Financial Services and Markets Bill [HL]

Lord Holmes of Richmond Excerpts

Committee stage
Monday 6th July 2026 Grand Committee

Moved by

[Lord Holmes of Richmond]

130: After Clause 22, insert the following new Clause—
“Digital operational resilience of regulated firms(1) The FCA and the PRA must each make rules requiring authorised persons to meet minimum standards of digital operational resilience, including standards relating to—(a) ICT risk management frameworks appropriate to the nature, scale, and complexity of the authorised person's operations;(b) classification, reporting, and remediation of major ICT-related incidents, including cyber attacks, within timeframes to be specified by the regulator;(c) oversight and contractual requirements for third-party ICT service providers, including cloud service providers and critical technology suppliers; (d) regular digital operational resilience testing, including advanced threat-led penetration testing for systemically significant firms.(2) In making rules under subsection (1), the FCA and PRA must have regard to—(a) the need for proportionality with respect to the size and systemic importance of authorised persons;(b) international standards and frameworks, including those adopted by the European Union;(c) the need to avoid duplication with existing regulatory requirements.(3) The FCA must publish a consolidated digital operational resilience framework within 18 months of this Act coming into force, setting out how requirements under this section interact with existing obligations on authorised persons.(4) The FCA and PRA must review rules made under this section no later than every 12 months.”Member’s explanatory statement
This amendment seeks to require the FCA to make rules in relation to the digital operational resilience of financial services firms.

[Lord Holmes of Richmond (Con)]

My Lords, it is a pleasure to open day 5 of Committee on the Financial Services and Markets Bill. In moving Amendment 130, which is in my name, I will also speak to Amendments 131 and 168. This is the latest round of AI and technology amendments to the Bill. It is a Bill that is curiously silent on these subjects. At least today there is something timely about my intervention in that, as I am on my feet, across town Sheldon Mills is launching his review into artificial intelligence in financial services—more of which presently.

Amendment 130 seeks to require financial services firms to have regard to all the issues around digital and operational resilience across all their activities. I know that the Minister in his response will refer to the cyber resilience Bill, which is coming to your Lordships’ House in a fortnight. Indeed, there is much in that Bill to commend. But in consideration of the significant impact and position of financial services in the UK economy, I believe that it would be helpful to have something about digital and operational resilience in this Bill.

We are not just talking about foreign states or negative acts from international adversaries; we are talking about issues around supply chain, third-party overreliance and concentration risk on particular providers—for example, in the cloud. Circumstances change and financial services institutions, believing that things will always be as they are, may find themselves extraordinarily exposed by the flick of a switch with perhaps only 90 minutes’ notice. I ask the Minister to consider this when he responds and state, in respect of financial service institutions’ significant contribution and place in the UK economy, whether he agrees that clauses in the Bill pertaining directly to these subjects would be helpful in our endeavours.

Amendments 131 and 168 are on artificial intelligence. Certainly, some of these concepts are covered in Sheldon Mills’ review. Given the proliferation and already deep penetration of artificial intelligence into financial services institutions—and, indeed, its use by not only sophisticated but retail and individual investors—will the Minister not agree that considering AI, not just in these clauses but throughout the Bill, would be beneficial to all those involved in financial services? When we say, “all those involved in financial services”, we could just as easily say “everybody”. The principles are clearly set out in Amendment 131, which takes us to the issue that I have raised on previous days around the Government’s approach to artificial intelligence. As stated, that is a domain-by-domain approach, yet there is nothing currently within this Bill.

Amendment 168 returns to an issue of which colleagues will be well aware, because I raised it when we deliberated on the Financial Services Act 2021 and FSMA 2023. That is to have an officer responsible for AI in all financial services institutions that develop, deploy and use AI—in other words, pretty much all financial services institutions. This is not cumbersome; it is not about compliance and it is certainly not about putting burdens on smaller firms—the proportionality principle would mean that we would be talking about a function rather than an individual—nor is this about delegation or abdication of the board’s responsibility, or indeed the senior managers’ responsibility, to the business. This is about having a point person: somebody who can orchestrate, who can co-ordinate and who can have that crucial horizontal view across an organisation, to assist internally and indeed present externally as to how AI is being used and deployed, for the benefit both of AI use internally and of customers.

