FCA publishes Operational Resilience Consultation Paper

The PRA, FCA and Bank of England have issued a joint Consultation Paper setting out the proposed requirements to be established in terms of rules and accompanying expectations for critical third parties (CTPs). The key aim of the proposed requirements and expectations is to manage potential risks to the stability of, or confidence in, the UK financial system that may arise due to a failure in, or disruption to, the services that a CTP provides.

The proposals will not place any additional requirements on firms. Rather, they aim to complement existing obligations on operational resilience and third-party risk management. Firms will remain accountable and responsible for assessing the materiality and risks associated with each of their outsourcing and third-party arrangements and performing appropriate and proportionate due diligence.

CTP’s designated status will not necessarily mean that it is inherently more resilient, safer, or more suitable to provide a given service to firms.

The regulators intend to recommend third parties for designation as CTPs based on their assessment of the potential impact that a failure in, or disruption to, these third parties’ services could have on the stability of or confidence in, the UK financial system. This is proposed to be done by regulators identifying potential CTPs to HMT by assessing against three criteria:

• Materiality of the services which the third party provides to firms;
• Concentration of the services which the third party provides to firms; and
• Other drivers of potential systemic impact.

One potentially relevant additional factor is the substitutability of a third party’s services to firms (in particular, material services), which may arise due to:

• the lack of viable alternative providers for one or more services; or
• the potential difficulties (including risks) that firms may face when migrating services on time from one third party to another or back in-house.

Firms that may meet the criteria as a CTP which are already subject to regulation and supervision/oversight by the regulators, are unlikely to be recommended for designation.

Critical Third Parties will have their own set of Fundamental Rules and Resilience Standards, which are laid out in the Consultation Paper.

The regulators propose to require each CTP to submit a written self-assessment to the within three months of designation and thereafter within 12. Responses are requested to be completed by 15 March 2024.

Read the full paper here.