CP26/23 – Operational resilience: Critical third parties to the UK financial sector

1.7 Throughout this CP, unless otherwise stated:

• ‘requirement’ and related terms describe the regulators’ proposed rules; and
• ‘expectation’ and related terms describe the regulators’ proposed expectations of how CTPs should comply with and interpret the proposed requirements in the draft rules. These expectations are set out in the draft supervisory statement.

1.8 Likewise, throughout the draft supervisory statement:

• ‘must’ describes a proposed requirement in FSMA or the regulators’ rules; and
• ‘should’ sets out the regulators’ proposed expectations on how CTPs should comply with a proposed requirement.

Scope

1.11 The CP is also relevant to firms and FMIs. The proposals in this CP would not impose additional requirements on firms and FMIs but seek to complement their existing obligations on operational resilience and third-party risk management.

1.12 Firms and FMIs are reminded that a CTP’s designated status will not necessarily mean that it is inherently more resilient, safer, or more suitable to provide a given service to a given firm or FMI than non-designated third parties providing the same or similar services. As set out in Chapter 2, the regulators intend to recommend third parties for designation as CTPs based on their assessment of the potential impact that a failure in, or disruption to, these third parties’ services could have on the stability of, or confidence in, the UK financial system. Nevertheless, firms and FMIs will remain accountable and responsible for assessing the materiality and risks for each of their outsourcing and third party arrangements and performing appropriate and proportionate due diligence on potential third parties.

Focus on CTPs’ services to firms and FMIs

1.13 The proposals in this CP would apply only to CTPs’ services to firms and FMIs.

1.14 The regulators propose to apply the CTP Fundamental Rules in section 4 to all of the services that a CTP provides to firms and FMIs. The regulators propose that other (more granular) requirements will only apply to a CTP’s material services. For instance, the Operational Risk and Resilience Requirements in section 5, the scenario testing requirements in section 6 and the incident notification requirements in section 7. As explained in the regulators’ draft rules and joint draft supervisory statement, material services encompass those services whose failure or disruption could threaten the stability of, or confidence in, the UK financial system. They are also the services that HMT must have regard to when designating a CTP.

1.15 The proposed requirements in this CP would apply to services provided to firms and FMIs regulated by the Bank, PRA, and/or FCA (wherever carried out). The proposals are therefore agnostic as to the location of a CTP. There is no requirement for a CTP to set up a UK establishment (e.g. a subsidiary) where one does not already exist. This proposed approach recognises that CTPs may provide services from multiple jurisdictions (which can help improve the efficiency and resilience of these services). Likewise, the firms and FMIs that receive services from CTPs may operate in multiple jurisdictions. This proposed approach could also reduce compliance costs for CTPs, firms and FMIs compared to an approach that required CTPs to localise entities, infrastructure, personnel, or services in the UK.

1.16 To ensure the efficient operation of the proposed oversight regime for CTPs, certain proposals in this CP seek to ensure that there is a central point of contact for the regulators at every CTP and, for those CTPs whose head office is not in the UK, a legal person to perform certain functions on their behalf such as receiving statutory notices issued by the regulators under FSMA.

Background

The Financial Policy Committee’s focus on CTPs

1.18 In the November 2018 FSR, the FPC began closely monitoring cloud service providers (CSPs) in particular after noting that, due to high concentration in the market for cloud services, ‘disruption at one provider, for example due to cyber-attack, could interfere with the provision of vital services by several firms’.

1.20 The FPC restated these views in the Q3 2021 Financial Policy Summary and Record and Q1 2022 Financial Policy Summary and Record.

Legislative changes

1.36 As noted above, the proposals in this CP do not blur, eliminate or reduce the accountability and responsibility of firms, FMIs, their boards, and senior management (including individuals performing SMFs) for their regulatory obligations on operational resilience, and outsourcing and third party risk management.

Interaction with global standards and similar non-UK regimes

1.37 The proposals in this CP draw inspiration from relevant global standards. In particular, the:

1.48 The PRA and the Bank intend to publish a further consultation paper relating to CTPs containing a draft statement of policy on their approach to the use of disciplinary powers. This will be published in due course ahead of the final policy statement that will follow this CP and contain the final rules and expectations for CTPs. To maintain a joint approach to the regime, the FCA plans to consult on their statement of policy on the use of disciplinary powers over CTPs around the same time.

1.49 As noted above, the regulators also intend to publish a ‘CTP approach document’ setting out how they will carry out their oversight roles in relation to CTPs) in due course.

2.6 As noted in chapter 1, once designated, CTPs will be subject to the proposed requirements and expectations in this CP and be overseen by the regulators in respect of their services to firms and FMIs. The regulators propose to apply their most granular proposed requirements and expectations only to CTP’s material services to firms and FMIs.

Sources of data and information

2.13 As part of their ongoing development of a methodology for assessing the ‘materiality’ of a third party’s services, the regulators propose to build on existing regulatory publications that define systemic risk (and specific variants thereof, such as systemic cyber risk), including the:

Background

5.2 In Chapter 5 of DP3/22, the regulators set out their initial thoughts on a potential set of ‘Minimum Resilience Standards for CTPs’ (‘standards’) that would apply to their services to firms and FMIs (see Box [B]).