To conclude, without having clauses on AI in the Bill, I believe that the legislation will be chronically insufficient for the challenges of our time. That is not the challenges of next year or five years’ time: AI is already impacting financial services right now. To give one example, how can we consider the consumer duty without considering how AI impacts on all elements of that? The Mills review has much good in it, but this legislation is before us today, and I believe that we have an opportunity to thread AI through it for the benefit of individuals, of institutions, of all of our financial services and, through that, of the entire economy of the United Kingdom. I look forward to the Minister’s response. I beg to move.

[Baroness Kramer (LD)]

My Lords, I was delighted when I saw that the noble Lord, Lord Holmes, had put down these amendments, because it is so apparent, as he has clearly stated, that the whole issue of digital and AI is missing from this Bill. Because of the pace of change and the impact—and strength of the impact—across all our financial services, this is an issue that has to be dealt with and grasped with some sense of urgency.

Like the noble Lord, I have been very interested in the Mills review, although, as it was published today, I have only had time to skim its summaries and some of the newspaper references to it. It is clear that, certainly from Sheldon Mills’ perspective—I think that most of us have, one way or another, dealt with Sheldon Mills over the years and very much respect his judgment—the FCA may well be short of relevant powers in dealing with AI. He noted particularly a lack of powers under the critical third-parties regime, which made sense to me. In his recommendations, he also raised issues around the regulatory perimeter, another area that we have raised on more than one occasion.

In recent years, it has not been uncommon—though I dread it—for the Government to present on Report amendments that deal with an area that has been missed from the body of a Bill in Committee. On this Bill, that would allow a period of thought and the opportunity to absorb and consider what is presented in the Mills review. Since financial services Bills do not come around that often, I very much hope that the Minister will seriously consider taking advantage of the Bill to get those kinds of protections in place. If he fails to do that, we might collectively have to come forward with something on Report. Frankly, given the intricacy, detail and complexity, this is an area where the Government coming forward with an answer would, I think, be welcomed across the House and very much, I hope, within the spirit and theme of the amendments presented by the noble Lord, Lord Holmes.

--- Later in debate ---

The Government are conscious of the risks associated with cyber resilience and AI and have been proactive with the regulators to ensure that the financial services sector is appropriately managing those risks for consumers and financial stability. I hope I have provided some reassurance that the Government and the regulators are alive to the risks identified and taking proactive steps to manage them. I ask the noble Lord to withdraw his amendment.

[Lord Holmes of Richmond (Con)]

I thank all noble Lords who have taken part in this debate and the Minister for his response. I look forward to reading the Mills review in further detail and seeing where we take these issues between Committee and Report. For now, I beg leave to withdraw the amendment.

Amendment 130 withdrawn.

--- Later in debate ---

[Lord Vaux of Harrowden (CB)]

My Lords, this group is really two separate groups as far as I can see, and I am not quite sure why they have been lumped together. One is on operational readiness and the other is on the different treatment of wholesale and retail activities. I will add my support briefly to the principles behind the latter, on wholesale and retail activities, and to Amendments 142A and 142C, tabled by the noble Lords, Lord Hunt and Lord Ashcombe. These bring us back to proportionality, which we have debated a number of times. The Minister can probably see a few themes coming through, and proportionality is definitely one.

In this case, the question is whether the regulators treat wholesale businesses with no retail customer exposure proportionately. By definition, wholesale businesses are dealing with sophisticated customers on a much more equal basis. It cannot be controversial to suggest that the regulation of these businesses could be lighter touch than for those dealing with retail customers.

The report of the Financial Services Regulation Committee on the secondary competitiveness and growth objective gave a number of examples where it appears that the FCA may not be doing enough to differentiate between these two parts of the market, while recognising that this is not always a clearly defined black and white boundary. Howard Davies put it well in his witness evidence:

“In wholesale markets, you are aiming to produce a fair contest, whereas in the retail markets you know it is not a fair contest because there is a significant information asymmetry problem between the consumer and the firm”.


The noble Lord, Lord Hunt, quoted the committee’s conclusion on this matter, so I will not repeat that. Whether this means that we need a separate wholesale markets and firms division within the FCA, as the amendments propose, is debatable, but I will be interested to hear how the Minister proposes to ensure that businesses that are primarily or wholly wholesale in operation are regulated proportionally.

