Consultancy & Skilled Persons Framework 3

Lot A: Client Assets and Safeguarding

Advice, skills and technical expertise in some or all of client assets, safeguarding, stablecoin issuance, and cryptoasset custody.

This will include skills, experience and expertise in areas such as, but not limited to:

• Client Assets (CASS) and SUP 16 in the appropriate regulator’s Handbook, including governance, regulatory reporting and systems and controls arrangements associated with client assets.
• Safeguarding requirements as set out in the Payment Services Regulations 2017 and E-money Regulations 2011, and the FCA Payment Services and Electronic Money Approach Document.
• Safeguarding CP25/14: Stablecoin issuance and cryptoasset custody, and any subsequent publications and additions/changes to the appropriate regulator’s Handbook relevant to the issuance and custody of cryptoassets.

Lot B: Governance, Accountability and Culture

Advice, skills and technical expertise in assessing for regulated firms (or designated Critical Third Parties):

• appropriateness and effectiveness of firm governance arrangements and frameworks
• leadership and individual accountability, including the Senior Managers and Certification Regime (SM&CR)
• organisational culture
• effectiveness of governance in practice to provide oversight on delivery of outcomes and regulatory objectives, including consumer protection, safety and soundness.

This should include, but not be limited to, knowledge of relevant regulatory requirements, standards, guidelines and industry best practice, and experience and expertise in assessing some or all of the following:

Governance

• Board composition, independence, succession plans, and holding executives accountable
• effective committee frameworks and decision-making, including board and executive committees
• appropriateness of governance structures for complex groups with many legal entities
• management of conflicts of interest
• purpose, risk appetite, business model, strategy and change management programmes (e.g. during transition, implementation and delivery)
• policies and procedures.

Leadership and Individual Accountability

• leadership effectiveness
• the SM&CR, including the assessment of the fitness and propriety of Senior Managers and certified staff, the embedding and application of the Conduct Rules, and individual accountability.

Organisational Culture

• psychological safety, diversity of thought, non-financial misconduct and inclusive cultures
• whistleblowing processes and practices
• people policies and practices (including remuneration, training and competence)
• culture, including risk culture (which encompasses Prescribed Responsibilities for culture)
• tone from the top, communication, and link with conduct
• management information on culture
• involvement across all levels of firms that encourages effective challenge and prevents harm by promoting inclusion of a range of views in the decision-making process.

Lot C: Controls and Risk Management Frameworks

Advice, skills and technical expertise in assessing for regulated firms (or designated Critical Third Parties) whether:

• they have effective controls and risk management arrangements in relation to (i) identifying, escalating, monitoring and management of risks, (ii) taking a risk-based approach to deliver fair outcomes for customers, (iii) safety and soundness, and (iv) financial resilience
• they have effective systems and controls to operate their businesses in line with regulatory requirements from an operational resilience perspective
• their risk management frameworks are effectively embedded through the organisation resulting in an effective culture and approach to the management of risk - evidenced in the design, operation and oversight of controls across the three lines of defence.

This should include, but not be limited to, knowledge of relevant regulatory requirements, standards, guidelines and industry best practice, and experience and expertise, in assessing some or all of the following:

Effective Risk Management

• risk management arrangements to identify, monitor, manage and escalate novel and emerging risks across all types of risk
• risks in outsourcing arrangements (including third party and supplier change risk management).

Effective Controls and Governance

• a firm’s ability to self-identify and effectively control for all types of risk
• effectiveness and strength of a firm’s Risk, Compliance and Internal Audit functions
• effectiveness of a firm’s management information (MI), including how the MI is used to (i) identify, escalate, monitor and manage risks, (ii) to build model risk expertise, and (iii) to support effective management reporting
• the preparation and reporting of regulatory returns and disclosures.

Operational Resilience

• firms have in place sound, effective and comprehensive strategies, processes and systems to identify important business services, and set appropriate impact tolerance for each one. This includes:

o specifying the point at which a disruption would pose a risk to a firm’s safety and soundness (and, for Other Systemically Important Institutions (OSII), the stability of the UK’s financial system)

o demonstrating their ability to operate within those tolerances through robust testing.