5.3 The potential minimum resilience standards set out in DP3/22 generated extensive responses. There was support for the idea of clear, principles-based, outcomes-focused requirements for CTPs. However, respondents urged the regulators to avoid excessively granular or prescriptive requirements. Most of the responses focused on the detail of individual standards. In particular, respondents:

• noted that the ‘Identification’ standard could be unworkable for some potential CTPs as:
  • the materiality of their services depends on how their customers use them; and
  • they do not know what firms and FMIs use their services for;
• wanted greater clarity on what the standard on ‘Engagement with the Supervisory Authorities’ may involve, in particular, whether it may include incident notification requirements for CTPs;
• supported the idea of a ‘financial sector continuity playbook’ but:
  • cautioned that requiring CTPs to implement business continuity plans, contingency plans, and other measures specifically for their firm and FMI customers could cause them to segregate their services to these customers from those services that they provide to other sectors, which could have adverse unintended consequences including diminished resilience of the relevant services, and higher costs for firms and FMIs;
  • suggested that the financial sector continuity playbook should focus on coordination and communication between CTPs, their firm, and FMI customers and the regulators during an incident; and
  • recommended the inclusion of additional standards with regard to CTPs’ cyber security, governance, and supply chain risk management.

5.4 In response to DP3/22, the regulators propose:

• not to include Operational Risk and Resilience Requirements dealing with:
  • ‘Identification’ for the reasons discussed in Chapter 5 or
  • ‘Testing’ as it would unnecessarily duplicate the proposed requirements and expectations on ‘Information-Gathering and Testing’ in Chapter [6];
• to make ‘Engagement with the supervisory authorities’ one of the proposed CTP Fundamental Rules (see Chapter [4]);
• to merge the standards on ‘Financial sector continuity playbook’ and ‘Post-incident communication’ in DP3/22 into a single Operational Risk and Resilience Requirement (renamed ‘Incident Management’);
• to apply the concept of ‘Learning and Evolving’ throughout the proposed requirements and expectations for CTPs rather than keeping it as a standalone requirement;
• introduce new Operational Risk and Resilience Requirements on dependency and supply chain risk management, technology and cyber resilience, and change management; and
• introduce proposed incident notification requirements for CTPs (see Chapter 7).

Proposed CTP Operational Risk and Resilience Requirements

5.5 The aim of the proposed Operational Risk and Resilience Requirements is to provide clear and consistent obligations that all CTPs would be required to meet in respect of their material services.

5.6 Although the proposed CTP Operational Risk and Resilience Requirements are more granular than the proposed CTP Fundamental Rules in Chapter 4, they are still outcomes-focused. They specify objectives that CTPs would have to achieve in respect of their material services, but do not propose to prescribe how they should be met.

5.7 Although a CTP should manage all relevant risks as part of its overall risk management processes under Requirement 2, there are three specific areas that the regulators propose to address explicitly and individually in Requirements 3 to 5 respectively, given their importance and relevance to the oversight regime for CTPs. These areas include dependency and supply chain risk management, technology and cyber resilience, and change management.

Requirement 1: Governance

5.9 The regulators also propose to require a CTP to notify them in writing of the name of the appointed person, their business address, and other up to date contact details including email addresses, telephone numbers, and out of hours contact details.

5.10 In the draft supervisory statement, the regulators set out their proposed expectations of what would constitute appropriate review and approval of information.

Requirement 2: Risk management

5.11 The regulators propose to require each CTP to effectively manage risks to its ability to continue to deliver a material service by:

• identifying and monitoring relevant external and internal risks;
• ensuring that it has risk management processes that are effective at managing those risks, and;
• regularly updating its risk management processes to reflect lessons learned and issues arising from:
  • a disruption to a material service;
  • engagement with regulators;
  • new and emerging risks; and
  • any associated testing, including but not limited to testing carried out in accordance with the proposals in Chapter 6 of this CP.

5.12 Many risks to a CTP’s delivery of material services are likely to be operational. The draft Supervisory Statement sets out a non-exhaustive list of examples. However, the regulators propose that a CTP should also consider financial risks that may affect its ability to deliver material services, such as the risk of insolvency.

5.13 To comply with Requirement 2, the draft supervisory statement proposes that a CTP would be expected to have a sound risk management framework to manage risks to the delivery of material services. The regulators expect that such a framework would include:

• strategies, policies, and procedures to identify, measure, monitor, and report on relevant risks (including a risk appetite);
• policies and procedures to control and manage risks within the CTP’s risk appetite; and
• mechanisms to periodically review and ensure that the strategies, policies, and procedures referred to above were designed and operating effectively.

5.14 A CTP would also be expected to monitor risks on an ongoing basis, including through horizon scanning and the use of threat intelligence.

