Stay informed with free updates
Simply sign up to the Financial services myFT Digest — delivered directly to your inbox.
The Bank of England has imposed an £11.9mn fine on Vocalink, an offshoot of Mastercard that operates a key part of UK payments infrastructure, over its “ineffective risk management framework” and weaknesses in internal controls and governance.
The BoE said on Wednesday that the fine reflected Vocalink’s failure to comply with the central bank’s requirement for it to fix a number of weaknesses in its systems and controls identified by supervisors by February 2022.
The penalty is a stinging rebuke for Vocalink, which operates a crucial part of UK financial infrastructure and was bought by Mastercard for £700mn from a group of 18 UK lenders in 2016.
Its systems underpin the Bacs direct debit system that pays 80 per cent of British wages, the UK Faster Payments system that handled £4.2tn of transfers last year and the UK ATM Link platform covering 47,000 cash machines.
“Vocalink fell short of its obligation to have adequate risk management and governance arrangements when responding to the Bank’s direction,” said Sarah Breeden, deputy governor for financial stability. “Its failure to comply with that direction in full has resulted in a significant fine.”
The fine represents the first of its kind levied by the BoE on a financial market infrastructure provider.
The BoE told Vocalink to hire an “expert person” to check it had fixed risk management weaknesses after the company told the central bank it had done so — despite a consultant working on the process telling executives it had fallen short.
The expert’s report criticised Vocalink’s work to address the BoE’s direction and found it had failed to comply with the requirements.
The central bank said Vocalink’s subsequent co-operation and its early admission of its compliance failures reduced its fine by 15 per cent. It also qualified for a 30 per cent reduction by agreeing to resolve the matter. Without this mitigation, the fine would have been £20mn.
The BoE said Vocalink had “invested significantly in remediating the issues” that led to the initial risk management problems and the subsequent failure to fix them.
Vocalink said: “We are pleased to resolve this matter which related to issues identified in 2020. Since then, we’ve delivered a number of improvements, as recognised in the Bank’s final notice. The historic issues related to internal systems and controls and had no impact on the service we delivered to UK consumers and businesses.”
As the sole operator of the UK’s real-time payment system, Vocalink in effect has a monopoly. In addition to the majority of salaries, its infrastructure is also responsible for processing 70 per cent of household bills and almost all state benefit payments.
Vocalink was formed in 2007 from the merger of Bacs and Link. Last year Pay.UK, the government-backed body that sets the standards for the UK’s payments system, ran a process to find an alternative operator. Tata Consultancy Services, the Indian IT giant, was at one stage in the running to replace Vocalink.
However, the appointment of a new operator was placed on hold while the government published its new strategy for the sector.