FCA and PRA fine Raphaels Bank £1.89m

Retail bank Raphaels, has received separate fines of £775,100 from the Financial Conduct Authority and £1,112,152 from Prudential Regulation Authority (PRA) in respect of breaches between April 2014 and December 2016.

Seasonal workers, who depended on their cards to receive their wages, used the largest prepaid card programme affected by the incident. The timing of the incident, on Christmas Eve, is “likely to have exacerbated the impact of the outage.”

During this period, 3,367 customers were unable to use their prepaid cards and charge cards. In total, the card processor could not authorise 5,356 customer card transactions attempted at point of sale terminals, ATM machines and online.

Its Payment Services Division (PSD) operates prepaid card and charge card programmes in the UK and Europe. The PSD relies on outsourced service providers to perform certain functions that are critical to the operation of its card programmes. These functions included the authorisation and processing of card transactions, a service performed by third party card processors.

Raphaels were judged to have failed to have adequate processes to enable it to understand and assess the business continuity and disaster recovery arrangements of its outsourced service providers.

The joint investigation identified weaknesses throughout the firm’s outsourcing systems and controls which Raphaels ought to have known about since April 2014.

Mark Steward, FCA executive director of enforcement and market oversight said: “’Raphaels’ systems and controls supporting the oversight and governance of its outsourcing arrangements were inadequate and exposed customers to unnecessary and avoidable harm and inconvenience. There is no lower standard for outsourced systems and controls and firms are accountable for failures by outsourcing providers.”

Sam Woods, deputy governor for prudential regulation and chief executive officer of the PRA, added: “’Firms’ ability to manage the outsourcing of any critical activities is a vital part of maintaining their safety and soundness. Such outsourcing is an important part of a firm’s operational resilience, and particularly so in the case of Raphaels given the level of reliance on outsourcing in its business model.

“In addition, this was a repeat failing which demonstrates a lack of adequate and timely remediation. This is a significant aggravating factor in this case, leading to an uplift in the penalty.”

Raphaels agreed to resolve this matter and therefore qualified for a 30% reduction in the fines imposed by both regulators. Without this discount, the combined fine imposed by the FCA and PRA would have been £2,709,574.