taken through a deliberately challenging scenario involving regional Global Navigation Satellite System (GNSS) spoofing, multiple damaged subsea cables and a cyberattack on a cable landing station. The exercise explored how hostile activity, supply chain disruption and dual-use technologies (equipment that has both military and civilian use, like drones) could affect market integrity and the UK's wider security. Unlike traditional firm-level exercises, it focused on opportunities for investment to strengthen national resilience as well as systemic risks across the sector.

Key findings include:

• Although firms generally understand their own vulnerabilities, the exercise showed a gap in how they think about dependencies, and risks at a system level.
• Firms would like greater clarity on national threats and priorities before committing capital.
• International dependencies need to be considered when planning for resilience, given that the UK relies on global technology providers for parts of its financial services infrastructure.
• Firms often rely on the same communications networks, satellite systems, subsea cables and technology providers, but may not realise the extent of those shared dependencies.
• There is an appetite for stronger cross-industry collaboration to address shared risks that cannot be solved by firms acting alone.

The FCA notes the government's defence investment plan, which calls for a whole-of-society approach to preparedness and resilience, recognising that the UK cannot rely on any single sector to protect itself against modern, complex threats. The FCA intends to continue supporting the sector in understanding these risks and building resilience. It plans to investigate how it can support intelligence sharing with the financial sector, whether more focus is needed on back-up, "fail-safe" technologies that can be used when disruption hits, and access to banking and finance frictions. The webpage concludes with a series of questions to help firms consider their exposure to systemic risk and how they can support UK resilience.

Return to main website.