• firms understand the impact of a disruption to consumers, firms’ own operations, market integrity and the wider systemic impact.

Lot D: Conduct of Business

Advice, skills and technical expertise in assessing application of relevant conduct of business rules and requirements (and other considerations), and adherence to the Consumer Duty; and wholesale market conduct.

This should include, but not be limited to, knowledge of relevant regulatory requirements, standards, guidelines and industry best practice, and experience and expertise in assessing some or all of the following to achieve good outcomes for customers:

Products and Services

• design, manufacture, value and distribution of financial products and services
• sales, marketing and advertising, including disclosure requirements
• approval of financial promotions

Price and Value

• products and services provide fair value and meet customers’ needs

Consumer Understanding

• customer communications
• quality and suitability of advice

Consumer Support

• the fair treatment of customers, including those with characteristics of vulnerability
• collections and arrears management
• complaints and claims handling
• management of conflicts of interest
• past business reviews, file reviews, and redress exercises

Other

• appropriate implementation of whistleblowing processes and procedures including assessing the adequacy of investigations
• firms’ oversight of appointed representatives.

In addition, technical expertise in assessing additional considerations for wholesale market conduct, including:

• upholding market integrity
• ensuring effective market abuse systems and controls
• managing conflicts and ensuring markets remain orderly in a range of market conditions.

This will include assessing firms of various sizes and require skills, experience and expertise in a wide variety of product types and against all relevant regulatory and legal requirements including but not limited to the FCA Handbook, industry standards and best practice.

Lot E: Financial Crime

Advice, skills and technical expertise in assessing financial crime systems and controls (money laundering, anti-bribery and corruption, sanctions, terrorist financing, proliferation financing and fraud) and the effective governance of these areas.

This should include, but not be limited to, knowledge of relevant regulatory requirements, standards, guidelines, industry best practice, and legislation – including experience and expertise in assessing the adequacy of firms’ oversight, systems, controls, and compliance with the following:

• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
• Financial Services and Markets Act 2000
• Proceeds of Crime Act 2002
• Terrorism Act 2000
• Terrorism Act 2006
• Economic Crime and Corporate Transparency Act 2023
• Anti-Terrorism, Crime and Security Act 2001
• Sanctions and Anti-Money Laundering Act 2018
• Fraud Act 2006
• Payment Services Regulations 2017
• Electronic Money Regulations 2011
• Relevant FCA SYSC rules
• Joint Money Laundering Steering Group guidance
• FCA Financial Crime Guidance
• FCA Financial Crime Thematic Reviews.

Lot F: Market Abuse

Advice, skills and technical expertise in relation to market abuse and market abuse surveillance (including insider dealing and market manipulation) and the effective governance of these areas.

This will include skills, experience and expertise in assessing the adequacy of firms’ systems and controls, and the investigation of areas including, but not limited to:

• the UK Market Abuse Regulation (UK MAR)
• the Suspicious Transaction and Order Reports (STOR) regime
• relevant SYSC rules
• Economic Crime and Corporate Transparency Act 2023.

Lot G: Prudential – Deposit Takers, Recognised Clearing Houses, Central Securities Depositories and PRA-Designated Investment Firms

Advice, skills and technical expertise in assessing whether firms have effective prudential arrangements and how these support safety and soundness and/or financial and operational resilience.

This should include, but not be limited to, knowledge of relevant national and international regulatory requirements, standards, guidelines and industry best practice and experience and expertise in:

• assessing and modelling risks (including, credit risk; traded risk; interest rate risk, liquidity and treasury risk; operational risk; settlement risk; cryptoasset technology risk; and climate risk)
• calculating and modelling prudential requirements (including for capital, liquidity, large exposures, and non-financial resources)
• reviewing the preparation and reporting of regulatory returns and disclosures
• business, capital and liquidity planning (including ICAAPs, ILAAPs and stress tests, and for mergers, acquisitions and transfer of business)
• recovery and resolution planning, implementation, and reporting (including Resolution Assessments).

Lot H: Prudential – Insurance

Advice, skills and technical expertise in assessing whether firms have effective prudential arrangements and how these support safety and soundness and/or policyholder protection.

