The Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) have fined R. Raphael & Sons plc (Raphaels) for failures in the management of its outsourcing arrangements.

Raphaels received separate fines of £775,100 from the FCA and £1.11 million from the PRA in respect of breaches between April 2014 and December 2016 which exposed customers to “unnecessary harm and inconvenience”.

Only the bank’s design of new outsourcing policies and procedures to remedy the failings saved it from larger joint fines of £2.7 million – the action having qualified it for a 30% reduction in the fines imposed by the FCA and PRA.

Mark Steward, FCA executive director of enforcement and market oversight, said: “Raphaels systems and controls supporting the oversight and governance of its outsourcing arrangements were inadequate and exposed customers to unnecessary and avoidable harm and inconvenience.

“There is no lower standard for outsourced systems and controls and firms are accountable for failures by outsourcing providers.”

The PRA’s deputy governor for prudential regulation and chief executive, Sam Woods, said: “Firms’ ability to manage outsourcing of any critical activities is a vital part of maintaining their safety and soundness.

“Such outsourcing is an important part of a firm’s operational resilience, and particularly so in the case of Raphaels given the level of reliance on outsourcing in its business model.

'”In addition, this was a repeat failing which demonstrates a lack of adequate and timely remediation. This is a significant aggravating factor in this case, leading to an uplift in the penalty.”

Raphaels’ Payment Services Division (PSD) operates prepaid card and charge card programmes in the UK and Europe.

The PSD relies on outsourced service providers to perform certain functions that are critical to the operation of its card programmes.

These functions include the authorisation and processing of card transactions, a service performed by third party card processors.

According to the findings of the FCA and PRA, Raphaels failed to have adequate processes to enable it to understand and assess the business continuity and disaster recovery arrangements of its outsourced service providers - particularly how they would support the continued operation of its card programmes during a disruptive event.

A statement issued by the FCA said: “The absence of such processes posed a risk to Raphaels’ operational resilience and exposed its customers to a serious risk of harm.

“These risks crystallised on the 24 December 2015 when a technology incident occurred at a card processor.”

The FCA said that incident had caused the complete failure of the authorisation and processing services it provided to Raphaels and lasted over eight hours.

During this period, 3,367 customers were unable to use their prepaid cards and charge cards.

In total, the card processor could not authorise 5,356 customer card transactions attempted at point of sale terminals, ATM machines and online.

Seasonal workers, who depended on their cards to receive their wages, meanwhile, used the largest prepaid card programme affected by the incident.

The timing of the incident, on Christmas Eve, is likely to have exacerbated the impact of the outage, the FCA said.

The FCA’s statement added: “Raphaels’ specific failings in relation to the incident resulted from deeper flaws in its overall management and oversight of outsourcing risk from Board level down.

“The joint FCA and PRA investigation identified weaknesses throughout the Firm’s outsourcing systems and controls which Raphaels ought to have known about since April 2014.

“These included a lack of adequate consideration of outsourcing within its Board and departmental risk appetites, the absence of processes for identifying critical outsourced services and flaws in its initial and on-going due diligence of outsourced service providers.

“Raphaels’ outsourcing arrangements continued to be inadequate until the end of 2016, by which time Raphaels had designed new outsourcing policies and procedures to remedy the failings.”

Raphaels exited the automotive sector in May last year.

A statment issued by Raphael Finance stated that a strategic decision to exit the market had been made by its parent bank, Raphaels Bank, and all new-business lending in motor finance would cease from May 17, 2018.