UK: Critical third parties to the UK financial sector - designation and rules

Why should I read this?

The Critical Third Party regime is designed to ensure the operational resilience of the UK financial services sector by ensuring that those CTPs that provide critical services to the sector (for instance, cloud computing services) are robustly managed and regulated. 

In this regard, the BoE, PRA and FCA are increasingly focused on addressing a perceived concentration of risk in a small number of large technology providers. 

Although HM Treasury will ultimately make the final decision on which service providers will be classified as CTPs (with input from the FCA and PRA), it is important for both financial services firms (“Firms”), and service providers, to familiarise themselves with the operational risk and resilience requirements in the supervisory statement and ensure that they are aware of the regulators’ expectations, both individually and jointly.

Designation Process: The regulators may recommend third parties to HM Treasury for designation as a CTP. Before HM Treasury decides to designate a third party as a CTP, it must give the third party the opportunity to make formal representations. Upon considering all evidence and representations, HM Treasury will make a final decision, informing the prospective CTP of the outcome as well as (where appropriate) publishing this in the Designation Regulations.

What should I do?

Approach to Designation:

Understand the rules on when a third party might be designated as a CTP

The regulators have set out the following approach which it will take when assessing whether to recommend a service provider to HM Treasury for designation as a CTP:

1. Scope: CTPs are expected to capture only those third parties whose provision of service(s) could, in the event of disruption or failure, threaten the stability of, or confidence in, the UK financial system;
2. Concentration: the concentration in the services which the third party provides to financial institutions (in both absolute terms and relative significance of the type(s) of Firms receiving those services);
3. Materiality: the impact and materiality of a CTP on Firms. This is informed by, though may differ from, a Firm’s assessment of their outsourcing and third party arrangements;
4. Other relevant factors: These include macro vulnerabilities, contagion risk, the inability of firms to individually deliver system-wide resilience, and other levels of risk such as the interconnectedness of systems, common and correlated vulnerabilities, concentration risk and dependence on third parties / data provided by third parties.

2. If you are potentially likely to be designated as a CTP, have a strategy for how to respond to any requests from HM Treasury and prepare evidence against statutory criteria.

3. In parallel, review the requirements required of a CTP and put in place a strategy to meet the requirements, including improving technology and cyber resilience, ensuring resilience in your own supply chain, undertaking self-assessments, scenario testing and building playbooks to manage incidents.

If Designated:

1. Understand the Operational Risk and Resilience Requirements and create a remediation program to meet the CTP requirements, including in respect of governance, risk management, dependency and supply chain risk management, technology and cyber resilience, change management, mapping critical services, incident management and exit management.
2. Understand the high level CTP Fundamental Rules which collectively act as an expression of the overall objective and ensure that systems and processes are in place which are designed to ensure the rules are complied with.
3. Understand evidence required to show that the CTP has met the rules, the information which the regulators may request, and the circumstances under which the FCA/PRA might appoint a skilled person.

What else do I need to know about Critical Third Parties: Designation and Rules?

Oversight cycles: In respect to CTPs identified, each oversight cycle will last 12 months and will be centred around an annual review to discuss the key risks a CTP poses and agree the oversight strategy for the upcoming 12 months, including any specific actions such as testing or remediation.

Incident Reporting: Critical Third Parties are required to report incidents to the Regulators. See our related briefings available.