Critical third party rules finalised – but no designations yet

The BoE, PRA and FCA have finalised the package of measures that will set:

• the approach that HM Treasury will take to designating entities as being critical to the UK financial sector, following advice from the regulators;
• the approach the regulators will take to overseeing designated CTPs;
• the operational resilience requirements the regulators expect CTPs to meet;
• enforcement powers over CTPs, which will include the right for regulators to commission skilled persons reviews.

The designations will require the CTPs to provide assistance, information and notifications to the financial regulators, undertake various stress-testing exercises and report to the regulators major incidents such as cyber attacks and power outages.

The regulators have published extensive feedback on the proposals they consulted on in 2023, but have made no changes of substance as a result of responses they received.

The rules will take effect from 1 January 2025, but of course the obligations of any single CTP under them will apply only once the relevant designation order comes into force, and the designation orders will also contain details of a transitional period.