Requirement 3: Dependency and supply chain risk management

5.17 To comply with Requirements 2 and 3, the regulators propose in the draft supervisory statement that a CTP would be expected to:

• perform appropriate due diligence before entering into sub-contracting arrangements that are key to its delivery of material services and monitor these arrangements on an ongoing, or regular (at least annual) basis thereafter;
• be transparent with the regulators and its firm and FMI customers about which parts of its supply chain are essential to its delivery of material services;
• obtain appropriate information about incidents in its supply chain;
• include scenarios involving supply chain disruption in its testing; and
• incorporate lessons learned from disruption to and testing of its supply chain into its risk management and incident management processes (see Requirements 3 and 7).

5.18 The regulators propose to require a CTP must ensure the resilience of any technology that delivers, maintains or supports a material service, including by having:

• technology and cyber risk management and operational resilience measures;
• regular testing of those measures (including as part of the requirements examined in Section 6);
• processes and measures that reflect lessons learned from testing; and
• processes and procedures that convey relevant and timely information to assist risk management and decision-making processes.

5.21 To facilitate compliance with Requirement 4, in the draft supervisory statement the regulators propose a range of additional expectations setting out what a CTPs technology and cyber resilience measures should include.

5.22 Finally, the regulators propose that a CTP should ensure that cyber and technology response and recovery measures are considered as part of compliance with Requirement 7: incident management.

Requirement 5: Change management

5.23 The regulators propose to require a CTP to ensure it has a systematic approach to dealing with changes to a material service (including changes to the processes or technologies used to deliver, maintain, or support that service) by:

• implementing appropriate policies, procedures, and controls to ensure the resilience of any change to a material service;
• implementing any change to a material service in a way that minimises the risk of undue disruption; and
• ensuring that prior to being implemented, any change is appropriately risk-assessed, recorded, tested, verified, and approved.

5.24 To comply with Requirement 5, the regulators propose that a CTP should assess the evolution of risk throughout the change process from inception to termination in the draft supervisory statement. The draft supervisory statement sets out a non-exhaustive list of the types of change the regulators propose that CTPs should consider.

5.25 The regulators propose that before commencing a change to a material service, a CTP should plan what it will do if the change fails. This may include but would not be limited to reversing or rolling back the change.

5.26 The regulators also propose that CTPs should continue to monitor changes to material services for an appropriate period after their implementation to identify and manage any unexpected risks.

Requirement 6: Mapping

5.27 The regulators propose to require a CTP to:

5.28 Mapping is a key concept in the operational resilience framework for firms and FMIs and in the BCBS Operational Resilience Principles. Respondents to DP3/22 welcomed the idea of adapting mapping requirements to CTPs. Some respondents questioned how granular CTPs’ maps would be expected to be, and others suggested that mapping should include dependencies and vulnerabilities across all material services.

5.29 The key objectives of mapping in its proposed application to CTPs would be to enable a CTP to identify vulnerabilities (which should then inform its scenario testing) by:

• distinguishing those resources across the supply chain that are essential to the CTP’s delivery of material services and any interconnections between them (the draft supervisory statement contains a non-exhaustive, illustrative list of resources);
• ascertaining whether these resources are fit for purpose; and
• considering what would happen if they became unavailable.

5.30 The regulators do not propose to require CTPs to use a set format for their map(s), but would expect the maps produced by CTPs to:

• focus on resources that are essential to the CTP’s delivery of material services;
• be sufficiently granular to meet the objective set out above; and
• be updated annually or following certain events (eg a change to a key nth party supplier).

Requirement 7: Incident management

Response and Recovery Measures

5.32 In the draft supervisory statement, the regulators propose that a CTP’s response and recovery measures should cover the lifecycle of an incident, including but not limited to:

• the setting of a maximum tolerable level of disruption for the material service prior to the incident occurring;
• the classification of incidents based on predefined criteria eg expected recovery time, and (if known) potential impact on the CTP’s firm and FMI customers;
• procedures and targets for restoring material services and recovering data eg recovery time objectives (RTOs), recovery point objectives (RPOs) etc. To the extent possible, these targets should be compatible with the impact tolerances that firms and FMIs have set for any important business services, which are in turn supported by the CTP’s relevant material services;
• internal and external communication plans; and
• continuous improvement through the incorporation of lessons learned from previous incidents and testing.

5.33 The draft supervisory statement sets out further proposals for how a CTP should set a maximum tolerable level of disruption, including the use of appropriate metrics and targets.

5.34 The regulators propose that a CTP would also be expected to:

• periodically, and at least annually, test and update its response and recovery measures; and
• identify the root causes of incidents and take all reasonable steps to address them to reduce the risk of incidents reoccurring.

5.35 The regulators propose that a CTP’s response and recovery measures should cover incidents with a potential cross-border and cross-sectoral impact.

Financial sector incident management playbooks

5.36 In line with responses to DP3/22, the primary objective of financial sector incident management playbooks would be for a CTP to consider, plan, document, test, and regularly review how it would communicate with and support the regulators, and its firm and FMI customers (collectively and individually) during an incident affecting one or more of its material services.