This should include, but not be limited to, knowledge of relevant national and international regulatory requirements, standards, guidelines and industry best practice and experience and expertise in:

• assessing risks arising from life and/or non-life insurance business, (including insurance risk, credit risk, market risk, counterparty default risk, operational risk, liquidity risk and climate risk)
• business, capital and liquidity planning (including stress tests, mergers and acquisitions and transfers of business)
• reserving and technical provisions
• underwriting, claims handling and pricing
• capital modelling – build and review, including the ability to assess insurance firms’ validation of internal models
• reinsurance modelling and exposure management, including catastrophe risk,
• actuarial modelling
• asset-liability management
• insurance Special Purpose Vehicles, insurance linked securities and valuation of assets,
• merger and acquisition due diligence
• reviewing the preparation and reporting of regulatory returns
• recovery, solvent exit and resolution planning
• captives (captives set-up, captives risk management including setting capital and technical provisions).

Lot I: Prudential - Adequate Financial Resources for FCA Solo-Regulated Firms

Advice, skills and technical expertise in evaluating whether solo-regulated firms have effective prudential arrangements, and adequate financial resources to ensure they meet threshold conditions and on-going regulatory requirements.

This will require skills, experience and expertise across different prudential regimes, the FCA Handbook, FCA published guidance, International Accounting Standards, International Financial Reporting Standards and UK Generally Accepted Accounting Practice.

This should include, but not be limited to, knowledge of relevant regulatory requirements, standards, guidelines and industry best practice and experience and expertise in assessing:

• firm’s skills, systems and processes to calculate and hold appropriate level and type of capital and/or liquid resources to cover potential harm, and to put things right when they go wrong
• firm’s skills, systems and processes to evaluate the viability and sustainability of their own business model and strategy; whereby firms consider forward-looking financial projections and strategic plans, under both business-as-usual and adverse circumstances that are outside their normal and direct control. The assessment of tail risk analysis should include elements like the stress test, reverse stress test and wind-down planning, together with the adequacy of the scenarios, its modelling and the governance of these areas
• the preparation and reporting of regulatory returns and disclosures.

Skills, experience and technical expertise should include but not be limited to:

o credit, market, liquidity and operational risk

o trading book: market risk, settlement risk, large exposures and/or the modelling of these risks, as well as regulatory reporting

o any other risks that are inherent to the firm’s business model and that can lead to impair its ability to compensate for harm done

o business, capital and liquidity planning (including Internal Capital and Risk Assessments (ICARAs), liquidity and stress tests, and for mergers, acquisitions and transfer of business)

o recovery and resolution planning, implementation and reporting (including Resolution Assessments).

Lot J: Information and Communications Technology and Cyber Risk and Resilience Management

Advice, skills and technical expertise in assessing whether regulated firms (or designated Critical Third Parties) have effective Information and Communications Technology (ICT) and cyber operational risk and resiliency management and culture to support safety and soundness / policy holder protection and / or operational resilience.

This should include but not be limited to:

• Knowledge of relevant national and international regulatory requirements, standards, guidelines and industry good practice, including:

o Supervisory Statement (SS) 1/21 and Policy Statement (PS) 21/3; SS6/24 and PS24/16; and SS2/21

o Configuration of ICT infrastructure standards such as Internet Protocol Security (IPSEC)

o ICT control frameworks, such as Control Objectives for Information and Related Technologies (COBIT), International Organisation for Standardisation (ISO) standards and Information Technology Infrastructure Library (ITIL)

o Cyber and information security standards and frameworks such as National Institute of Standards and Technology (NIST), ISO27001 and family, NIST SP 800 Series, Open Web Application Security Project (OWASP), Centre for Internet Security (CIS), and SysAdmin, Audit, Network and Security Institute (SANS)

o Project and programme management good practices such as PRINCE2 and MSP

o Software development life cycles such as SSADM and RAD

o Relevant ICT infrastructure, systems and application software.

