Coronavirus (Covid-19): Information for firms

Your responsibilities

Operational resilience

Our rules give you the ability to consider your arrangements and your customers’ circumstances.

We welcome firms reviewing their current arrangements to address the evolving situation while managing the risks to their employees, customers and the impact on the market.

We expect you to:

• take reasonable steps to ensure you are prepared to meet the challenges coronavirus poses to customers and staff, particularly through your business continuity plans
• provide strong and transparent support and service to customers and small businesses
• manage your financial resilience and actively manage your liquidity (you should report to us immediately if you believe you will be in difficulty)
• prioritise information security and ensure that adequate controls are in place to manage cyber threats

You should have tested contingency plans to deal with major events. 

Alongside the Bank, we are actively reviewing the contingency plans of a wide range of firms. This includes firms’ assessments of operational risks, the ability of firms to continue to operate effectively and the steps firms are taking to serve and support their customers.

You should take all reasonable steps to meet the regulatory obligations that are in place to protect your customers and maintain market integrity. 

Read our consultation paper on operational resilience matters that firms should be considering[23].

Information security

Cyber criminals are increasingly exploiting coronavirus related themes for their own gain. In the UK, the National Cyber Security Centre (NCSC) has detected more UK Government branded scams relating to coronavirus than any other subject.

Operational disruptions (including cyber related incidents) can:

• mean important business services are unavailable
• have the potential to cause wide-reaching harm to consumers and market integrity
• threaten the viability of firms
• cause instability in the financial system

While alternative ways of working may be needed to enable business continuity, we expect you to prioritise information security and ensure that adequate controls are in place to manage cyber threats and respond to major incidents. You should look to implement enhanced monitoring to protect end points, information and firm critical processes, including network connections and video conferencing software.

We expect you to proactively manage the increased risk. This includes:

• being vigilant to the potential increase in security breaches or cyber attacks
• ensuring that you continue to have appropriate governance and oversight arrangements
• reviewing the impact of coronavirus on your information and systems security defences, and taking action as needed
• ensuring that the general notification requirements[24] are followed, and significant operational/cyber incidents are reported

We are in regular contact with industry, the Government, trade associations and other regulators to understand the impact of coronavirus on firms’ operational resilience. In particular, we are working closely with industry to ensure that workarounds and continuity actions do not adversely impact firms’ information security controls and their ability to provide services to customers.

Please check the NCSC[25] for advice on how to keep your organisation secure. To subscribe to up-to-date cyber threat information, please see the Cyber Security Information Sharing Partnership (CiSP)[26].

Market trading and reporting

At the start of the pandemic, if your firm moved to an alternative site or a working from home arrangement, we asked you to consider the broader control environment in view of the new circumstances. 

Given the extensive duration of these arrangements, we now expect you to record all relevant communications (including voice calls) when working outside the office. 

You should continue to take all steps to prevent market abuse risks. This could include enhanced monitoring, or retrospective reviews. We will continue to monitor for market abuse and, if necessary, take action. 

You should also submit regulatory data without undue delay. 

If you have any concerns about meeting your obligations due to coronavirus, you should contact us via your regular supervisory channels as soon as possible.

Our expectations of listed issuers

We’ve provided updates on our expectations of listed issuers in our November 2020 Policy Statement on European Single Electronic Format (ESEF) reporting[27] and in subsequent Primary Market Bulletins. 

MiFID Markets Regime

Our Supervisory Statement on the Operation of the MiFID Markets Regime[28] sets out how we will operate the pre and post-trade transparency regime for the secondary trading of financial instruments after the end of the EU withdrawal transition period.

More information

Market Watch 63[29] was published on 27 May 2020 and sets our expectations of market conduct and discipline in the context of coronavirus. 

Any future updates regarding our expectations of market participants, including listed issuers, will be made using our usual communication channels, including:

• supervisory communications
• Market Watch
• Primary Market Bulletins