5.37 The regulators recognise that each incident will be different, and there can be no one-size-fits-all approach. However, the regulators propose that the playbook should meet a number of outcomes, including setting out how a CTP would:

• coordinate its crisis communications with those of the firms and FMIs to which it provides material services in order to mitigate risks to the stability of, and confidence in, the financial system; and
• ensure that its firm and FMI customers and the regulators receive accurate, consistent, and timely information and support throughout the incident’s lifecycle.

5.38 To comply with Requirement 7 and the proposed requirements on information-gathering and testing in Chapter 6 of this CP, the regulators propose to require a CTP to test its financial sector incident management playbook at least annually with an appropriately representative sample of firms and FMIs to which it provides a material service (see Chapter 6).

5.39 The regulators propose that a CTP should make its financial sector incident management playbook available to them on request.

• arrangements to support the effective, orderly, and timely termination of those services, including (if applicable) their transfer to another person, including the firms or FMIs the services are provided to; and
• provision for ensuring access, recovery and return of any relevant assets to the firms or FMIs it provides the material service to (and where applicable in an easily accessible format).

5.43 The draft supervisory statement sets out a non-exhaustive range of reasons why termination could happen, including but not limited to corporate restructuring, change in control, legal or regulatory issues, insolvency, court processes, or unrecoverable disruption. Firms and FMIs would remain responsible for complying with applicable requirements and expectations on operational resilience and third-party risk management, including in relation to stressed exits. The measures that CTPs should take under Requirement 8 seek to facilitate firms’ and FMIs’ compliance with these requirements.

6: Information-gathering, self-assessment, testing, Skilled Person Review and information sharing

• the regulators’ information-gathering power under s312P FSMA;
• Chapter 11 and 12 of the Critical Third Parties sourcebook in the FCA Handbook; and
• the following chapters in the Critical Third Parties Parts of the PRA and Bank Rulebooks:
  • information-gathering, evidence and testing;
  • self-assessment; and
  • information sharing with firms.

6.2 In Chapter 6 of DP3/22, the regulators set out a potential approach to testing the resilience of services that CTPs provide to firms and FMIs using a range of tools, including but not limited to:

• scenario-testing;
• participation in sector-wide exercises, such as: FPC cyber stress tests, Sector Simulation Exercises (SIMEX), and Quantum Dawn;
• cyber-resilience testing; and
• skilled persons reviews.

6.3 This section of the DP attracted a large number of responses. Respondents to the DP generally supported the regulators’ thinking but encouraged them to:

• adopt an agile, proportionate approach to testing the resilience of CTPs, which leveraged a wide range of available tools; and
• take into account CTPs’ own testing (whether performed internally or by independent parties); and other forms of oversight carried out by other regulators and authorities.

6.4 Respondents also recognised the potential value of bringing CTPs into sector-wide exercises but raised concerns about the resources and time involved in organising them. As an alternative, some respondents suggested that CTPs could be required to run smaller, similar exercises with volunteers from the firms and FMIs to which they provide services.

6.5 There were mixed views about the potential value of the regulators performing threat-led penetration testing on CTPs. Respondents also noted the importance of ongoing monitoring and vigilance by CTPs, and appropriate follow-up by the regulators of any recommendations for remediation resulting from tests or other forms of oversight.

6.6 The regulators have taken responses to DP3/22 into account when developing the proposed requirements and expectations on assurance, information gathering and testing of CTPs in this chapter.

6.7 The regulators propose a general requirement for every CTP to demonstrate to the regulators its ability to comply with their rules both annually and upon request.

Self-assessment

Testing requirements

Scenario testing

6.9 Under the regulators’ proposals, a CTP would be required to:

• carry out regular scenario testing of its ability to continue providing each material service within its maximum tolerable level of disruption in the event of a severe but plausible disruption.
• identify an appropriate range of adverse circumstances of varying nature, severity, and duration relevant to its business, risk profile, and supply chain and consider the risks to the delivery of the material service in those circumstances.

6.10 The proposed scenario testing requirements and expectations for CTPs are adapted from the requirements and expectations in the operational resilience framework for firms and FMIs. CTPs would be expected to assume that disruption is inevitable when designing their scenarios for testing.

6.11 The regulators would expect the sophistication of a CTP’s scenario testing to be consistent with its systemic significance while balancing minimising the risk of disruption to its operations or customers.

• be organised and coordinated centrally by the CTP;
• include an appropriate representative sample of the CTP’s firm and FMI customers to which it provides material services; and
• be reviewed and approved at an appropriate level in the CTP.

6.13 The regulators also propose to require each CTP to produce a report following each test of its financial sector incident management playbook and share it with the regulators. The report should be completed as soon as reasonably practicable and sent to the regulators immediately after the report is completed. The report would be expected to set out:

• the key findings from the test;
• proposed revisions to the CTP’s Financial Sector Incident Management Playbook or the CTP’s incident management more broadly; and
• general non-attributable feedback to the CTP’s firm and FMI customers based on the test eg on best practices identified.

Information on request

6.14 In addition to the proposed annual self-assessment and testing requirements, the regulators could ask a CTP to provide information under s312P FSMA if reasonably required. The draft supervisory statement sets out expectations regarding how CTPs should comply with these requests.

