As the coronavirus weaves its web around the globe, it's time for regulated firms to look to their business continuity plans to ensure they are covered.

The FCA have already made a statement confirming that it is working closely with the financial services sector to ensure it is responding effectively to the Novel Coronavirus (COVID-19) outbreak.

This is not surprising as the FCA requires all firms to have contingency plans in place to deal with major events. References to firms needing the ability to deal with operational risk appear throughout sectoral regulatory requirements, and the recent spate of portfolio strategy letters has called out operational risk as critical – even leaving the COVID-19 outbreak to one side. For example, SYSC 13.8 of the FCA handbook (in relation to insurers) states that "the exposure of a firm to operational risk may increase during times of significant change to its organisation, infrastructure and business operating environment. Before, during, and after expected changes, a firm should assess and monitor their effect on its risk profile". For BIPRU firms, SYSC 7.1.16 requires them to implement policies and procedures "to evaluate and manage the exposure to operational risk, including to low-frequency high-severity events". Firms must consider what constitutes operational risk for these purposes.

COVID-19 has the potential to really affect a firm's operating environment. The Government is estimating that at its worst, one fifth of the working population could be off sick.

Together with the potential for lower headcount, quarantining for financial institutions and the absence of parents whose childrens' schools are closed could result in the closure of branches, offices, call centre, technology/platform providers and an increase in customers defaulting on credit.

This risk will see business continuity professionals all over the UK dusting down their business continuity plans to assess whether they are able to cope with the impact of such a crisis.

SYSC 3.2.19 requires insurers and managing agents to have "appropriate arrangements to ensure that it can continue to function and meets its regulatory obligations in the event of unforeseen interruption." For all other firms, SYSC 4 contains the critical business continuity requirements, saying, among other things that policies must be "aimed at ensuring, in the case of an interruption to its systems and procedures, that any losses are limited…", and specifically states a business continuity plan should include resource requirements, including human resources.

Financial Institutions in the UK are well versed in this and regularly assess and test their plans. However, most plans are contingent on the plan being invoked in isolation – one institution in crisis, but what about where multiple institutions invoke their plans at the same time. What happens to shared alternative sites for example?

We have set out below, some of the key considerations for regulated financial services firms as part of their COVID-19 contingency planning.

Regulatory requirements

With a wealth of new regulatory requirements falling to be implemented in the next few months, firms are trying to understand the impact on meeting these regulatory obligations should the virus affect their business and employees.

At the moment the FCA position is that it expects firms to take all reasonable steps to meet their regulatory obligations. However, some firms may struggle to meet deadlines where large numbers of staff or third party providers have not been able to contingency plan for this unique occurrence.

As always, firms should liaise with the FCA directly if they feel like they may struggle to meet any deadlines as a result of the virus becoming widespread and affecting their business. Early engagement is always encouraged and is in the spirit of the principle of transparency.

Contracts and outsourcing

Bearing in mind the reliance on firms on third party suppliers, how will COVID-19 impact firms' supply chains?

The legal and regulatory framework for firms ensures that protections are in place for firms' outsourced providers. However, any outsourced or supply contract is only as good as the terms within it and the business continuity plan that forms part of that arrangement is only as good if it works in practice and is not frustrated by external factors. Another key tenet of outsourcing protection is that risks should not be concentrated in a small number of providers, but here all providers might be suffering the same issue at the same time, like the firms that have appointed them.

Coronavirus has the potential to close down supply chains and so firms should be reviewing the terms of their material outsourcing and other supply contracts to be able to understand the implications of a force majeure event or frustration on their contracts.

Whether the force majeure clause is used by the firm, or against it, it is recommended that the position is clear and properly risk assessed and documented. It's worth noting that each contract could potentially have a different outcome as force majeure is not defined in the UK so an individually negotiated position might exist in each of a firm's contracts.

Recovery by, or against supply chains, together with the likelihood of recovery against insurance policies will be front of mind in this regard.

Branch closures

In China, the provincial arm of one of China’s big-four state banks decided to close at least 10% of its branches. It's likely that branches in certain parts of the UK may also have to close as a result of the virus. But what legal impact will this have?

