On 12 November 2024, the Bank of England (BoE), Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) published a joint policy statement (PRA PS16/24 / FCA PS24/16) on Operational resilience: Critical third parties to the UK financial sector (the PS). The PS sets out feedback to responses the regulators received to their consultation paper on the topic, CP26/23, as well as their final policy.

Background

The Government gave regulators new powers in 2023 to oversee the resilience of the services that certain third parties, known as critical third parties (CTPs), provide to the financial services sector. These were intended to address concerns that financial firms and financial market infrastructures (FMIs), such as payment systems, have become increasingly reliant on the services of a small number of third party providers, the disruption or failure of which could affect large numbers of consumers and firms and threaten the stability of the UK financial system.

The Financial Services and Markets Act 2023 (FSMA 2023) amended the Financial Services and Markets Act 2000 (FSMA 2000) to give HM Treasury the power to designate certain third parties as critical third parties (CTPs) to the financial services sector, and to give the regulators powers to make rules imposing duties on CTPs in connection with the services they provide to firms (i.e. rulemaking powers); to direct a CTP to do or refrain from doing certain things (i.e. powers of direction); information-gathering and investigatory powers; and disciplinary powers.

The BoE, PRA and FCA consulted from December 2023 to March 2024 on a range of proposed requirements and expectations for CTPs, which would apply to all CTPs that are designated by HM Treasury regardless of the specific firms and FMIs to which each CTP provides services.

The final rules

The documents published alongside the PS, which are collectively referred to as the ‘CTP Oversight Regime’, comprise:

  • Three separate rule instruments (one issued by each of the BoE, PRA and FCA) – these are identical in effect and substance and should be interpreted accordingly.
  • Supervisory Statement (SS) 6/24 – this has been issued jointly by the regulators and should be the main source of guidance for CTPs on how the regulators expect them to interpret and comply with the requirements in their rules.
  • BoE and PRA’s final SS7/24, Reports by skilled persons: Critical third parties and the FCA’s equivalent guidance on skilled persons reviews which is set out in the FCA Handbook: Critical third parties Instrument 2024.
  • The regulators’ approach to the oversight of CTPs.
  • BoE’s approach to enforcement: proposed changes to statements of policy and procedure following FSMA 2023 and the FCA’s equivalent and substantively identical approach to enforcement in respect of CTPs which is set out in The FCA’s Critical Third Parties Statement of Policy relating to Disciplinary Measures Instrument 2024.

The CTP Oversight Regime is not intended to impose additional, explicit requirements or expectations on firms, but to complement their existing requirements and expectations relating to operational resilience and third party risk management.

The regulators emphasise that once HM Treasury designates a third party as a CTP, firms and (where applicable) their groups will remain accountable and responsible for managing the risks in any outsourcing or third party arrangements they have, or may enter into, with that CTP, although some features of the CTP regime (such as the information-sharing requirements on CTPs) may assist firms in managing these risks.

Next steps

The final rules for CTPs will take effect from 1 January 2025.

However:

  • A CTP’s statutory obligations under FSMA 2000, the requirements in the regulators’ rules and the expectations in SS6/24 and other documents listed in the PS will only apply to a CTP on the date the designation order made by HM Treasury comes into force.
  • There will also be a transitional period for compliance with certain requirements in the regulators’ rules, which will also start from the date specified by HM Treasury in the designation order. Chapter 2 of the PS and section 12 of SS6/24 list the requirements that are subject to a transitional period and the applicable transitional periods.

A statement on the PS, published on the FCA website, notes that the regulators welcome engagement from industry over the coming months as the regime is implemented.

Memorandum of Understanding

HM Treasury has also published a Memorandum of Understanding between the BoE, PRA and FCA, outlining how the regulators will coordinate with respect to the exercise of their CTP functions through a joint CTP Consultation and Coordination Forum.