Operational Resilience
The FCA and PRA have placed considerable emphasis on operational resilience as a core supervisory priority. The regulatory framework introduced in March 2022 requires firms to identify their Important Business Services, set impact tolerances, and demonstrate the ability to remain within those tolerances during severe but plausible scenarios. Heightened geopolitical tensions create material risks to business continuity, particularly for firms with operations, counterparties, or infrastructure dependencies in affected regions.
Institutions should urgently review their Important Business Services and assess whether current impact tolerances remain appropriate given the fluid risk environment. The scenarios previously considered may not have adequately anticipated the nature or speed of geopolitical deterioration. Scenario testing should be revisited to incorporate geopolitical disruption, including potential impacts on third-party service providers, data centers, and communications infrastructure. Where firms rely on offshore operations centers or technology providers with exposure to impacted zones, particular scrutiny is warranted.
Firms must ensure that their business continuity plans adequately address the possibility of rapid escalation, including contingency arrangements for staff safety, cross-border payments, and market access. Payment systems and correspondent banking relationships may be disrupted by sanctions developments or operational failures in a region. Firms should identify critical dependencies and develop alternative arrangements where feasible.
Third-party risk management takes on heightened importance in this context. Outsourcing arrangements should be reviewed to identify any concentration risks or vulnerabilities arising from service providers’ own exposure to an affected region. Contractual provisions relating to business continuity and exit planning should be examined to ensure they remain fit for purpose.
Senior managers with responsibility for operational resilience under the Senior Managers and Certification Regime should satisfy themselves that appropriate governance structures are in place to monitor developments and escalate concerns promptly. This includes ensuring that management information is sufficiently timely and granular to support informed decision-making as the situation evolves.
Market Abuse
Periods of geopolitical uncertainty inevitably generate heightened market volatility and increased trading activity, and we have seen this recently. This environment creates elevated risks of market abuse, including insider dealing and market manipulation. The Market Abuse Regulation continues to apply, and firms must remain vigilant in their compliance efforts notwithstanding the challenging circumstances.
UK financial institutions must ensure that surveillance systems are calibrated to detect suspicious trading patterns that may arise during periods of abnormal volatility. Alert thresholds and parameters may require adjustment to distinguish genuine abuse from legitimate trading activity driven by market conditions. Compliance teams should anticipate an increase in alerts requiring investigation and should ensure adequate resources to manage the workload without compromising quality.
Front office staff should be reminded of their obligations regarding the handling of inside information, particularly where firms have access to non-public intelligence regarding geopolitical developments or their potential commercial impacts. This includes information obtained through government relationships, industry contacts, or proprietary research. Firms with significant government or defense sector client bases should be particularly attentive to information barriers and personal account dealing restrictions.
Compliance teams should pay particular attention to trading in energy commodities, defense sector equities, currencies of affected nations, and other instruments likely to be affected by instability. Oil and gas markets are particularly sensitive to developments, and firms active in these markets should ensure that their surveillance arrangements are appropriately focused.
Firms should also review their suspicious transaction and order reporting procedures to ensure timely notification to the FCA where required. The obligation to report arises where there are reasonable grounds for suspicion, and firms should err on the side of caution in uncertain circumstances. Record-keeping should be meticulous to demonstrate compliance in any subsequent regulatory review.
Sanctions Compliance
The sanctions landscape represents perhaps the most acute area of regulatory risk. UK financial institutions must navigate a complex framework comprising domestic UK sanctions administered by the Office of Financial Sanctions Implementation, retained EU sanctions, and the extraterritorial application of US sanctions. The interaction between these regimes creates significant compliance challenges, and the consequences of breach—both regulatory and reputational—are severe.
Cyber Security
State-sponsored cyber threats represent a critical concern. Historical precedent suggests that cyber operations frequently accompany or follow kinetic military action, whether as a form of retaliation or as part of a broader strategic response.
The National Cyber Security Centre has previously issued guidance on heightened cyber threats during geopolitical tensions, and firms should review this guidance to ensure that their defensive measures are appropriately strengthened. The NCSC’s advice on actions to take during periods of heightened threat provides a useful framework for immediate response.
