The U.K. Financial Conduct and Prudential Regulation authorities imposed a combined fine of roughly £1.9 million on R. Raphael & Sons Plc for failing to manage its outsourcing arrangements properly between April 2014 and December 2016.
The FCA imposed a £775,100 fine on the lender, while the PRA handed a penalty of roughly £1.1 million.
Raphaels' Payment Services Division, or PSD, which operates prepaid card and charge card programs in the U.K. and Europe, relies on outsourced service providers for critical functions to the operation of its card programs.
The regulators said the bank lacked adequate processes to understand and assess the business continuity and disaster recovery arrangements of its outsourced service providers, specifically how they would ensure the continued operation of its card programs during a disruptive event. On Dec. 24, 2015, such an incident took place locking out 3,367 customers from accessing their services during the holiday season, and an investigation carried out by the regulators into the incident identified weaknesses throughout the firm's outsourcing systems and controls that the company should have known about since April 2014.
The bank's outsourcing arrangements remained inadequate until the end of 2016, when it designed new outsourcing policies to address the previous flaws in the system, according to the regulators.
The bank, by agreeing to resolve the matter, qualified for a 30% reduction in the fines imposed by the regulators. Otherwise the combined total fine from both regulators would have totaled roughly £2.7 million.