PRA penalty imposed for bank’s management and control failures

On 27 November 2015, the Prudential Regulation Authority (PRA) announced that it had fined R. Raphael & Sons Plc (Raphaels) £1,278,165 for breaches of the PRA rulebook’s third Principle for Business (Principle 3) and the Senior Management Arrangements, Systems and Controls (SYSC) provisions.  The fine was levied as a result of failures related to the outsourcing of Raphaels’ ATM operations.

Principle 3 (which was in force until 19 June 2014 but which has since been superseded by revisions to the PRA Rulebook) mandated that a firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems.


Raphaels operated 334 ATMs across various locations in the UK, including railway stations, bureaux de change, and mobile ATMs at major sporting events.

In September 2006 Raphaels entered into a joint venture with Company C, another company in Raphaels’ group of companies (the Group), to provide ATMs in various locations around the UK. As part of this arrangement, Raphaels also outsourced its ATM finance functions.  According to the PRA findings, Raphaels did not:

  • undertake appropriate due diligence prior to entering into the arrangement
  • clearly set out Company C’s obligations in a written agreement
  • put appropriate controls in place to manage the arrangements on an ongoing basis.

The PRA determined that this lack of control and oversight enabled employees of Company C (over a period of 7 years) to improperly divert funds from Raphaels; these funds were used to address cash-flow problems at Company C.  An ongoing lack of management oversight enabled the improper transfers to remain undetected for a prolonged period.


The improper transfer of funds from Raphaels to Company C meant that between May 2011 and November 2013 Raphaels failed to accurately report its capital position or appreciate that it had a significant balance-sheet exposure to the Group.

For a total of 20 months during the period in question, the improper transfers (in addition to other unreported inter-company arrangements) exposed Raphaels by more than 25% of its regulatory capital.  Whilst the funds remained within the Group and were ultimately returned, the insolvency of Company C could have had severe financial repercussions for the bank.

The PRA ruled that Raphaels’ breaches of Principle 3, the PRA Threshold Conditions, and the SYSC requirements, were sufficiently grave to warrant a considerable fine. 

Note: The fine was reduced by 30% as a result of cooperation and settlement by Raphaels during the early stages of the PRA investigation.  Whilst the PRA did not cite them as reasons for reducing the quantum of the fine, the PRA would have regarded positively the significant and timely remedial actions taken by the bank following discovery of the improper transfers.

What this means for you

Implement appropriate processes and controls when outsourcing key operational functions

Although there was no evidence of significant losses incurred by either the bank or its customers, the PRA demonstrated its willingness to penalise financial institutions for failures to implement appropriate processes and controls when outsourcing important operational functions.  In the case of Raphaels, the lack of adequate control mechanisms, and a failure to properly assess the risks inherent in the outsourcing arrangements, exposed the bank to a material capital exposure.  This also highlights the PRA’s role in policing financial stability and seeking to protect banks from failure.

Outsourcing rules can apply to intra-group arrangements

The PRA announcement is a timely reminder that the outsourcing rules (and indeed those of the FCA handbook) apply as much to intra-group arrangements as to arms-length outsourcing.  Firms should also be careful to apply the rules when in-sourcing functions and activities previously provided by third party service providers.