6.15 Under s166(3) FSMA, any of the regulators may require a CTP or any person connected with a CTP to appoint, or the regulators may appoint, a skilled person to provide the regulators with a report. Similarly, under s166(A)(2) FSMA, each of the regulators may also require a CTP or any person connected with a CTP to appoint, or may itself appoint, a skilled person to collect or update information.

6.16 The regulators may use s166 reviews for any purpose in connection with their functions, including for resilience testing. The regulators’ proposed approach to the exercise of their powers to order skilled persons reviews of CTPs is consistent with existing obligations on firms and FMIs, and is set out in:

• Chapter 12 of the Critical Third Parties sourcebook in the FCA Handbook;
• the ‘Cost of Skilled Persons Reviews’ and ‘Contracts with Skilled Persons and delivery of reports’ chapters in the Critical Third Parties Parts of the PRA and Bank Rulebooks; and
• a separate draft supervisory statement.

Cost of appointing a Skilled Persons

6.17 A CTP or the person connected with a CTP shall pay the cost of a skilled persons review where the skilled person is appointed by the CTP or the person connected with a CTP. Where a regulator appoints the skilled person, the regulators have proposed a rule that all the expenses incurred by the regulator in relation to that appointment shall be payable to it by the CTP or the person connected with a CTP. This follows the existing requirements in place for firms and FMIs with respect to paying for S166 reviews.

Contracts with Skilled Persons and Delivery of Reports

6.18 The regulators propose a range of contractual requirements that must be fulfilled when a CTP contracts with a skilled person. In particular, the CTP would be required to permit the skilled person during and after the course of their appointment to:

• cooperate with the regulators in the discharge of their oversight functions;
• communicate to the regulators:
  • information on, or their opinion on, those matters that may be of material significance to the regulators in determining whether the CTP concerned satisfies and will continue to comply with their CTP duties;
  • information or their opinion on whether they reasonably believe that the CTP is not, may not be, or may cease to be a going concern;
• require the skilled person to prepare a report or collect or update information, as notified to the CTP by the regulator, within the time specified by the regulators; and
• waive any contractual or other duty of confidentiality owed by the skilled person to the CTP which might limit the provision of information or opinion by that skilled person to the regulators.

6.19 The regulators propose to require a CTP to ensure that the contract requires and permits the skilled person to provide the regulators with:

• interim reports;
• source data, documents, and working papers;
• copies of any draft reports given to the CTP; and
• specific information about the planning and progress of the work to be undertaken (which may include project plans, progress reports including percentage of work completed, details of time spent, costs to date, and details of any significant findings and conclusions).

6.20 The regulators propose that the s166 contract must be:

• governed by the laws of a part of the UK;
• in writing; and
• include a number of enforcement and arbitration provisions.

6.21 The regulators propose that when a CTP appoints a skilled person (either directly or indirectly), the CTP would be required to take reasonable steps to ensure that the skilled person delivers a report or collects or updates information in accordance with the terms of appointment.

6.22 The regulators also propose that a CTP must provide all reasonable assistance to a skilled person appointed under section 166 or 166A and take reasonable steps to ensure that its employees and agents do so.

6.23 The regulators propose to require every CTP to have in place effective and secure processes and procedures to ensure that their firms and FMI customers can comply with their regulatory obligations, and adequately manage risks related to their use of the CTP’s services. CTPs would be required to share:

• the results of scenario testing described in paragraph 6.9 above and financial sector incident management playbook testing described in paragraph 6.12 above with the regulators’ requirements, including any recommended remediation (where that information relates to a firm to which it provides services); and
• a summary of the information contained in the CTP’s annual self-assessment submitted to the regulators.

6.24 The regulators propose that a CTP would be responsible for developing an appropriate method for sharing these summaries and other information with its firm and FMI customers. This method should include controls to ensure that confidential or sensitive information is appropriately protected.

7.1 The regulators propose to require CTPs to notify them and their firm and FMI customers who receive an affected service of certain incidents. The proposed requirements are in:

• Chapter 8 of the Critical Third Parties sourcebook in the FCA Handbook; and
• the ‘Notifications’ and ‘Inaccurate, False or Misleading Information’ chapters in the Critical Third Parties Parts of the PRA and Bank Rulebooks.

7.2 Where a CTP would be required to disclose information under the regulators’ rules that would be subject to s413 of FSMA (which deals with information subject to legal privilege), this information is not disclosable to the regulators. However the CTP may choose whether or not to disclose this information to firms.

7.3 The DP addressed post-incident communications. In line with responses to the DP, the regulators consider that incident notification requirements for CTPs are necessary to advance the objectives of the regime.

• assess the potential impact of these incidents on the stability of, and confidence in, the UK financial system; and
• implement response and recovery measures both at the individual firm and FMI level, and on a coordinated sector-wide level.

7.8 The regulators propose to require a CTP to provide, the following notifications to both the firms and FMIs it provides services to, and to the regulators

• an initial incident notification;
• one or more intermediate incident notifications; and
• a final incident notification.

7.9 The CTP should in all cases provide these notifications based on its reasonable knowledge at the time of submission.

7.9 The regulators propose to require a CTP to also provide additional information about the incident to the regulators if requested pursuant to the information-gathering powers in s312P FSMA.

