UK regulators propose oversight for financial third parties

Specifically, the three regulators have proposed measures to improve oversight and bolster the resilience of services offered by critical third parties (CTPs) to UK-regulated financial services firms and financial market infrastructure entities (FMIs). 

CTPs contribute various services to firms and FMIs, delivering operational resilience and fostering innovation. However, the potential disruption or failure of these third-party services poses risks to UK financial stability according to the Bank of England. Recognising the limitations of individual firms and FMIs in managing these risks independently, the regulators are seeking an appropriate and proportionate level of direct regulatory oversight. These proposed measures are designed to complement existing responsibilities of firms and FMIs, rather than replacing or changing them. 

Officials from the Prudential Regulation Authority emphasised the importance of consulting on proposals to effectively manage risks associated with third-party service providers, acknowledging their vital role in delivering essential services by banks and insurers. 

Moreover, the Deputy Governor for Financial Stability highlighted the increasing dependence of financial market infrastructure firms on third-party technology providers and underscored the necessity of managing systemic risks to ensure the resilience of critical services. 

Officials from the FCA noted the potential benefits of well-managed outsourcing but acknowledged the risk of significant impact in case of disruption or failure. The proposed measures are seen as a means to enhance the resilience of critical third-party services, supporting market integrity and contributing to the competitiveness and growth of the UK financial sector.

A closer look at the proposals and what they involve

The proposals outline how regulators may identify potential CTPs and recommend their designation to HM Treasury. Key elements include fundamental rules applicable to all services provided by CTPs, along with specific operational risk and resilience requirements for material services. CTPs are expected to provide information and assurance to regulators, including annual self-assessments and scenario testing to demonstrate their ability to deliver services under severe disruptions. 

While critical third parties will not be fully authorised or overseen by regulators, their third-party services will be monitored against these proposals once finalised. Feedback on the consultation paper is open until 15 March 2024, with the regulators aiming to publish final requirements and expectations for CTPs in the second half of 2024, subject to feedback.