Raphaels Bank fined £1.89m for outsourcing failings

Raphaels is a small UK-based independent bank that provides prepaid and credit card services, personal savings products and consumer credit.

Its prepaid card and charge card programmes rely on third party firms to authorise and process card transactions.

The FCA says Raphaels failed to adequately understand and assess the business continuity and disaster recovery arrangements of its outsourced service providers - particularly how they would support the continued operation of its card programmes during a disruptive event.

In a statement, the FCA said the absence of such processes "posed a risk to Raphaels’ operational resilience and exposed its customers to a serious risk of harm".

These risks crystallised on the 24 December 2015 when a technology incident occurred at a card processor. The incident caused the complete failure of the authorisation and processing services it provided to Raphaels and lasted over eight hours. During this period, 3,367 customers were unable to use their cards.

Seasonal workers, who depended on their cards to receive their wages, used the largest prepaid card programme affected by the incident.

The joint FCA and PRA investigation found that Raphaels’ specific failings in relation to the incident resulted from "deeper flaws in its overall management" and oversight of outsourcing risk from Board level down.

Raphaels agreed to resolve this matter and therefore qualified for a 30% reduction in the fines imposed by both regulators. Without this discount, the combined fine imposed by the FCA and PRA would have been £2,709,574.

Mark Steward, executive director of enforcement and market oversight at the FCA, said: "Raphaels’ systems and controls supporting the oversight and governance of its outsourcing arrangements were inadequate and exposed customers to unnecessary and avoidable harm and inconvenience. There is no lower standard for outsourced systems and controls and firms are accountable for failures by outsourcing providers."

Sam Woods, deputy governor for prudential regulation and chief executive officer of the PRA, added: "Firms’ ability to manage outsourcing of any critical activities is a vital part of maintaining their safety and soundness. Such outsourcing is an important part of a firm’s operational resilience, and particularly so in the case of Raphaels given the level of reliance on outsourcing in its business model.

"In addition, this was a repeat failing which demonstrates a lack of adequate and timely remediation. This is a significant aggravating factor in this case, leading to an uplift in the penalty."