7.19 Once a relevant incident has been resolved and the CTP has had time to assess its root causes and identify lessons learned, the regulators propose that it must provide a final incident notification to the regulators, and the firms and FMIs it provides services to. The proposed contents of the final notification are set out in the regulators’ draft rules.

Other notification requirements

7.20 In addition to the incident notification requirements examined in the previous sections, the regulators propose to require CTPs to notify them if:

8.2 This consultation package makes clear that designation does not mean a third party has superior operational resilience to a non-designated third party and is not inherently safer than non-designated third parties. As we explain in chapter 2, the regulators will recommend CTPs for designation based on criteria relating to concentration in and materiality of the services they provide to firms and FMIs. They will not be hand-picked as favoured, operationally resilient suppliers. The regulators have also emphasised that ultimate accountability and responsibility for firms’ outsourcing and operational resilience obligations cannot be outsourced to a CTP. The proposals would not change the fact that financial services firms need to conduct due diligence and perform ongoing monitoring of third parties they engage, whether these be designated CTP or otherwise. Moreover, contracting with a CTP would not relieve a firm or FMI from liability in any potential enforcement action.

8.3 Nevertheless, the regulators recognise the risk of firms misinterpreting designation as regulatory approval and the potential for CTPs to encourage this. The regulators therefore propose to prevent a CTP from unduly using its designation for marketing purposes.

8.4 Under this proposal, a CTP would be required to refrain from indicating or implying that it has the approval or endorsement of the regulators by virtue of its designation as a CTP or being overseen by the regulators in respect of services it provides to firms or FMIs. Likewise, the regulators propose that a CTP must not suggest in any communication that its designation by HMT or oversight by the regulators confers any advantage to a firm or anyone else in using its services as compared to a service provider who is not designated. The regulators also recognise the potential for some related competition impacts, which are discussed in the CBA [insert reference].

8.5 The relevant draft rules are located in:

• Chapter 13 of the Critical Third Parties sourcebook in the FCA Handbook; and
• the ‘Referrals to oversight by the regulators or designation by HMT’ chapters of the Critical Third Parties Parts of the PRA and Bank Rulebooks

9: Nomination of a legal person for non-UK CTPs

9.1 As noted earlier, the focus of the proposals in this CP is on the services that a CTP provides to firms and FMIs. Consequently, the proposals are agnostic about the location of CTPs and do not require them to set up an establishment (ie a branch or subsidiary) in the UK where one does not already exist. This approach recognises that many CTPs provide services across international borders and/or to clients in multiple jurisdictions, and that this can help improve the efficiency and resilience of firms and FMIs and reduce compliance costs for CTPs.

9.2 However, for practical purposes, in addition to the proposed requirements in Requirement 1 of the operational risk and resilience chapter of the draft rules, a CTP whose head office is outside the UK would be required to nominate a legal person with authority to receive documents and notices from the regulators (including statutory notices under FSMA). The term ‛person’ is as defined in Schedule 1 of the Interpretation Act 1978 and ‛includes a body of persons corporate or unincorporate’. For the purposes of this requirement, the regulators propose that a CTP with no presence or employees in the UK should appoint a law firm or other suitable UK-based corporate body, partnership, or limited liability partnership as its representative.

9.3 The relevant rules are located in:

10. Record keeping and emergency relief

10.1 The regulators propose that a CTP must arrange for orderly records to be kept of its business and internal organisation, in so far as it concerns the provision of services to firms or FMIs. These records must be sufficient to enable each regulator to perform its oversight functions; and to ascertain whether or not the CTP has complied with its duties.

10.2 The relevant rules are located in:

• Chapter 14 of the Critical Third Parties sourcebook in the FCA Handbook; and
• the Nomination chapters of the Critical Third Parties Parts of the PRA and Bank Rulebooks.

Emergency

10.3 Bank draft rules include proposals that are intended to provide relief to a CTP in an emergency circumstance when it would be impossible for the CTP and related persons to comply with the proposed rules.

10.4 The relevant draft rules are located in the Critical Third Parties Emergency Provisions Part of the Bank rulebook.

11.7 The Bank considers that this policy accords with the Bank of England’s secondary objective, in exercising its FMI functions to advance the primary stability objective, to facilitate innovation in the provision of FMI services so far as reasonably possible. The PRA and FCA also consider that this policy accords with their respective have regard to innovation in HMT’s remit letters.

11.8 The regulators note that the proposals will not place any requirements on firms or FMIs themselves around the use of CTPs for provision of services, and also does not change the incentives for firms or FMIs with respect to their use of CTPs for provision of services. Moreover, the regime does not discriminate on the basis of particular technologies – the policy is intended to be technology-neutral and focuses on regulatory outcomes.

