Regulators consult on critical third party supervision

BoE, PRA and FCA are consulting on how to oversee the resilience of critical third party service providers, where those providers service UK regulated firms and FMIs. The debates leading up to the introduction of the Critical Third Parties regime in the FSMA 2023 recognised that managing fully the risks of failure of a provider is outside the ability of any one regulated firm, which is why a level of direct regulatory oversight is needed. The regulators are now consulting on how they will provide that oversight in a way that complements without eliminating or diluting the existing responsibilities of individual firms.

The consultation covers the changes that would be made to the PRA and FCA rules as well as requirements the BoE places on FMIs and seeks views on:

• the process of deciding to designate a provider as a CTP;
• a set of fundamental rules that would apply to all services that CTPs provide to regulated firms and FMIs;
• granular operational risk and resilience requirements that would apply to “material” services only (including requirements in relation to cyber resilience and supply chain and incident management);
• information requirements on CTPs, including an annual self-assessment that they would have to provide to regulators; and
• notification requirements on CTPs to alert regulators and the firms they provide services to of specific disruptions that may adversely affect the services they provide.

There will also be supervisory statements addressing the regulators’ expectations on CTPs and on the potential use of skilled persons reviews as an oversight tool.

While the changes are aimed at CTPs, the paper is also relevant to the regulated firms and FMIs, and the regulators stress that designation of a CTP under FSMA should not be taken as assurance that the provider is inherently more resilient, safer or a more suitable service provider than a non-designated party that can provide the same service.

TheCityUK has published a complementary paper setting out its recommendations on matters both firms and regulators should consider to ensure implementing the CTP regime supports innovation and growth as well as minimising the impact of disruption.

Consultation closes on 15 March 2024, and the regulators plan to publish the finalised requirements in H2 2024.