NatWest Markets Plc

On 19 November 2014, the PRA issued a Final Notice to the Royal Bank of Scotland Plc, National Westminster Bank Plc and Ulster Bank Ltd (together the “Banks”), which imposed on the Banks, pursuant to section 206 of the Financial Services and Markets Act 2000, a financial penalty of £14,000,000 for breach of Principle 3 of the FSA’s (and after 1 April 2013, the PRA’s) Principles for Businesses (now the PRA’s Fundamental Rule 6).  The financial penalty was imposed on the basis that, during the period between 1 August 2010 and 10 July 2012, the Banks’ failed to meet their obligation to have adequate systems and controls to identify and manage their exposure to IT risks, in particular:  i) the RBS Group’s Technology Services function (the centralised Group IT function which provides services to the Banks) did not manage and plan changes to the RBS Group’s IT systems adequately; ii) the Technology Services Risk, Business Services Risk and Group Internal Audit (together the “The Three Lines of Defence specific to IT for the Banks through the RBS Group), did not take sufficient care to control IT risks responsibly and effectively; and  iii) the RBS Group had a limited understanding of IT operational risk. A copy of the Final Notice for RBS can be found on the Bank of England website and can be accessed using the following link: