On 8 June 2022, HM Treasury published a Policy Statement ‘Critical third parties to the finance sector’.

Financial services are increasingly relying on third parties, outside the finance sector, to provide key functions or services, i.e. cloud based computing services. These arrangements can reap many benefits but can also create risks. The Policy Statement sets out HM Treasury’s approach to mitigating the risks posed by such ‘critical’ third parties to the UK finance sector. The proposed regime will enable the regulators to ensure that services, provided by critical third parties to firms in the finance sector, are resilient, thereby reducing the risk of systemic disruption. However, it must be noted that, the framework will complement but not replace the individual responsibilities of the firm.

The proposal sets out the following:

• HM Treasury will ­– in consultation with the financial regulators and other bodies – be able to designate certain third parties, which provide services to firms, as ‘critical’.
• The financial regulators will then be able to make rules, gather information from critical third parties and take formal action (including enforcement) when needed.
• A rule making power will allow the financial regulators to set minimum resilience standards that critical third parties will be directly required to meet in respect of any material services they provide to the UK finance sector.
• Critical third parties will be required to take part in a range of targeted forms of resilience testing.

In addition, the financial regulators will be granted powers to:

• Request information directly from critical third parties on the resilience of their material services to firms, or their compliance with applicable requirements.
• Commission an independent ‘skilled person’ to report on certain aspects of a critical third party’s services.
• Appoint an investigator to look into potential breaches of requirements under the legislation.
• Interview a representative of a critical third party and require the production of documents.
• Enter a critical third party’s premises under warrant as part of an investigation.

Going forward, the Government intends to legislate for this regime when Parliamentary time allows. Additionally, the financial regulator’s joint discussion paper will be published shortly after such legislation is introduced. Following Royal Assent, the financial regulators anticipate publishing a further consultation paper on their proposed rules, building on feedback to their discussion paper and based on their proposed, new statutory powers.