PRA has fined Raphaels Bank £1,278,165 for breach of what was at the time Principle 2 in relation to outsourcing of provision of ATMs. The bank had agreed in 2006 to enter into a joint venture agreement with a group company to provide ATMs in various UK locations. It did not enter into suitable written agreements or undertake appropriate due diligence over the outsourcing. The agreement it did eventually produce did not properly divide responsibilities. Under the arrangements, the group company would pay certain third parties and replenish the ATMs on the bank’s behalf and be reimbursed by the bank. Over the next seven to eight years, employees in the group company’s team responsible for managing the outsourced functions had access to the bank’s accounts and improperly transferred funds in excess of the amounts the bank owed. PRA found no evidence that any other person within the group company knew about this or had sanctioned it. The effect was that, although the funds were repaid once the transfers were discovered, and the bank did not ultimately suffer any financial loss, the impact on the bank’s financial position would have been severe had the group company become insolvent. As a result of the transfers, the bank had a large exposure to the group on several successive reporting dates but did not report it, and was often in breach of the large exposure limit. Moreover, it described and treated the transfers incorrectly for the purposes of its capital calculation. The banks’ auditors raised concerns on several occasions before the bank addressed them. PRA concluded that, had the bank outsourced with reasonable care, the transfers may not have happened at all, or at least would have been detected sooner. The effect of its failings was that its regulators had an incomplete and erroneous understanding of risks to which the bank was exposed, which goes to the heart of PRA’s ability to achieve its regulatory objectives. (Source: PRA Fines Raphaels Bank for Outsourcing Control Failings)