Decision-maker

BoE.

Firm

Vocalink Limited.

Related decisions

No related decisions.

Sanction

Fine of £11.9 million following a 30% settlement discount. In coming to this figure:

• In terms of seriousness, the BoE considered the breach to be serious, taking into account the firm’s key position in the UK’s national financial payments infrastructure and the significant risk management and governance failings, and determined the appropriate starting point to be £20 million.
• In terms of mitigating factors, the fine was decreased by 15% to £17 million taking into account the firm’s co-operation with the investigation including detailed admissions and its engagement in remediation.

Provisions

Sections 191 and 196 of the Banking Act 2009.

Factual findings

The firm is a company which designs, builds and operates payment systems infrastructure and from 2018 was within the regulatory remit of the BoE having been specified by HM Treasury as a service provider to certain recognised payment systems. 

Key factual findings are summarised below:

November 2020: A review by a consultant (the review) identified various issues and weaknesses with the firm’s systems and controls.

December 2020: The firm implemented a remediation programme to address the issues identified (the remediation programme) with governance arrangements which included reporting to and oversight from all three lines of defence and the Board.

June 2021: The BoE issued a supervisory direction to the firm requiring it to implement the recommendations of the review.

September 2021: The risk function reported to the Risk Committee on its review relating to the remediation programme which identified that the scope of the remediation programme had not been mapped against the direction.

November and December 2021: Key assurance reports prepared by external consultant B found that the firm’s systems and controls fell short in a number of areas and that issues identified by the review remained unremediated.

January 2022: A senior executive with responsibility for remediation work confirmed to the Risk Committee that all but three milestones of the remediation programme were complete and work by an external consultant (external consultant A) was ongoing but had not yet identified any issues.  Second and third line also presented on their reviews. The board approved completion of the remediation programme subject to completion of two milestones.

February 2022:  

• Internal audit circulated a report on its review of the remediation programme noting that the audit was not designed to assess compliance with the direction but concluding that required remediation in relation to several milestones was not in place. 
• A further key assurance report by external consultant B was highly critical of the remediation programme. The key assurance reports were only circulated to a small number of individuals in the first line.
• A senior executive confirmed to the board that all milestones were complete and the firm wrote to the BoE to confirm compliance with the direction.

March 2022:  

• A report by external consultant A confirmed that successful delivery of the remediation programme milestones would address issues related to the scope of the direction and that there was evidence that delivery of those milestones was complete, although changes had been made to several milestones which meant they deviated from their original description. Consultant A also observed that there were unclear communication lines between those delivering the remediation programme and those engaging with the BoE in relation to the direction.
• The BoE required the firm to appoint an independent expert (the expert) to assess the firm’s remediation and confirm the firm had addressed the requirements of the direction.

May 2022: 

• The expert observed at a meeting with the firm and the BoE that the remediation programme likely did not cover the full scope of the direction and should have been a two-year programme.
• The expert’s report found that the firm had failed to comply with the direction and made critical findings regarding the firm’s remediation work which included that it had an unrealistic timeline; rescoping of coverage to the direction was not performed; concerns and challenge of the risk function was not acted on and the Board was not provided with all the appropriate information. 

June 2022: The board discussed the expert’s report and it emerged that some of the key assurance reports had not previously been escalated internally including to the board.

Failings

The BoE concluded that the firm had failed to comply with the direction due to its risk management framework and controls not being sufficiently integrated and not operating effectively to identify, oversee and mitigate the risk of the remediation programme not fulfilling the requirements of the direction. Particular failings included:

• Removing or limiting elements of the remediation programme which meant that it only partially met the scope of the direction and failing to clearly communicate about this within the firm or to the BoE.
• Failing to consider and act upon concerns raised by the risk function around the remediation work.
• Failing to carry out a holistic assessment of new controls implemented under the remediation programme.
• Assurance work which was not in all respects designed to assess properly the key question of compliance with the Direction.

The firm did not have sufficiently robust governance arrangements and escalation processes in place to ensure adequate assessment and management of the delivery of the remediation programme against the requirements of the direction, having regard, in particular, to:

• The fact that certain key assurance reports were not adequately escalated or circulated internally.
• Decisions to change the remediation programme were taken informally outside the firm’s governance structure/procedures and were not properly escalated.