FCA Issues New Guidance on Cyber Resilience and Notification of Cyber Attacks

The FCA published a new page on its website providing informal guidance on cyber resilience on 18 May 2017. 

Following the recent global ransomware cyber attacks, the FCA says firms should be aware of the threat, able to defend themselves effectively, and respond proportionately to cyber events.

To achieve this, firms should:

• Develop a "security culture", from the board down to every employee.
• Be able to identify, prioritise and protect their information assets (ie, hardware, software and people).
• Detect, respond to and recover from breaches.
• Constantly evolve to meet new threats.

Under Principle 11 of the FCA's Principles for Businesses, firms are required to report material cyber incidents to the FCA (and the PRA if the firm is dual-regulated). The FCA indicates an incident may be considered material if:

• it results in significant loss of data, or the availability or control of the firm’s IT systems; 
• it impacts a large number of victims; or
• it results in unauthorised access to, or malicious software present on, the firm’s information and communication systems.

If the incident involves a data breach, the FCA says firms should also report to the Information Commissioner's Office (ICO).

The webpage contains a link to the National Cyber Security Centre website which provides guidance on how firms can protect their information and systems and how to respond to a cyber attack.

Visit the new FCA webpage

FCA Issues Instructions for Submitting MiFID II Commodity Derivative Position Reports

The FCA published a document entitled “Commodity Position Reports” on 3 May 2017 containing reporting instructions for trading venues and investment firms submitting position reports under MiFID II. This is further to the FCA’s final draft rules, published in PS 17/5, to be included in chapter 10 of its Market Conduct sourcebook (MAR 10) on commodity derivative position limits and controls, and position reporting.

The FCA has published the instructions on a webpage containing information on the introduction of position limits and the reporting regime for commodity derivatives.

The FCA’s market data processor (MDP) system supports entities' daily reporting obligations set out in Article 58(1)(b) and 58(2) of MiFID II. The Article 58(1)(a) obligation to make public a weekly report with the aggregate positions held by the different categories of persons for the various commodity derivatives traded on the trading venue (TV) (that is, "commitment of traders" reports) will not be facilitated by the MDP system. The FCA will set up a dedicated inbox for firms to communicate these reports to it.

MiFID II requires TVs to report a daily breakdown of the positions held by all persons on that venue in commodity derivatives and emission allowances (or their derivatives). It also requires investment firms that trade in commodity derivatives or emission allowances (or their derivatives) outside a trading venue to provide the national competent authority (NCA) for the trading venue where the contract is traded daily position reports for those instrument types and for their economically equivalent OTC positions. This enables an NCA to aggregate positions and determine if a position holder is in breach of a position limit.

The MiFID II position limits and reporting regime for commodity derivatives aims to prevent market abuse and support orderly pricing and settlement conditions by improving transparency and oversight of financial markets. It comes into force on 3 January 2018.

Read the FCA Commodity Position Report

Visit the FCA webpage on commodity derivatives

FCA Publishes Final Amended Disclosure Rules Conforming to the PRIIPs Regulation

The FCA published a policy statement (PS17/6) on 2 May 2017, with its final amended disclosure rules following the application of the EU Regulation on key information documents (KIDs) for packaged retail and insurance-based investment products (PRIIPs) (Regulation 1286/2014).

PS17/6 sets out how the FCA's disclosure requirements will change to reflect the introduction of the PRIIPs key information document (KID). In summary, the changes are intended to reflect the direct application of the PRIIPs Regulation that will apply to firms that manufacture, give advice on or sell PRIIPs to consumers in the retail market. However, the FCA acknowledges the lack of guidance and clarification at EU level on the PRIIPs Regulation will lead to operational difficulties and legal uncertainty for some firms. It therefore seeks to provide some clarification in PS17/6 on the scope of the Regulation to help firms plan for the new disclosure framework. It does this by including some high-level comment on some of the issues raised by the consultation responses it received, including:

• That firms may need to prepare and provide additional disclosure material to supplement the information in the KID, for example under the Solvency II Directive (2009/138/EC), and supported guidance proposed in relation to this.
• That firms should be able to, but not be required to, provide post-contractual documents in relation to PRIIPs. If provided, this disclosure would be in addition to the standalone KIDs that will need to be provided pre-sale.

Annex 2 of PS17/6 includes lists of products that the FCA considers are PRIIPs or non-PRIIPs, which the FCA has amended slightly, following consultation. Those lists may be amended or clarified further following any clarification at EU level that may be provided during 2017.

Firms must comply with the PRIIPS Regulation and any revised disclosure rules in the FCA Handbook from 1 January 2018.

Read the Policy Statement

On 12 May 2017, the FCA updated its webpage: PRIIPs disclosure: Key Information Documents with revised lists of the products that it considers fall within and outside the definition of a PRIIP. The lists are almost identical to those included in Annex 2 of PS17/6.

Visit the FCA webpage