PRA fines and enforcement actions in 2016

The Prudential Regulation Authority (PRA) issued a Final Notice on 19 November 2014 fining The Royal Bank of Scotland Plc, National Westminster Bank Plc and Ulster Bank Ltd £14,000,000 for failures in IT risk management between 1 August 2010 and 10 July 2012. The PRA found the Group‑wide Technology Services function did not manage or plan changes to IT systems adequately, the IT-specific 'three lines of defence' did not control IT risks effectively, and the group had a limited understanding of IT operational risk. The breach was of the FSA’s Principle 3 (now PRA Fundamental Rule 6) — i.e. the requirement to have adequate systems and controls to identify and manage risks. The FCA register records this action on 5 February 2016.