You are viewing COREPRU 7 Overall risk assessment as it appeared on 25/10/2027. The current version of COREPRU 7 Overall risk assessment was last updated on 25/10/2027.

COREPRU 7.1 Overall risk assessment

Application

25/10/2027R

COREPRU 7 (Overall risk assessment) does not apply to a firm that is both a CRYPTOPRU firm and a MIFIDPRU investment firm.

25/10/2027G

The effect of COREPRU 7.1.1R is that, where a firm is both a CRYPTOPRU firm and a MIFIDPRU investment firm, only the requirements in MIFIDPRU 7 (Governance and risk management) apply.

Purpose

25/10/2027G

The overall purpose of COREPRU 7 is to ensure that a firm:

  1. (1) has appropriate systems and controls in place to identify, monitor and, if proportionate, reduce all risks from the ongoing operation or winding down of the firm’s business that may cause material harm; and
  2. (2) holds financial resources that are adequate for the business it undertakes.
25/10/2027G
  1. (1) COREPRU 7 contain rules and guidance which supplement:
    1. (a) the appropriate resources threshold condition in Schedule 6 to the Act, under which a firm must have appropriate resources in relation to the regulated activities that it carries on;
    2. (b) Principle 3 (Management and control), under which a firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems;
    3. (c) Principle 4 (Financial prudence), under which a firm must maintain adequate financial resources; and
    4. (d) the systems and controls requirements in SYSC, in particular SYSC 4.1.1R, under which a firm must have robust governance arrangements, which include effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms.
  2. (2) The requirement for a firm to carry out an overall risk assessment is the articulation of the requirements in (1).
25/10/2027G

This chapter builds on the requirements in COREPRU 7.1.4G and explains how a firm applies them to carry out its overall risk assessment.

25/10/2027G

The rules and guidance in COREPRU 7 also build on the FCA’s general approach to assessing the adequacy of financial resources, as explained in Finalised Guidance, FG20/1 (Our framework: assessing adequate financial resources), which can be found on the FCA’s website at https://www.fca.org.uk/publication/finalised-guidance/fg20-1.pdf. Firms should refer to that guidance when considering their obligations under COREPRU 7.

25/10/2027G

A firm should also refer to the rules and guidance on any supplementary requirements on the overall risk assessment in the sectoral prudential sourcebooks (as applicable).

COREPRU 7.2 Overall risk assessment

Overall risk assessment: baseline requirement

25/10/2027R
  1. (1) Reflecting the requirement in SYSC 4.1.1R, a firm must have in place appropriate systems and controls to identify, monitor and, if proportionate, reduce all risks from the ongoing operation or winding down of the firm’s business that may cause material harm:
    1. (a) to the firm’s clients and counterparties; or
    2. (b) to the markets in which the firm operates.
  2. (2) If any risks that may cause material harm remain after a firm has implemented the systems and controls in (1), the firm must assess whether to hold own funds or liquid assets to mitigate those risks.
  3. (3) The requirements in this rule apply to a firm’s entire business, including:
    1. (a) all regulated activities; and
    2. (b) any unregulated activities.
  4. (4) The systems, controls and procedures operated by a firm to comply with the requirements in this rule are known as the overall risk assessment.
25/10/2027R

A firm’s overall risk assessment must be proportionate to the nature, scale and complexity of the business carried on by the firm.

25/10/2027G
  1. (1) A firm’s overall risk assessment is the collective term for the internal systems and controls that a firm must operate on an ongoing basis to identify, monitor and, if proportionate, reduce all risks from the ongoing operation or winding down of the firm’s business that may cause material harm.
  2. (2) As part of its overall risk assessment, a firm should consider what proportionate measures it can take to reduce risks that may cause material harm. The nature of such measures will vary depending on the firm’s business and operating model. Examples may include implementing additional internal systems and controls, strengthening governance and oversight processes or changing how the firm conducts certain business. A firm will need to form a judgement about what is proportionate for its particular circumstances. That judgement will be informed by the firm’s risk appetite.
  3. (3) A firm must assess whether it should hold own funds or liquid assets to mitigate risks that may cause material harm that it has identified under its overall risk assessment. This may be the case where the firm cannot identify other proportionate measures to mitigate risks that may cause material harm, or where it has applied these measures, but a residual risk of material harm remains. Any assessment must be realistic and based on severe but plausible assumptions.
  4. (4) A firm should therefore use its overall risk assessment to ensure it complies with the overall financial adequacy rule.

Overall financial adequacy rule

25/10/2027G

COREPRU 2.3 sets out the overall financial adequacy rule, which is the standard that the FCA applies to determine whether a firm has adequate financial resources.

Calculating the own funds threshold requirement and liquid assets threshold requirement

25/10/2027R
  1. (1) Subject to (2) and (3), a firm must use the assessment in COREPRU 7.2.1R(2) to calculate:
    1. (a) its own funds threshold requirement; and
    2. (b) its liquid assets threshold requirement,
  2. to comply with the overall financial adequacy rule.
  3. (2) The amount of the own funds threshold requirement is the higher of:
    1. (a) the firm’s own funds requirement; and
    2. (b) the amount of own funds resulting from the firm’s overall risk assessment.
  4. (3) The amount of the liquid assets threshold requirement cannot be lower than the sum of:
    1. (a) the firm’s basic liquid assets requirement; and
    2. (b) any applicable sectoral liquidity requirement.
25/10/2027G

COREPRU 7.2.5R complements the requirement in COREPRU 7.2.1R on the overall risk assessment by setting out how the firm determines the amount of own funds and liquid assets that it needs to hold to comply with the overall financial adequacy rule. The resulting own funds threshold requirement cannot be lower than the firm’s own funds requirement. The resulting liquid assets threshold requirement cannot be lower than the sum of the firm’s basic liquid assets requirement and any sectoral liquidity requirement.

25/10/2027G

A firm should also refer to any supplementary rules and guidance on the overall risk assessment in any applicable sectoral prudential sourcebook.

Reviewing and documenting a firm’s overall risk assessment

25/10/2027R

A firm must:

  1. (1) carry out its overall risk assessment on an ongoing basis; and
  2. (2) review the adequacy of its overall risk assessment:
    1. (a) at least once every 12 months; and
    2. (b) irrespective of any review carried out under (a), following any material change in the firm’s business model or operating model.
25/10/2027R
  1. (1) A firm must:
    1. (a) document any review carried out under COREPRU 7.2.8R(2);
    2. (b) keep adequate records of its overall risk assessment; and
    3. (c) retain the documentation and records in (2) for at least 3 years from the date on which the relevant document or record was approved.
  2. (2) The documentation and records produced by the firm to comply with (1) are referred to as the overall risk assessment document.

Embedding the overall risk assessment

25/10/2027R

A firm must embed the overall risk assessment within the firm’s business model and strategic decision making.

Point In Time
25/10/2027