• and experience and expertise in:

o ICT strategy, governance and culture

o ICT risk management

o Cyber and information security, governance and risk management

o Threat intelligence and hunting

o Security Operations (SOC)

o Cyber response and recovery

o Vulnerability management

o Cryptography

o Service mapping and design, systems architecture, development and maintenance

o Incident and problem management, including playbooks

o Project and change management, including transformation programmes, and associated risk management

o Performance and capacity management

o Data integrity, quality and migration

o Identity and accesses management

o Physical Environment security

o Service continuity, testing and business continuity and disaster recovery management including response and recovery processes to mitigate severe but plausible scenarios

o Third party management (third party risks from outsourced and offshore activities, including cloud services etc.), and service termination to minimise disruption

o Regulatory Technology (RegTech), including regulatory compliance and reporting.

Lot K – Threat Intelligence and Penetration Testing

Provision of services by suppliers with a CBEST or STAR-FS accreditation in the following areas:

• Threat Intelligence (TI)
• Penetration Testing (PT)

A Threat Intelligence supplier is required to have a CREST accredited CCTIM - CREST Certified Threat Intelligence Manager.

A Penetration Testing supplier is required to have CREST accredited CCSAM – CREST Certified Simulated Attack Manager/CCRTM – CREST Certified Red Team Manager and CCSAS - CREST Certified Simulated Attack Specialist/CCRTS – CREST Certified Red Team Specialist

Lot L: Credit Rating Agencies

The provision of credit opinions to the standard of public issue credit ratings on financial assets. The service is to be provided by a credit rating agency that is registered or certified in accordance with CRA regulation.

Lot M: Trade and Transaction Reporting

Advice, skills and technical expertise in assessing the design and operational effectiveness of a firm’s trade and transaction reporting processes, reporting logic, systems and controls, and change management.

This should include technology backed capability for data completeness and accuracy testing for one or more of the following regulatory reporting regimes:

• Transaction reporting requirements in UK MiFIR and Commission Delegated Regulation (EU) 2017/590 (UK RTS 22)
• Instrument reference data requirements in UK MiFIR and Commission Delegated Regulation (EU) 2017/585 (UK RTS 23)
• The Regulatory Technical Standards for the maintenance of relevant data relating to orders in financial instruments: Commission Delegated Regulation (EU) 2017/580 (UK RTS 24)
• Trade reporting requirements in UK MiFIR, Commission Delegated Regulation (EU) 2017/587 (UK RTS 1) and Commission Delegated Regulation (EU) 2017/583 (UK RTS 2)
• Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories
• EMIR Technical Standards on the Minimum Details of the Data to be Reported to Trade Repositories 2023; and on the Standards, Formats, Frequency and Methods and Arrangements for Reporting 2023
• The Technical Standards (Securities Financing Transactions Regulation) (EU Exit) (No 1 and No 2) Instrument 2020.

In the context of the above regimes, this will include making recommendations for improvements to any weaknesses identified on the:

• effectiveness of the policies and procedures
• incident management process, escalation protocols and compliance risk management
• reconciliation and exception management process
• data governance, linage and traceability
• governance, operating model, senior management oversight and audit
• training, regulatory awareness and engagement, and culture in relation to regulatory reporting.

Lot N: Financial Analysis

The provision of consultancy advice and expertise on finance related consultancy. This will include but not be limited to:

• Audit and investigation
• Statistical analysis and modelling
• Financial analysis and modelling
• Data analysis and visualisation, including for large data sets
• Pensions and actuarial consultancy services, which may include inter alia broader market, product and risk analysis
• Capital and liquidity assessments
• Taxation, including but not limited to, corporate tax and value added tax
• Quantitative expertise to address regulatory issues
• Treasury management (Link Asset Services)

Lot O: Economic Regulation and Analysis

The provision of consultancy advice and expertise on competition and regulatory economics, including both theoretical and applied advice in relation to the regulation and analysis of financial services. The areas of expertise will include, but not be limited to:

