The Bank of England fines Vocalink Limited £11,900,000 for a compliance failure

News release

The Bank of England (the “Bank”) has fined Vocalink Limited (“Vocalink”) £11,900,000 in respect of a compliance failure under section 196 of the Banking Act 2009 (the “Act”). This is the first time the Bank has fined a financial market infrastructure firm. Vocalink has been regulated by the Bank since April 2018 as a specified service provider, a type of financial market infrastructure firm involved in the operation of UK payments systems.

Vocalink was required by the Bank to remediate a number of identified systems and controls issues via a direction issued under section 191 of the Act (the “Direction”). Vocalink implemented a remediation programme in response and had until 28 February 2022 to comply with the Direction’s requirements. However, an ineffective risk management framework, combined with weaknesses in its controls, governance arrangements and escalation processes meant that it failed to comply in full with the Direction’s requirements by the deadline.

Sarah Breeden, Deputy Governor for Financial Stability, said:

“Vocalink fell short of its obligation to have adequate risk management and governance arrangements when responding to the Bank’s Direction. Its failure to comply with that Direction in full has resulted in a significant fine.”

The Bank’s investigation identified the root cause of Vocalink’s non-compliance was the failure to have in place a sufficiently integrated risk management framework for the remediation programme. This would have ensured that risks facing the programme could be properly understood, monitored and shared amongst the three lines of defence (and external assurance providers). It also found there were failures to escalate key risks and information to senior committees, which undermined the firm’s ability to fully comply with the Direction. The Bank considers Vocalink’s governance arrangements fell below the standards expected of a financial market infrastructure firm.

The Firm has invested significantly in remediating the issues which led to both the Direction being issued and the subsequent compliance failure.

Vocalink’s cooperation throughout the investigation, including the early admission of a compliance failure, resulted in a 15% reduction to the penalty. Vocalink agreed to resolve the matter and therefore qualified for a further 30% reduction in the fine. Without these reductions, the fine imposed by the Bank would have been £20,000,000.

Notes to editors

1. Vocalink Final Notice
2. Vocalink Limited designs, builds and operates payment systems infrastructure. It is regulated by the Bank as a ‘specified service provider’. ‘Recognised payment systems’ are payment systems recognised by HM Treasury as systemically important. They are critical to the functioning of financial markets and the economy. They allow funds to be transferred between, for example, businesses and individuals, and from business-to-business and individual-to-individual. ‘Specified service providers’ in relation to recognised payment systems are persons who provide services which form part of the arrangements constituting that payment system. The penalty in this matter is imposed upon Vocalink Limited only.
3. The Bank of England’s approach to financial market infrastructure supervision, November 2024: sets out the Bank’s supervisory expectations of service providers to recognised payment systems.
4. The Bank of England’s approach to enforcement: statements of policy and procedure, November 2024: See Annex 2 in respect of Financial Market Infrastructures.
5. Banking Act 2009
6. Under s.197 of the Banking Act 2009 we may publish details of a compliance failure and accompanying sanction and we have chosen to publish appropriate details of this action.