| Link(s): | CP23/30: Operational resilience: Critical third parties to the UK financial sector | FCA CP26/23 – Operational resilience: Critical third parties to the UK financial sector | Bank of England |
Context
The PRA, FCA and Bank of England (‘the regulators’) have issued a joint Consultation Paper. It sets out the proposed requirements to be established in terms of rules and accompanying expectations for critical third parties (CTPs). The key aim of the proposed requirements and expectations is to manage potential risks to the stability of, or confidence in, the UK financial system that may arise due to a failure in, or disruption to, the services that a CTP provides.
Key points to note and next actions
- CTP’s designated status will not necessarily mean that it is inherently more resilient, safer, or more suitable to provide a given service to firms.
- The regulators intend to recommend third parties for designation as CTPs based on their assessment of the potential impact that a failure in, or disruption to, these third parties’ services could have on the stability of, or confidence in, the UK financial system. This is proposed to be done by regulators identifying potential CTPs to HMT by assessing against three criteria:
- Materiality of the services which the third party provides to firms;
- Concentration of the services which the third party provides to firms; and
- Other drivers of potential systemic impact.
- One potentially relevant additional factor is the substitutability of a third party’s services to firms (in particular, material services), which may arise due to:
- the lack of viable alternative providers for one or more services; or
- the potential difficulties (including risks) that firms may face when migrating services in a timely manner from one third party to another or back in-house.
- Firms that may meet the criteria as a CTP which are already subject to regulation and supervision/oversight by the regulators, are unlikely to be recommended for designation.
- Critical Third Parties will have their own set of Fundamental Rules and Resilience Standards, which are laid out in the Consultation Paper.
- The regulators propose to require each CTP to submit a written self-assessment to the Regulators within three months of designation and thereafter within 12 months of the last submission. They will also be required to carry out regular scenario testing and to test its financial sector incident management playbook annually.
This consultation closes on Friday 15th March 2024.If you want to provide feedback on the proposals set out in the consultation, please send any comments to CP26_23@bankofengland.co.uk.