UK regulators issue joint proposals to tackle risk of financial instability posed by CTP dependency
The Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) have come together to issue new joint proposals to tackle the risk of potential financial instability posed by the growing relationship between critical third parties (CTPs) and UK-regulated financial services firms and financial market infrastructure entities (FMIs).
UK regulators issue proposals to oversee CTPs
The legislative proposals outlined in the trio’s consultation paper this week aim to “oversee and strengthen the resilience of services” provided by CTPs.
“Well managed outsourcing can bring efficiencies, accelerate innovation and boost operational resilience,” says Nikhil Rathi, chief executive of the FCA. “With a concentration of third parties serving multiple clients in financial services, there is, however, a risk of major impact if they are disrupted or fail.”
Strengthening the connection
The proposals acknowledge that the full management of such risks is “beyond the ability” of participating firms and FMIs, and thus requires “an appropriate but proportional level of direct regulatory oversight”.
This oversight is expected to include a set of core tenets outlining the fundamental obligations of CTPs to their partners, including “more granular operational risk and resilience requirements” regarding technology, cyber resilience, supply chain risk and change and incident management.
CTPs will also be required to supply regulators with “certain information and assurance” through annual self-assessments and scenario testing.
Notably, the proposals, which build on a previous discussion paper published in July 2022, plan to regulate the third-party services provided by CTPs, but not the CTPs themselves.
“We are consulting today on proposals to implement new powers given to us by Parliament to manage these risks for those providers who could present risks to financial stability, in an effective and proportionate way,” says Sam Woods, deputy governor of prudential regulation and the CEO of the PRA.
The regulators welcome feedback on their consultation paper until 15 March, and say they expect to publish final requirements by H2 next year.