Statutory obligations relating to competition

PRA and FCA competition ‘have regard’ in Treasury remit letters

11.10a The proposals engage the PRA and FCA competition ‘have regard’, which suggests that the PRA and FCA should consider competition in relation to ‘all consumers’. This may include any ‘upstream’ impact resulting from competition among CTPs. Accordingly, in the CBA, the regulators have considered not only competition among CTPs, but also the potential for the proposals to have indirect competition impacts on firms and end consumers. As set out in the CBA, where the regulators believe that there are potential impacts, like the ‘halo effect’, these are mitigated as described or in other cases these potential impacts are unlikely to be material. The regulators therefore consider the proposals to be compatible with the PRA and FCA competition ‘have regard’.

PRA secondary objective: competition

11.10b The regulators consider that while the proposals in this CP are compatible with the PRA’s secondary competition objective, they are not expected to have a direct impact on the market for services provided by PRA regulated firms. The proposals are directed at CTPs and will not place new burdens or obligations on existing PRA-authorised firms. Potential impacts on competition are considered more fully in the CBA.

FCA operational objective: competition and competition duty

11.11 The proposals are directed at CTPs and will not place new burdens or obligations on existing FCA-authorised firms. They do not directly impact competition within the relevant markets under the FCA’s competition objective. Likewise, the FCA’s competition duty relates to ‘effective competition in the interests of consumers’. The regulators consider that firms are not generally consumers and this applies to firms purchasing services from CTPs. As set out in the CBA, the regulators believe any indirect impact on the relevant markets or consumers is either mitigated or unlikely to be material. The regulators therefore consider the proposals to be compatible with the FCA’s competition objective and duty.

FCA and PRA Secondary competitiveness and growth objective

11.12 As explained in the CBA, the regulators believe that the proposals will advance this objective. The proposals would increase the resilience of the financial sector as a result of more resilient third party services. This in turn will contribute to the making the UK financial system safe and attractive for business. While the proposals do impose new burdens, the CBA explains that third parties are likely to be subject to similar burdens in comparable regimes, especially the EU’s DORA, and in many cases may already be preparing to meet such requirements. This will reduce the impact, while ensuring the wider benefits to the financial system contribute to the UK’s continued position as an attractive place to do business.

Regulators’ ‘have regards’ analysis

11.13 The following factors, to which all the regulators are required to have regard, were significant in their analysis of the proposal:

• Service-based approach: the CP proposes a service-based approach to the oversight of CTPs. The proposals focus on the material services provided by CTPs to the financial sector. The measures would not involve regulators having wider responsibility for the supervision of CTPs as entities (as would be the case for a full supervisory regime for regulated firms) or the services they provide to other sectors. This approach is motivated in part by a concern for the efficient use of regulators’ resources, as well as to reduce compliance costs for CTPs.
• Leveraging external resources: the regulators would consider taking into account testing undertaken by the CTPs themselves or by other (UK or overseas) authorities. Leveraging these external resources would help the regulators to use their resources efficiently and economically.
• Efficient coordination between regulators: by adopting a single unified policy and by issuing a joint CP, the three supervisory authorities will avoid the unnecessary duplication of efforts.

Proportionality

• Focus on specific services: By focusing the proposals primarily on CTPs’ provision of material services to firms and FMIs, the regulators would ensure that restrictions imposed on CTPs are proportionate to the expected benefits – namely, management of the systemic risks to the regulators’ objectives posed by third party service provision to the UK financial sector.
• Responsibility lies with CTP: The proposals would not impose new burdens or restrictions on firms and FMIs. The responsibility for satisfying the minimum resilience standards would rest with the CTP.
• Principles- and outcomes-based approach: rather than requiring CTPs to satisfy a checklist of controls, we propose that CTPs meet a principles-based set of minimum resilience standards.
• Avoidance of unnecessary duplication: the regulators have sought to minimise unnecessary duplication between the new CTP regime and existing certifications and standards. Similarly, by potentially taking into account resilience testing undertaken by CTPs themselves, other UK competent authorities or non-UK financial supervisory authorities, the regulators will minimise unnecessary duplication of testing. This avoidance of duplication will help to ensure that burdens and restrictions imposed by the regime are proportionate to its benefits.
• Cost benefit analysis: the regulators have also tested the proportionality of the costs imposed by the proposals in this CP as part of their cost benefit analysis.

Net Zero

11.14 The use of certain third-party services by firms and FMIs can offer improvements in energy efficiency that could beneficially affect their emissions profiles. By managing the systemic risks posed by third-party arrangements with CTPs, the policy proposals could give firms and FMIs greater confidence in the resilience of the relevant third-party services. It could be considered that the policy proposals might thereby indirectly facilitate the energy efficiencies these arrangements can offer by giving firms and FMIs greater confidence to use such services. However, the regulators consider that any such effect would likely be small and indirect.

Consumers should take responsibility for their decisions

11.15 The regulators consider that the proposals will have a neutral impact on consumers’ decision-making. The proposals are focused on CTPs providing services to firms and FMIs, and do not impact on firms providing services to consumers.