Banks with branches will need to ensure that a proper analysis of the implications of short or long term closure forms part of their COVID-19 planning. Amongst other things, banks should be looking at how they can continue to comply with their regulatory obligations and also how they can continue to provide alternative means of access to banking services for those dependant on the branch network.

Forbearance may also need to be considered and potentially implemented where the closure of a bank branch has had an impact on a customer's ability to repay their debts.


It's not only employees in a branch that might be affected, firms' headquarters and other offices and their call centres could be impacted. In terms of the legal position, it's well known that employers have a duty of care to their employees under the Health and Safety at Work Act. They also have a common law duty to take reasonable care for the health and safety of their workforce. Therefore, to prevent the spread of Coronavirus, employers may need to consider imposing restrictions on travel and unnecessary meetings in person. Employers should also implement NHS advice on hygiene, such as hand washing and providing hand sanitisers and tissues.

If an employee contracts the virus then they will be off sick in the usual way and entitled to sick pay. Those who voluntarily self-isolate are not sick and would not ordinarily qualify for sick pay. However, the Secretary of State for Health, when addressing the Commons last week, said "Self-isolation on medical advice is considered sickness for employment purposes". The Prime Minister then confirmed on Wednesday that employees who are required to self-isolate will qualify for Statutory Sick Pay from day one, rather than the usual day four – giving employees an extra 3 days of sick pay.

On the other hand, employees who are required to self-isolate by their employer, perhaps due to a branch closure, should receive full pay for the duration of the period as it amounts to a medical suspension under s64 of the Employment Rights Act. Due to the strong public interest in ensuring that employees adhere to the guidance issued by Public Health England it seems unsatisfactory that one situation warrants sick pay and the other warrants full pay. Therefore, employers may wish to consider paying full pay in either situation.

Employers should also be prepared to consider how they will treat staff who need to take time off or be quarantined for family reasons.

Collections and recoveries

Of course the inability of customers to work could impact their ability to re-pay lenders. This could range from small monthly payments, such as credit card payments, to larger, longer-term loans and mortgages.

It's been announced today that RBS have introduced a number of measures to help those affected by the COVID-19 including a deferment of mortgage and loan repayments for up to 3 months and being able to access fixed term savings for no penalty.

Aside from looking into means to alleviate financial strain, lenders will need to consider how they will exercise forbearance in these circumstances especially where individuals are unable to work for an extended period of time due to the illness (CONC 7.3 and Principle 6) . This should also fall within a lender's usual process for treating customers fairly, vulnerable customers and treatment of customers with other illnesses, but some lenders may look to review their forbearance policy for this scenario, given the circumstances.

It will depend on each lender's usual treatment strategies as to how they deal with this but due regard to CONC will have to be given. The FCA has not commented on how lenders should deal with the CONC requirements in this situation but will be looking to ensure lenders continue to comply with their regulatory obligations, despite this unique situation.

In addition, practical considerations such as reporting to credit reference agencies (given the requirements under the Principles of Reciprocity) will need to be looked, together with controls being put in place to ensure that any forbearance of other arrangements are there to help those genuinely affected.

Data protection

An increase in enforced home working has the potential to increase exposure to data breaches. We would urge all firms to remind their workforce of their information security obligations and ensure that data protection compliance remains front of mind, even at home.


All of this potential disruption to financial institutions' processes and procedures may well affect their ability to meet deadlines in dealing with customer complaints. In fact, any ongoing complaints where a deadline has been provided to a customer for a substantive reply could be in jeopardy.

Managing the customer's expectations is important in order to avoid the potential for the customer to feel the complaint is not being treated seriously. Close regard must be given to the FCA's DISP rules regarding complaints and how they should be dealt with in order to treat all customers fairly. Meeting deadlines is important.

You should also consider that a failure to meet the deadlines may result in customers lodging claims with the Financial Ombudsman Service ("FOS") out of frustration with a lack of a response. Such action has financial consequences in the form of the requirement to pay the FOS complaint fee. Therefore, careful planning and the implementation of a robust contingency plan to deal with lack of staff resources to deal with complaints should be high on the list of priorities.

At a time of uncertainty, it’s certain that firms have an obligation to continue to comply with their legal and regulatory obligations. If you would like to talk about any of the topics covered in this article, please get in touch.