In a strategic move to bolster the robustness of the UK's financial sector, The Bank of England, Prudential Regulation Authority (PRA), and Financial Conduct Authority (FCA) have united to propose groundbreaking measures. These joint proposals, unveiled on December 7, 2023, aim to oversee and reinforce the resilience of critical third parties (CTPs) that provide services to regulated financial entities.
The financial landscape has undergone significant transformations, with CTPs playing a pivotal role in delivering operational resilience and fostering innovation for financial firms and market infrastructure entities. However, the potential risks posed by disruptions or failures of these critical players are a real concern for the stability of the UK financial system. Recognizing the need for a comprehensive approach, the regulators are stepping in to provide a proportional level of direct regulatory oversight.
Navigating chaotic third-party dependencies
The proposed measures are set to bring clarity and order to the intricate web of third-party dependencies. While acknowledging the benefits that CTPs bring, the regulators emphasize the necessity of managing associated risks collectively. The goal is not to overshadow the responsibilities of individual firms but to enhance their capabilities in operational resilience and third-party risk management.
Sam Woods, Deputy Governor of Prudential Regulation and CEO of the PRA, emphasized the significance of third-party service providers, stating, "We are consulting on proposals to implement new powers given to us by Parliament to manage these risks for those providers who could present risks to financial stability, in an effective and proportionate way."
Strategic oversight for Operational Resilience
The proposed framework is designed to address the evolving landscape where financial market infrastructure firms increasingly rely on third-party technology providers. Sarah Breeden, Deputy Governor for Financial Stability, highlighted the importance of the proposals in managing systemic risks effectively. She stated, "The proposals... enable the Bank of England, in coordination with the PRA and the FCA, to manage these systemic risks while enabling UK FMIs also to benefit from using such providers."
Nikhil Rathi, Chief Executive of the FCA, underlined the potential benefits of well-managed outsourcing, noting, "These proposals will improve the resilience of the critical third-party services that financial firms and their customers depend on, support market integrity, and enhance UK competitiveness and growth."
Unpacking the proposal
- The comprehensive proposals outlined in the consultation paper include:
- Identification and designation of potential CTPs to HM Treasury (HMT).
- Fundamental rules applying to all CTP services, acting as a general statement of their obligations.
- Granular operational risk and resilience requirements for material services, covering technology, cyber resilience, supply chain risk, change management, and incident management.
- Information and assurance requirements for CTPs, including annual self-assessment and scenario testing.
- Notification requirements for specific disruptions impacting services.
- Importantly, CTPs will not be authorized or overseen in their entirety by the regulators, ensuring a balanced approach that maintains the autonomy of individual entities.
Looking ahead: Building a Resilient Future
The consultation period for feedback on these proposals is open until March 15, 2024. Pending feedback, the regulators plan to publish final requirements and expectations for CTPs in the second half of 2024.
As the financial sector braces for a future that demands resilience and adaptability, these proposals represent a confident stride towards bringing order to the complexity of third-party dependencies. By fortifying the foundations of the financial system, the UK aims to emerge stronger, more competitive, and better equipped to navigate the challenges of the evolving financial landscape.
A made for mutuals solution to help build resilience
We help risk professionals excel in the face of disruption. Without Excel.
Book a demo of Ansarada GRC. See Operational Resilience in action.
This blog was original published on Ansarada.com.
Comments