• Cost Benefit Analysis, including valuation of non-market impacts
• Ex-post evaluation of policies, including process evaluation, impact evaluation and value-for-money evaluation
• Experimental and quasi-experimental research designs
• Econometric and qualitative research methods
• Competition economics, including market definitions, supply-side and demand-side assessments
• Assessment of consumer needs or preferences, including understanding specific consumer groups such as vulnerable consumers
• Behavioural economics, including choice architecture
• Microeconomics, including industrial organisation, strategic behaviour, game theory and incentive design
• Financial economics, including the economics of wholesale financial markets
• Macroeconomics, particularly relating to economic growth, productivity and international competitiveness
• Economics of regulation, including price controls, infrastructure cost and cost of capital assessments
• Regulatory strategy and policy, including regulatory approaches and remedy design

Lot P: Business Consultancy

The provision of business consultancy advice relating to strategy, structure, management and/or Relevant Participating Authority operations. This covers advice and/or the delivery of complex, multi-discipline projects/work streams/programmes or portfolios. This will include, but not be limited to:

• Transformation, strategy and management
• Operating Models (including People, Technology, Process)
• Process re-design and re-engineering
• Strategy development and review
• Change management (including communications and training)
• Organisational design and development
• Workforce transformation
• Operational Resilience
• Project / programme framework design – including methodologies, processes, artefacts and tooling
• Full project/programme delivery and assurance & delivery across methodologies (i.e.Waterfall, Agile)
• Reviews (including Value for Money review, Contract review and independent Peer review of projects/programmes)
• Markets knowledge and technical knowledge (i.e. schemas and taxonomies such as SFTR/EMIR.

Lot Q: Technology

The provision of consultancy services relating to the identification, design and delivery of technology including the resources, processes and assets to meet the Relevant Participating Authority objectives and/or end user service needs. This includes auditing current service provision, continuous service improvement and developing innovative services. This will include, but not be limited to:

• Technology strategy & operationalisation, and architecture
• Process design and improvement, including through Lean and Agile methodologies and the ITIL Framework
• Digital Operating Models
• AI
• Capability Analysis (including process and technology)
• Product and technology roadmap
• Enterprise security services
• Transition and transformation of existing technology services
• User experience
• Accessibility
• Solution design and delivery
• Test strategy and execution
• Product lifecycle
• Technical authoring

Lot R: Resource Augmentation

The provision of ad-hoc resources to augment Relevant Participating Authority teams. The individuals will have an Relevant Participating Authority line manager and deliverables will be specific to the requirements of the assignment. These roles will typically be varied and be filled based on the skillset and the number of years’ experience. Typical roles will include, but are not limited to:

• Forensic Accountant
• Expert Witness
• Change Management Specialists (all roles)
• Data Specialists (all roles)
• Actuaries
• Economists
• Strategy and Policy Specialists
• Technology and Digital Specialists (all roles)

NOTE:

It is envisaged that staff supplied under this Framework will generally work alongside and report directly to the Relevant Participating Authority management throughout the duration of the engagement.

Individuals will have to be employed by the providing Supplier. No third-party contractors or Associate models will be accepted.

The individuals work will not require quality assurance by the providing Supplier. The above does not apply to an Expert Witness as they must be independent – the Supplier will remain responsible for the provision and conduct of the expert witness.

Lot S: Forensic Accountancy/General Investigations

The provision of ad hoc forensic accounting and investigative services to support the work of the Enforcement operation. The services required will cover the full range of the Relevant Participating Authority’s regulatory and criminal remit and will include, but not be limited to:

• Regulatory, criminal, civil or insolvency proceedings reviewing the full range of firms and senior managers, investigating unauthorised activity and attempting to get monies back for investors who have been sold unsuitable products.
• The mis-selling of financial products, such as funds or pensions
• Financial promotion issues including inappropriate or misleading advertisements
• Misuse of client money
• Corporate governance
• Financial crime
• Consumer Credit
• Consumer duty
• Cryptocurrencies/crypto assets
• Systems and controls (with a particular focus on taking cases against senior managers)
• Market abuse
• Transaction reporting breaches
• Issues of wholesale conduct (for example those relating to systems and controls or corporate governance failings within wholesale insurers or banks)
• Unauthorised activity (including share fraud operated by boiler rooms, unauthorised collective investment schemes / deposit taking, get rich quick schemes and land banking)
• General investigation work
• Interpreting accounts (balance sheets, profit & loss accounts)
• Analysing financial statements and cash flow, trading and banking analysis
• File Reviewers - work alone or as part of a team to assess the information held on client files in terms of adequacy and compliance with industry standards/requirements; and identify key underlying issues and potential breaches of the Relevant Participating Authority rules
• Witness statement takers - drafting clear and concise witness statements recording the evidence a person can provide; and producing (exhibiting) any documents provided by the witness in support; where applicable. Required is a working understanding of both the Civil and Criminal Procedure Rules); and to undertake straight forward data analysis including updating investigative and evidential spreadsheets and databases.

