The nearly £1.3m fine awarded by the PRA against R. Raphael & Sons Plc (Raphaels) on 27 November has once again brought to the fore the operational risks that Bank’s face if their outsourcing arrangements are not managed in accordance with their regulatory obligations.
Raphaels, which owns ATMs and provides consumer finance facilities and is regulated by the PRA, was fined £1,278,165 for a series of breaches of Principle 3 of the Principles for Business – which saw the company to which it outsourced some of its finance function misappropriating funds to make up shortfalls in its own balance sheet for over six years. The improper transfers remained undiscovered for several years and during this time Raphaels misreported its capital position to the FSA and subsequently the PRA.
The primary failures related to incorrect liquidity and capital reporting, and were therefore within the jurisdiction of the PRA’s prudential regulation of Raphael. However, the seriousness of the failure was exacerbated by Raphael’s failure to comply with its regulatory obligations relating to outsourcing. The decision therefore deals with failures in both the outsourcing as well as regulatory reporting.
The series of events leading to the decision are notable for a number of reasons:
- The outsourced arrangements were part of an intra-group joint venture;
- The improper transfers were made by a group of employees without the knowledge or involvement of Rapahels, or anyone within the group;
- Rapahels not only misreported its capital position but it did not itself have an accurate understanding of it due to the accounting treatment of the improper transfers; and
- The funds involved were significant (in one year alone amounting to over £9m, and at its peak, involving an exposure of more than 50% of its capital to the group), but as the funds were repaid by the company which made the improper transfers, there was in fact no disruption to the continuity of financial services and no impact on Raphael’s performance.
The events involved numerous breaches of SYSC 8.1, and the PRA considers that had Rapahels outsourced with reasonable care and with appropriate checks and oversight, the improper transfers may not have happened or remained undetected for so long. In particular:
- No written agreement was put in place at the outset, meaning there was no clear allocation of responsibilities or implementation of an oversight structure. Outsourcing agreements were eventually put in place, but they were signed months, and in some cases years, after the arrangements had commenced and then backdated;
- The agreements which were executed were materially deficient in setting out the rights and responsibilities of the parties. They did not specify arrangements for Raphael’s oversight; did not set out service levels for measuring efficacy; and did not capture the services that were actually provided. In one case, the agreement was not even with the group company whose employees were carrying out the outsourced function; and
- Raphaels failed to ensure that the company to whom it outsourced some of its functions, adequately managed the risks associated.