FinTech UK SME Banking Platform -- FCA PS21/3 Operational Resilience

PS21/3 IBS Mapping for SME bank

identifying Important Business Services.

ClickMasters PS21/3 methodology

• 1service identification (list all services -- current account, payments, cards, Open Banking, accounting integration, tax payment),
• 2IBS criteria (does disruption cause intolerable harm to customers?

For SME bank

current account access = IBS, payments = IBS, accounting integration = not IBS), (3) Impact Tolerance setting (board-approved -- current account: 4 hours, payments: 2 hours, card services: 4 hours), (4) IBS architecture design (what systems deliver this IBS? -- dependency mapping), (5) monitoring design (how do we know the IBS is unavailable? CloudWatch Synthetics from outside AWS -- synthetic transaction tests every 5 minutes).

PS21/3 March 2025 deadline

ClickMasters delivered PS21/3-compliant platform 6 months before FCA deadline.

Open Banking for SME banking

• 1TrueLayer AISP (account aggregation -- SME can see all their business bank accounts in one dashboard, not just ClickMasters bank),
• 2cash flow forecasting (bank transaction data + invoice data from accounting integration -- ML forecast of 30-day cash position),
• 3HMRC Open Banking (HMRC accepts direct bank payment via Open Banking for corporation tax, VAT, PAYE -- integration with HMRC banking service),
• 4payroll integration (Xero Payroll, Sage Payroll -- automatic bank transfer to employees on payroll date via Open Banking PISP),
• 5accounting reconciliation (Xero, QuickBooks, Sage -- automatic bank feed via Open Banking -- categorised transactions in accounting software).

FCA PS21/3 IBS

Open Banking features are not IBS (disruption does not cause intolerable harm -- core current account and payments are IBS, value-added features are not).

AML MLRs 2017 for SME banking

higher-risk customer base (SMEs have more complex beneficial ownership).

AML workflow

• 1KYB (Know Your Business -- company incorporation from Companies House, SIC code, beneficial ownership from PSC register),
• 2UBO verification (Ultimate Beneficial Owner -- any individual owning 25%+ of company -- ID verification via Onfido),
• 3adverse media screening (ComplyAdvantage -- any negative news about company or directors),
• 4ongoing transaction monitoring (unusual transaction patterns for SME -- large cash deposits, round-number international transfers, rapid account growth),
• 5SAR filing (NCA goAML -- within 24 hours of decision to file). Enhanced Due Diligence (EDD): high-risk SIC codes (money service businesses, crypto, gambling) require EDD -- additional source of funds verification, periodic review every 12 months.

PS21/3 quarterly board report automation

FCA requires board to review IBS resilience quarterly.

Automated evidence generation

• 1CloudWatch Synthetics report (IBS availability percentage for each IBS -- generated from CloudWatch metrics, formatted as PDF),
• 2incident log (any IBS unavailability during quarter -- automated from PagerDuty incident history),
• 3chaos testing results (AWS FIS quarterly test results -- AZ failure, Aurora failover, GoCardless dependency failure),
• 4change risk assessment (GitHub Actions deployment history with IBS-tagged deployments -- CAB decisions),
• 5improvement programme (any IBS that breached Impact Tolerance -- automated detection and programme tracking).

ClickMasters PS21/3 board report template

auto-generated quarterly, ready for board submission.