Lot T: Risk/Risk Management

The provision of advice, skills and technical expertise in assessing effective controls and risk management frameworks, including identification and control arrangements to pre-empt, identify and mitigate risks. This will include but not be limited to

• Knowledge of relevant regulations and guidelines
• Creation, implementation and assessment of risk governance framework
• How use of benchmarking / industry knowledge is demonstrated into the development of a framework
• Risk appetite and risk acceptance approach
• Assessment of internal control effectiveness (design and operational effectiveness, including control testing or validation within a Three Lines of Defence model (3LOD)
• Stress testing of existing frameworks (including assessment models to ascertain risk maturity)
• Expertise in operational risk (including people, data, information management, Op res, finance, cyber risk and comms risk management), strategic risk, compliance/legal risk, conduct risk, regulatory risk, and reputational risk management
• Emerging risk identification and management
• Strength of risk mitigants
• Third party risk Management

Lot U: Multi Firm Failure

Introduction

As part of our crisis response framework, we require access to external consultants who can be deployed at short notice if a multi-firm failure (MFF) event arises. These consultants would temporarily supplement case teams in our Resolution & Insolvency (R&I) department during the acute phase of the crisis. We envisage that the length of this phase would be approximately two weeks, although it could be longer.

We hope that this facility is never needed, so there is no guaranteed volume of work; but ongoing readiness to deploy at short notice is essential.

We are inviting bids for this lot from specialist restructuring and insolvency firms, or wider professional services firms with restructuring and insolvency capabilities, who can provide consultants on short notice.

Ten bidders will be appointed to the panel (provided that ten or more achieve the pass mark), plus any firms that are tied for tenth place.

It is unlikely that a crisis will require the FCA to draw on all of the bidders appointed to the panel. The FCA will therefore allocate crisis work among the different panel firms at its discretion. This allocation will be carried out on an equitable basis, in line with the FCA’s legal duties and having regard to sector-specific capabilities and any other factors relevant to the work.

Requirements

• Bidders must have the capability to lead and support on creating and delivering effective strategies for the resolution of failing financial services firms, including in the context of large, complex and high-profile crisis events.
• Bidders must be able to provide consultants who have sector-specific capabilities to lead or support on projects involving:

o banks

o payments firms (payment services firms and e-money issuers)

o asset managers

o wealth managers

o credit unions

o insurers and insurance intermediaries

o platforms

o wholesale brokers

o central counterparties.

This is not an exhaustive list, but bidders should meet at least three of these categories.

• Bidders must be able to provide consultants who are familiar with how the Authorities (FCA, Bank of England, PRA, HM Treasury, FSCS) operate in a crisis.
• Bidders must be able to provide the consultants within 24 hours of being notified by the FCA of a crisis situation arising. The consultants must be able to hit the ground running in a high-pressure environment.
• Once a consultant has been allocated to a case, they cannot be substituted. Therefore, each consultant must be able to continue working full-time for the FCA throughout their assignment, which is likely to last around two weeks (but may take longer).
• We will have periodic touch points with the consultants, including training and readiness checks. These will not exceed the equivalent of 1.5 days per year, and will be provided at no cost to the FCA. There will be benefit to the consultants in participating in these exercises in the form of increased knowledge and awareness of the FCA’s work.
• Conflict management is an important consideration for this Lot. In a crisis situation, the workloads of insolvency and restructuring practices are likely to be such that conflicts of interest and duty may arise when the FCA calls on panel firms. We envisage that the same panel firm may be providing services across the Authorities and to business; and that different teams within the same panel firm may be engaged by different parties. Managing any conflicts in such a situation will be a matter for the relevant firm(s).