The Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA), which together are called the “supervisory authorities,” have come up with possible ways to keep an eye on and strengthen the resilience of services provided by “critical third parties” (CTPs) to the UK financial sector.
CTPs provide certain services to regulated financial services firms and financial market infrastructure firms (also called “FMIs”). If they fail or are disrupted, these services could affect the stability of the financial system and cause harm to consumers. The possible steps in the discussion paper are meant to reduce this risk.
When managed well, outsourcing and other arrangements with third parties can help firms and FMIs in a number of ways, such as by making them more efficient, cutting costs, allowing them to grow, speeding up innovation, giving customers better results, and making operations more stable.
But, as the Financial Policy Committee (FPC) of the Bank of England pointed out in 2021, disruptions at a small number of third-party service providers that firms and FMIs rely on could affect financial stability. In response, the government made changes to the Financial Services and Markets Bill, which is currently being debated in Parliament, to give the supervisory authorities the power to directly monitor the stability of the services CTPs provide to the UK financial sector.
In the discussion paper, there are ideas for how the proposed powers of the supervisory authorities could be used. These ideas include:
A plan for finding possible CTPs, which would help the supervisory authorities make formal designation suggestions to HM Treasury.
The services that designated CTPs provide to firms and FMIs would have to meet minimum resilience standards.
A framework for testing the resilience of material services that CTPs provide to firms and FMIs using a variety of tools, such as, but not limited to, scenario testing, participation in sector-wide exercises, cyber resilience testing, and skilled person reviews of CTPs.
These measures wouldn’t replace firms’ and FMIs’ existing duties to manage risks from contracts with third parties. Instead, they would add to them. The regulators would only keep an eye on the systemic risks that come from the services that CTPs offer to firms and FMIs.
People can say what they think until December 23, 2022. The supervisory authorities plan to hold a consultation on their proposed requirements and expectations for CTPs in 2023. This will depend on how the Financial Services and Market Bill is discussed in Parliament and on the responses to this discussion paper.
Sam Woods, who is the CEO of the PRA and the Deputy Governor of Prudential Regulation, said:
“It is very important that the companies we regulate can count on the services they get from third parties, especially if those third parties have become important parts of the system.” Today’s paper explains how we think we can make sure those services have the right level of resilience. We would like to hear from anyone who is interested in this area.
Deputy Governor for Financial Stability Jon Cunliffe said:
“Financial market infrastructure firms are becoming more and more dependent on third-party technology providers for services that could affect the financial stability of the UK if they fail or are disrupted.” The possible steps looked at in this DP are an important first step for the Bank of England to take to deal with these systemic risks (in coordination with the FCA). The DP also has suggestions for how to improve coordination between the Bank/PRA and FCA, international financial regulators, and UK non-financial regulators. This is important because many CTPs and the services they offer are cross-border and cross-sector.
The head of the FCA, Nikhil Rathi, said:
“In a world that is becoming more digital, businesses that deal with money are becoming more reliant on a small number of third-party providers. That can have big benefits, but it also comes with a risk of being resilient. We want an open conversation about how we should use the new powers that Parliament is giving us to oversee the services that these third parties provide to the financial sector and reduce the risk of major disruptions that could hurt consumers and markets.”