Enhanced monitoring of network activity is essential. Security operations centres should increase alert levels and ensure that anomalous activity is investigated promptly. Verification of access controls should be undertaken, including review of privileged access arrangements and confirmation that multi-factor authentication is universally deployed for critical systems. Readiness to implement incident response procedures should be tested through tabletop exercises or technical rehearsals.
Particular attention should be paid to potential distributed denial-of-service attacks, which may seek to disrupt customer-facing services or payment systems. Phishing campaigns targeting staff represent another significant vector, and firms should consider issuing renewed guidance to employees regarding suspicious communications. Social engineering attacks may become more sophisticated during periods of heightened tension, exploiting staff anxiety or curiosity about unfolding events.
Attempts to compromise third-party suppliers as vectors for intrusion are increasingly common, and firms should assess the cyber security posture of their critical vendors. Supply chain attacks can bypass perimeter defenses and provide access to sensitive systems, making third-party risk management an essential component of cyber resilience.
Board-level engagement on cyber risk is essential during this period. Directors should receive regular briefings on the threat landscape and the firm’s defensive posture. Firms should ensure that their cyber incident response plans include clear escalation pathways and communication protocols, including arrangements for notifying regulators, law enforcement, and affected customers where required. The FCA’s expectations regarding notification of material cyber incidents should be clearly understood.
Additional Considerations
Financial Crime and Anti-Money Laundering
Financial crime teams should remain alert to potential money laundering and terrorist financing risks. These conditions are conducive to illicit financial flows, including the movement of funds to support terrorist organizations, proliferation financing, and the laundering of proceeds from corruption or sanctions evasion.
Enhanced transaction monitoring and customer reviews may be warranted for higher-risk business relationships. Firms should pay particular attention to transactions involving jurisdictions neighboring any conflict zones, as these may be used as transit points for illicit funds. Unusual patterns of activity, including sudden increases in transaction volumes or changes in counterparty profiles, should be investigated promptly.
Suspicious activity reporting obligations remain in force, and firms should ensure that their staff are adequately trained to recognize and escalate potential concerns. The National Crime Agency should be notified through the normal SAR reporting process where appropriate. Firms should also be alert to potential trade-based money laundering involving the movement of goods through a region.
Liquidity and Funding Risk
Liquidity and funding risks should be carefully considered, particularly when firms have exposures to markets or counterparties that may be affected by regional instability or sudden capital flight. Geopolitical shocks can trigger rapid changes in market conditions, including widening credit spreads, reduced market liquidity, and increased collateral demands.
Firms should review their liquidity stress testing assumptions to ensure they adequately capture the potential impact of the current situation. Contingency funding plans should be examined to confirm that alternative funding sources remain available and that early warning indicators are appropriately calibrated. Treasury functions should maintain close communication with senior management regarding liquidity positions and emerging pressures.
Correspondent banking and payment system access should be monitored for any signs of disruption. Where firms rely on clearing or settlement services that may be affected by regional developments, alternative arrangements should be identified where feasible.
Insurance Considerations
Firms should review their insurance arrangements to understand the extent of coverage available in the current circumstances. Professional indemnity insurance, directors’ and officers’ liability insurance, and cyber insurance policies may all be relevant, but coverage terms vary significantly.
Political risk and war exclusions are common in many insurance policies, and firms should seek clarity from their insurers regarding the application of such exclusions to the current situation. Business interruption coverage should also be examined, particularly where firms have operations or dependencies in an affected region.
Notification obligations under insurance policies should be carefully observed. Many policies require prompt notification of circumstances that may give rise to a claim, and failure to comply with notification requirements may prejudice coverage.
Consumer Protection and Customer Communications
Firms should consider their obligations to customers who may be affected by the situation. This includes customers with connections to an affected region, customers whose transactions may be delayed or blocked due to sanctions compliance measures, and customers who may be experiencing financial difficulty as a consequence of the conflict.
