On 21 July 2022, the Bank of England, PRA and FCA (the UK regulators) jointly published a Discussion Paper setting out potential measures to oversee and strengthen the resilience of services provided by critical third parties (CTPs) to the UK financial sector.

The Financial Services and Markets Bill (FSM Bill) provides for a proposed statutory framework for managing systemic risks posed by third parties designated as CTPs by HM Treasury.

The Discussion Paper sets out how the UK regulators could use their proposed powers in the FSM Bill to assess and strengthen the resilience of services provided by CTPs to firms and financial market infrastructures (FMIs), thereby reducing the risk of systemic disruption. The potential measures set out in the Discussion Paper focus on material services that CTPs provide to the financial sector. The UK regulators would not have any responsibility or powers for wider regulation and supervision of CTPs or for the resilience of the services they provide to other sectors. This service-based approach recognises that some potential CTPs may provide services to many other sectors besides financial services.

The potential measures set out in the Discussion Paper comprise three main building blocks:

• A framework for the supervisory authorities to identify potential CTPs and recommend them for formal designation to HM Treasury. CTP designation by HM Treasury would recognise the potential systemic impact that disruption to the services provided by the third party could have on the supervisory authorities’ objectives.
• Minimum resilience standards for designated CTPs in respect of material services they provide to firms and FMIs. These standards would align to and build on the operational resilience framework for firms and FMIs, and would include a requirement for CTPs to develop and test ‘financial sector continuity playbooks’ to improve their ability to respond and recover from disruption affecting multiple firms and FMIs simultaneously.
• A range of tools for testing the resilience of material services that CTPs provide to firms and FMIs. These tools could include, but not be limited to, scenario testing, participation in sector-wide exercises, cyber resilience testing, and skilled person’s reviews of CTPs.

The deadline for responding to the Discussion Paper is 23 December 2022.