UK Regulators Finalize Rules on Critical Third Parties to the UK Financial Sector

The Prudential Regulation Authority and Financial Conduct Authority have published a joint policy statement on operational resilience for critical third parties (CTPs) in the U.K. financial sector, which includes their final rules for CTPs. The overall objective of the final policy is to manage risks to the stability of, or confidence in, the U.K. financial system that may arise due to a failure in, or disruption to, the services that a CTP provides to one or more authorised persons, relevant service providers and/or financial market infrastructure entities.

The rules will take effect from January 1, 2025, but will only apply to individual CTPs from the date their HM Treasury CTP designations come into force. HM Treasury has not yet made any such CTP designations.

The final rules are largely as consulted on, though some changes have been made, including:

• additional guidance is provided on how the regulators will identify and make recommendations of CTPs for designation, including that the regulators' assessment of "materiality" of a service for recommending designation may refer to the vulnerabilities listed in the Financial Policy Committee's macroprudential approach to operational resilience, confirmation that firms' in-house service providers will not be recommended for designation and that third-party service providers subject to a regime comparable to the U.K.'s CTP regime (e.g., the U.K. National Infrastructure Resilience Framework) are unlikely to be recommended for designation.
• the scope of CTP Fundamental Rules 1-5 has been limited to a CTP's provision of "systemic third-party services". CTP Fundamental Rule 6 will still apply to all services a CTP provides. The narrower scope of Fundamental Rules 1-5 will be kept under review.
• revisions to the incident notification requirements for CTPs.
• all CTPs must provide the regulators with an address in the U.K. for service of documents. There is no longer a requirement that the U.K. recipient should be a law firm or other suitable U.K.-based corporate body.

Also published are: (a) the regulators' joint final Supervisory Statement SS6/24 - Operational resilience: Critical third parties to the UK financial sector; (b) the Bank of England/PRA's final Supervisory Statement SS7/24 on Reports by skilled persons: critical third parties; (c) the regulators' joint Approach to the oversight of critical third parties. In addition, the BoE published this week its final statement of policy on the approach to enforcement, which includes (at annex 4) the BoE's approach to enforcement against CTPs.

A memorandum of understanding between the BoE, the FCA and the PRA has been laid before Parliament. The MoU outlines how the financial regulators will co-ordinate through a joint CTP Consultation and Coordination Forum in exercising their CTP functions.

Return to main website.