The FCA’s Treating Customers Fairly principles and the Consumer Duty require firms to act in good faith and deliver good outcomes for retail customers. Where sanctions screening or enhanced due diligence processes result in delays to customer transactions, firms should communicate clearly and promptly with affected customers.
Vulnerable customers may require additional support during periods of uncertainty. Firms should ensure that their customer service teams are equipped to handle enquiries sensitively and that appropriate escalation routes are available.
Regulatory Engagement
Firms should consider proactive engagement with their supervisory contacts at the FCA and PRA where material concerns arise. Regulators generally prefer to be informed early of emerging issues rather than learning of them after the fact. This is particularly true where firms anticipate potential breaches, operational disruptions, or other matters that may affect their ability to meet regulatory requirements.
Industry forums and trade associations may also provide useful channels for sharing information and developing collective responses to common challenges. Firms should monitor communications from regulatory bodies and industry groups for guidance relevant to the current situation.
Staff Welfare and Human Resources
The welfare of staff should not be overlooked during periods of geopolitical tension. Employees with personal connections to an affected region may experience significant stress, and firms should ensure that appropriate support is available through employee assistance programs or other channels.
Staff working in compliance, risk management, and other functions experiencing increased workloads should be monitored for signs of fatigue or burnout. The quality of decision-making may deteriorate under sustained pressure, increasing the risk of errors or oversights.
Firms with staff located in or travelling to affected regions should have clear procedures for ensuring their safety, including evacuation arrangements if necessary. Travel policies should be reviewed and updated to reflect current risk assessments.
Reputational Risk
Reputational risk requires careful management during periods of heightened public attention to geopolitical matters. Firms should consider how their activities and client relationships may be perceived in the current environment, and whether any adjustments to public communications or business activities are warranted.
Social media monitoring may be advisable to identify emerging reputational concerns at an early stage. Crisis communications plans should be reviewed to ensure that spokespersons are identified, and key messages are prepared for foreseeable scenarios.
Commodities Price Volatility
Rapid fluctuations in commodities pricing represent a significant area of concern for UK financial institutions during periods of instability. The impacts on global energy markets are of particular concern of course, with consequences extending to a wide range of commodities including oil, natural gas, petrochemicals, and precious metals.
Firms engaged in commodities trading, financing, or derivatives activities should anticipate heightened volatility and ensure that their risk management frameworks are calibrated accordingly. Value-at-risk models and stress testing scenarios may require urgent review to reflect the changed market environment. Historical correlations and volatility assumptions underpinning these models may not adequately capture the potential for extreme price movements during acute geopolitical crises.
Margin requirements for commodities derivatives are likely to increase as clearing houses respond to elevated volatility. Firms should ensure that adequate liquidity is available to meet potential margin calls and should communicate proactively with clients who may face similar pressures. The collapse of trading positions due to margin shortfalls can create systemic risks and reputational damage that extend well beyond the immediate financial loss.
From a conduct perspective, firms should be alert to the risk that rapid price movements may create opportunities for market manipulation or other forms of abuse. Surveillance systems should be adjusted to account for the changed trading environment, and compliance teams should maintain heightened vigilance regarding unusual trading patterns in commodities markets. The FCA has previously indicated that it expects firms to demonstrate robust controls in volatile market conditions.
Firms providing commodities financing should review their exposure to borrowers whose creditworthiness is sensitive to commodity prices. Energy producers, airlines, shipping companies, and manufacturers with significant energy input costs may all be affected by sustained price volatility. Collateral valuations should be reassessed where commodities or commodities-linked assets form part of the security package.
Hedging strategies employed by corporate clients may be tested by extreme price movements. Firms should consider whether clients have adequate understanding of their hedge positions and the potential for basis risk or hedge ineffectiveness in stressed conditions. The suitability of hedging products previously sold to clients may come under scrutiny if those products fail to perform as expected during the current volatility.
Regulatory capital requirements may also be affected by commodities price volatility. Market risk capital charges will increase as volatility rises, and firms should monitor their capital positions closely to ensure continued compliance with regulatory requirements. Early communication with supervisors may be appropriate where capital pressures are anticipated.