[Lord Holmes of Richmond (Con)]

My Lords, I support Amendments 142A and 142C from my colleagues, the noble Lords, Lord Hunt and Lord Ashcombe. As has been said, this can be summed up in one word: proportionality. We have debated these themes on previous days in Committee and they are still as strong as they were when we mentioned them on day one. To “proportionality” I would add “specificity” and “applicability” because, without making this critical distinction—though difficult in some of the marginal cases—we are effectively saying that rules apply across the piece, which inevitably means increased burdens, increased costs, a lack of specificity, inapplicability, and holding firms and the UK economy back.

As the noble Lord, Lord Hunt, rightly said, we have the at least odd situation right now where pet insurance is treated the same as marine or aviation insurance. I can see only one potential case where this would be appropriate: if many people were petting flying fish. As I do not believe we have an increase in flying fish petting, I believe that proportionality, specificity and applicability would be achieved by embracing the principles set out in Amendments 142A and 142C.

[Baroness Bowles of Berkhamsted (LD)]

My Lords, I broadly support Amendment 142A, and I thank the noble Lord, Lord Hunt, for bringing it forward. I also think that the amendment in the name of the noble Lord, Lord Ashcombe, or something similar would obviously be needed as some kind of companion to it.

Whatever the FCA may have been intended to be, it is now proudly and explicitly a consumer protection body. For much of its work that is good, but some noble Lords will know that it has taken me and others four years to get incorrect cost disclosure descriptions for listed investment companies corrected, simply because consumers like the incorrect versions. Indeed, that saga led to a telling exchange at a meeting of the Financial Services Regulation Committee. The FCA chair insisted that consumer views always took priority, and I replied, “If you ask whether one and one makes two or three, and the consumer says, ‘I like three—it’s a bigger number’, is that what you use?” There was no denial. That is the scale of the problem: a regulatory culture where consumer preference for something factually incorrect overrides market integrity. It is a mindset that has already cost billions in potential investment in productive assets.

That was where it touched consumers; now let us move on to look at the wholesale areas. The trouble is that that mindset gets pasted across too. We do not need to debate whether the FCA went overboard in demanding that wholesale businesses had to proactively prove that they do no consumer harm in transactions that never touched consumers. The admission is there in consultation CP26/23 at paragraph 1.3, acknowledging overreach, as well as acknowledging

“unnecessary cost, complexity and uncertainty, without clear benefits for retail consumers”.

However, having finally identified the cancer, the regulator is merely applying a sticking plaster. All that is being offered is the mildest semantic tweak to guidance—effectively, a guide to guidance. It has no legal effect. It allows the regulator to continue its current trajectory with a slight adjustment to its vocabulary. We all know that this change was extracted only after heavy nudging by the Chancellor and intense parliamentary scrutiny. It is hardly being done with good grace and provides no guarantee of permanence.

The fact is, we must deal with the FCA as it is, not as it might have been. Since the advent of the consumer duty, the retail-first culture is irreversibly embedded into the psyche of staff, and in many instances it is the reason why they joined the regulator in the first place.

Perhaps one of the most telling things is to look at what is said about other regulators. On the Monetary Authority of Singapore, which I found a very enlightened body on my visit there some years ago, the comment is, “Although MAS is a unitary regulator, it splits its internal policy divisions strictly by target market rather than by trying to govern everything under an overarching outcomes-based code like the UK’s consumer duty”, and, “It works because the wholesale division, answerable to the MAS leadership, is judged primarily on market liquidity, innovation and international competitiveness. There is zero risk of a consumer advocacy group hijacking a wholesale policy consultation”. I wonder where they were thinking about. A ring-fenced, structurally separate wholesale unit within our regulator’s architecture must live up to that standard.

Some may argue that all wholesale activity impacts retail eventually, and I agree, but there is a massive, fundamental difference between regulating wholesale markets for the integrity of the system, which protects everyone, and regulating as if they are a high-street retail shopfloor. The former ensures safety, the latter ensures paralysis. For any noble Lord worried about this structural change, nothing being suggested would remove liability for wrongs or harms to consumers, should that occur. Let us be clear: this amendment is not an attempt to escape oversight; it is an attempt to ensure that oversight is competent, technically accurate and focused on the reality of the market being regulated. Let nobody forget that MiFID and other legislation already provides a rigorous framework governing transparency, best execution and conflicts of interest. This is no soft ride: this amendment is a necessary structural correction, and I support it.