The U.K. Financial Conduct Authority has published a Dear CEO letter for data reporting services providers. Since its previous letter in May 2022, the FCA has seen improvement in some areas such as within firms' data quality system and controls and more bespoke DRSP documentation. However, there remain risks of harm.
The FCA's ongoing supervisory priorities are:
- operational resilience — the FCA has observed a low number of operational resilience-related incidents being reported by DRSPs. While this could reflect strong operational resilience, the FCA is concerned that it may indicate that firms have not set appropriate thresholds for reporting incidents. The FCA will closely monitor reported incidents and work with DRSPs to review the adequacy and compliance of incident management and response procedures;
- data quality systems and controls — the FCA expects DRSPs to prioritize enhancing data quality systems and controls to ensure all reported data is complete, accurate, and submitted on time; and
- communication with the FCA and the notification regime — firms are required to provide prompt and accurate notifications to the FCA. The FCA will undertake a review to assess DRSPs' procedures for submitting notifications, which will focus on ensuring that firms have clearly established and appropriate thresholds for determining when a notification is required.
[View source.]