Credit Risk
Credit risk exposures should be reviewed in light of the changed economic outlook. Counterparties with significant exposure to an affected region, or to sectors likely to be affected by a conflict such as energy, transport, and defense, may experience deterioration in creditworthiness.
Firms should consider whether credit limits and risk appetite parameters remain appropriate, and whether additional provisions or impairments may be required. Early engagement with borrowers experiencing difficulty is generally preferable to reactive measures taken after default.
Environmental, Social, and Governance Considerations
ESG considerations may arise in connection with the current situation. Firms with stated commitments regarding responsible investment or ethical business practices should consider how these commitments apply in the current context.
Shareholder and stakeholder expectations regarding corporate responses to geopolitical events have increased in recent years, and firms should be prepared to articulate their position if questioned. This includes considerations relating to any business activities that may directly or indirectly support parties to the conflict.
Checklist for Financial Institutions
The following checklist summarizes the key actions that UK financial institutions should consider in response to the current situation. This list is not exhaustive and should be adapted to reflect each firm’s specific circumstances and risk profile.
Governance and Oversight
Convene senior management and board-level discussions to assess the firm’s exposure and response
Ensure clear accountability for monitoring developments under the Senior Managers and Certification Regime
Establish or activate crisis management arrangements as appropriate
Review management information to ensure timely and accurate reporting on relevant risks
Operational Resilience
Review Important Business Services and impact tolerances in light of the changed risk environment
Update scenario testing to incorporate geopolitical disruption
Examine business continuity plans and confirm contingency arrangements are in place
Assess third-party dependencies and outsourcing arrangements for vulnerabilities
Identify critical infrastructure and payment system dependencies
Market Abuse
Review and recalibrate surveillance systems for heightened volatility
Remind front office staff of obligations regarding inside information
Ensure adequate compliance resourcing to manage increased alert volumes
Review suspicious transaction and order reporting procedures
Focus surveillance on energy, defense, and currency markets
Sanctions Compliance
Confirm sanctions screening systems are updated with latest designations from OFSI, EU, and OFAC
Cyber Security
Review NCSC guidance on heightened cyber threats
Increase security operations monitoring and alert levels
Verify access controls and multi-factor authentication deployment
Test incident response procedures and escalation pathways
Assess third-party vendor cyber security posture
Issue staff guidance on phishing and social engineering risks
Financial Crime
Enhance transaction monitoring for higher-risk relationships and jurisdictions
Review customer portfolios for connections to affected region
Ensure SAR reporting processes are functioning effectively
Monitor for trade-based money laundering indicators
Liquidity and Funding
Review liquidity stress testing assumptions
Confirm contingency funding arrangements
Monitor payment system and correspondent banking access
Maintain communication between treasury and senior management
Insurance
Review policy terms and coverage for current circumstances
Clarify application of political risk and war exclusions
Observe notification obligations under insurance contracts
Customers and Communications
Prepare communications for customers affected by sanctions-related delays
Ensure customer service teams are briefed on relevant issues
Consider support arrangements for vulnerable customers
Review crisis communications plans and identify spokespersons
Staff Welfare
Ensure employee assistance programs are accessible
Monitor staff in high-pressure functions for fatigue
Review travel policies and staff safety arrangements for affected regions
Commodities and Market Risk
Review value-at-risk models and stress testing scenarios for commodities exposures
Ensure adequate liquidity for potential margin calls on derivatives positions
Adjust surveillance systems for commodities trading in volatile conditions
Reassess collateral valuations where commodities-linked assets are involved
Review client hedging strategies and suitability considerations
Monitor regulatory capital positions in light of increased market risk charges
Communicate proactively with clients facing margin pressures
Credit and Financial Risk
Review credit exposures to affected counterparties and sectors
Consider whether risk appetite parameters require adjustment
Assess potential provisioning or impairment requirements
Regulatory Engagement
Consider proactive communication with FCA/PRA supervisory contacts
Monitor regulatory and industry guidance
Engage with trade associations and industry forums as appropriate