Context
The FCA has announced that the FCA, the PRA and the Bank of England (BoE) (collectively the ‘regulators’) have published a joint Policy Statement (PS) 24/16 ‘Operational Resilience: Critical Third Parties to the UK Financial Sector’ containing the final rules, expectations and guidance under a new oversight regime for CTPs to the financial services sector. The Policy Statement and final rules have taken into account industry feedback to Consultation Paper (CP) 26/23.and follow the UK Parliament’s adoption of the Financial Services and Markets Act 2023 (FSMA 2023), which provides the statutory framework for the new CTP regime.
The new regime will aim to strengthen the resilience of the services that CTPs provide to UK-regulated financial services firms and ‘financial market infrastructure entities’ (‘FMIs’). The new regime does not replace the responsibility authorised firms and FMIs have in continuing to meet the FCA’s operational resilience requirements. They will continue to be accountable for managing the risks in their own outsourcing and third-party arrangements.
Key points to note and next actions
Note: The third-party providers which will be CTPs have not yet been decided. HM Treasury will decide which third-party providers will fall under the new regime based on input from regulators.
The regulators’ approach to the oversight of CTPs (see pages 9 to 12) sets out how the regulators will identify potential CTPs for recommendation to HMT to consider for designation. Having reviewed the commentary in relation to the criteria, in our opinion it is possible that the FCA might view the larger and more established insurance broker software systems providers as CTPs.
The regulators have also published the following supporting documents:
- A Supervisory Statement, along with an overview, which sets out the regulators’ expectations of how CTPs should interpret and comply with the rules.
- The regulators’ approach to the oversight of Critical Third Parties as guidance, along with an overview, which sets out how the regulators will carry out their regulatory oversight and is designed to help CTPs understand the oversight approach.
- A Memorandum of Understanding, along with an overview, that sets out how the FCA will work together with the Bank and PRA to oversee CTPs.