The Bank of England's Financial Policy Committee, the body charged with protecting the resilience of the UK financial system as a whole, kept its overall risk assessment at 'elevated' in its November Financial Stability Report, published on Wednesday. The unchanged headline is not, however, the whole story. Buried in the supporting material are a number of important shifts in the committee's thinking — on private credit, on the commercial real estate sector, and on the operational resilience of banks and clearing houses to cyber attack.

Presenting the report at a press conference at the Bank, the FPC's chair, Andrew Bailey, said the committee's overall judgement was that "the UK financial system remains resilient, but that the risks around the global outlook have become more skewed to the downside" since the summer. The committee's central scenario continues to assume a soft landing for the UK economy; the alternative scenarios it now weights more heavily are a sharper slowdown in global growth and a materialisation of one of several tail risks it identifies.

Private credit: a new chapter

The most prominent new section of the report is on private credit, an asset class that has grown from a niche corner of the alternatives market to a $1.7 trillion global industry in the space of a decade. The FPC does not, in this report, identify the asset class as a systemic risk. It does, however, flag a number of concerns — about leverage, about liquidity mismatches, and about the opacity of the funds that hold these assets.

It also notes that the banks have become increasingly exposed to private credit, both directly and through the subscription lines and capital call facilities they extend to funds. The FPC asks the Prudential Regulation Authority to "consider whether existing prudential standards adequately capture these exposures" and to report back in the spring.

Cyber: a new operational resilience regime

The FPC's second major new section is on operational resilience, and in particular on cyber risk. The report notes that the number of significant cyber incidents affecting UK financial firms has roughly doubled in the last two years, and that the average time to restore service has lengthened. The FPC announces that it intends to consult, in the new year, on extending the operational resilience regime to a wider set of firms — including the largest asset managers and some of the central counterparties.

It also calls on firms to "invest in the people, processes and technology" needed to maintain service through a major cyber incident, and to "test, test, and test again" their recovery arrangements. The Bank's own operations, the report notes reassuringly, have been independently audited as meeting the most stringent resilience standards.

Commercial real estate: a watched sector

The FPC continues to keep a close watch on the commercial real estate sector, where refinancing risks have grown as higher gilt yields have fed through into the cost of debt. The report notes that aggregate CRE exposures at the major banks have continued to fall, but that smaller, more specialist lenders remain under pressure. The FPC asks the PRA to maintain a "vigilant supervisory posture" and to ensure that any firm in the sector with material capital or liquidity issues is engaged with "at the earliest possible stage."

What it means for the system

For the banks themselves, the FPC's report is broadly reassuring. CET1 ratios at the major UK banks stand at an average of 14.7 per cent, well above regulatory minima; liquidity coverage ratios remain robust; and the Bank's own stress tests, last run in the summer, suggest that the system could absorb a severe but plausible scenario without breaching capital requirements.

That is, however, a description of a system in good health. The FPC's report is a reminder that the risks around the system are not static, and that the committee's job is to look around corners — at private credit, at cyber, at the way the banks' exposures are evolving. By the standards of the last decade, this is a comfortable report. By the standards the FPC sets itself, it is a vigilant one.