Responsibilities of senior management

11.16 The management body of an authorised firm or an FMI have a responsibility to maintain and enhance the firm’s operational resilience. The regulators consider that the proposals in this CP, specifically the proposed governance requirement (Requirement 1) would support these responsibilities by requiring a CTP to:

• Appoint an employee or members of the governing body (who has appropriate authority, knowledge, skills, and experience) to act as the central point of contact for the regulators
• Establish clear roles and responsibilities at all levels of its staff involved in the delivery of any material services.
• Establish, oversee, and implement an effective approach that covers the CTP’s ability to prevent, respond and adapt to, as well as recover from any event that disrupts the delivery of a material service, learn from those disruptive events and any testing of its material services undertaken.
• Ensure appropriate review and approval of any information provided to the regulators.

Desirability of publishing information

11.17 The regulators propose that a CTP would be required to prepare and share with those of their firm and FMI customers a summary report of assurance and testing activities carried out in compliance with the CTP regime. These proposals would ensure that relevant and actionable information about CTPs’ compliance and risks is shared with their financial sector clients, while balancing the desirability of such information sharing with the need to protect the security of confidential and sensitive information.

Differences in the nature of business

11.18 With regard to firms and FMIs, the significance of the proposed CTP oversight regime derives from their increasing reliance on third-party services to support their operations. This reliance is a sector-wide trend that encompasses firms and FMIs with different business models and objectives. The regulators therefore regard the regime as compatible with exercising its functions in a way that recognises differences in the nature, and objectives of businesses carried on by different firms and FMIs.

11.19 With regard to CTPs, the regime only applies when a prospective CTP has been assessed as providing services for which failure in, or disruption to, the provision of these services could threaten the stability of, or confidence in, the UK financial system. The regulators propose that all CTPs are therefore subject to consistent minimum requirements, expectations, and oversight. However, when overseeing CTPs, the regulators will take a proportionate approach, which may take into account the nature and objectives of the CTP’s businesses. Moreover, the technology-neutrality of the proposed regime recognises differences in the in the business of CTPs.

Regulatory transparency

11.20 The regulators consider that the proposals in this CP accord with these principles of regulatory transparency. For example:

Accountability and Consistency

11.21 The proposals in this CP accord with the principle of consistency in regulatory activities. They have been designed, where appropriate, to align with, and complement, existing regulatory obligations on firms and FMIs in relation to operational resilience and third-party risk management. The regulators will also set out, in a memorandum of understanding (MoU), how they will ensure coordination and consistency in the exercise of their respective function. HMT will lay this MoU before parliament, which will help uphold the regulators’ accountability to the public and Parliament.

Supporting compliance and growth, and providing clear information, guidance and advice

11.22 In addition to proposed requirements in the Bank Rulebook, PRA Rulebook, and FCA Handbook, the regulators are proposing to publish a supervisory statement setting out their expectations of how CTPs should comply with and interpret the proposed requirements in their draft rules. The regulators also intend to publish a document setting out how they will carry out their oversight roles in relation to CTPs (‘CTP approach document’) in due course. The CTP approach document will help CTPs, firms, and FMIs understand how the regulators will oversee CTPs in practice and also uphold the regulators’ accountability to the public and Parliament through greater transparency.

Impact on mutuals

11.23 The regulators consider that the impact of the proposed rule changes on mutuals is expected to be no different from the impact on other firms. The reason for this is that they are not proposing to place new obligations on any firms and FMIs.

FCA financial crime have regard

11.24 In formulating these proposals, the FCA has had regard to the importance of taking action intended to minimise the extent to which it is possible for a business carried on (i) by an authorised person or a recognised investment exchange; or (ii) in contravention of the general prohibition, to be used for a purpose connected with financial crime (as required by s. 1B(5)(b) FSMA). Financial crime is not the focus of this regime. However, the regulators do consider that the proposals will be neutral in respect of any risk under this have regard.

PRA Practitioner Panel

11.25 The PRA has consulted the Practitioner Panel, and taken account of its representations, as part of the process of developing the proposals in this CP.

FCA panel engagement

11.26 The FCA has consulted its Practitioner Panel, Listing Authority Advisory Panel, Consumer Panel, Small Business Panel, and Markets Panel in preparing these proposals, and has taken their feedback into account.

Economic growth under HMT remit letters

11.27 The PRA and FCA have had regard to medium to long-term economic growth as part of considering their secondary competitiveness and growth objectives, which requires the PRA and the FCA to act in a way that facilitates the growth of the UK economy in the medium to long-term. As explained in the related analysis above, the regulators believe that the proposals in this CP may promote UK economic growth.

Competitiveness of UK economy

11.28 The PRA and FCA have had regard to the international competitiveness of the UK as part of considering the secondary competitiveness and growth objective, As explained in the analysis above, the regulators believe that the proposals in this CP are likely to promote the international competitiveness of the UK.

Equality and diversity

11.29 In making its rules and carrying out its policies, services, and functions, the regulators are required by the Equality Act 2010 to have due regard to the need to eliminate discrimination, to promote equality of opportunity, and to foster good relations between persons who share a protected characteristic and those who do not.

11.30 The regulators have considered the equality and diversity issues that may arise from the proposals in this consultation. The regulators do not consider that the proposals in this CP raise any concerns with regards to equality and diversity

Bank of England additional ‘have regards’ analysis

Effects of FMI functions