On Nov. 12, UK FCA, UK BoE, PRA issued critical third parties' rules.
UK BoE, UK PRA, UK FCA issued rules for critical third parties (CTP) oversight regime
The new rules are intended to bolster the resilience of technology and other third parties providing key services to financial firms, help protect consumers and firms.
UK GVT will decide which third parties should fall under regime, on regulators' advice.
Contains regulators' final policy: final rules for CTPs set out in UK BoE FMI Rulebook Critical Third Parties Instrument 2024; UK BoE FMI Rulebook: Critical Third Parties Emergency Provisions Instrument 2024; PRA Rulebook: Critical Third Parties Instrument 2024 (PRA 2024/10); FCA Handbook: Critical third parties instrument 2024 (FCA 2024/41); FCA Handbook: Critical Third Parties Statement of Policy relating to Disciplinary Measures Instrument 2024 (FCA 2024/40).
Regulators' joint final supervisory statement SS 6/24Operational resilience: Critical third parties to the UK financial sector; UK BoE and PRA's final SS 7/24Reports by skilled persons: Critical third parties, regulators' approach to oversight of CTPs.
UK BoE's approach to enforcement: proposed changes to statements of policy and procedure following Financial Services and Markets Act 2023 (CTP Enforcement SoP).
Collectively the above documents are referred to as the CTP Oversight Regime.
UK Treasury has also laid before UKP the regulators' memorandum of understanding, which describes how they intend to coordinate their respective functions re CTPs.
Changes from Consultation
62 responses were received, respondents generally supported the overall objective and proposed approach, but requested changes and clarifications to various aspects.
The regulators do not consider that the changes made in the final rules are significant, but have made some amendments in response to feedback to the consultation.
Include additional guidance in the CTP approach document on their approach to identifying potential CTPs and recommending them for designation to UK Treasury.
Added new section to SS 6/24 explaining how the disruption or failure of a CTP's services to firms could impact stability of, or confidence in, the UK financial system.
Added, amended, clarified and/or deleted several key defined terms in their rules and SS 6/24, including renaming material services as systemic third party services.
Recognized shared responsibility model in SS 6/24; and limited the scope of CTP Fundamental Rules 1-5 to CTP's provision of systemic third party services to firms.
Amended and clarified various aspects of CTP Operational Risk and Resilience Requirements in the rules and SS 6/24 in order to make regulators' expectations clear.
The final rules for CTPs will take effect from Jan. 1, 2025, the statutory obligations of a CTP, requirements in regulators' rules and expectations in SS 6/24, other material will only apply to CTP on date designation order made by UK Treasury comes into force.
In addition, compliance with certain requirements in the regulators' rules will be subject to a transitional period that will also start from dates specified in UK Treasury designation order, section 12 of SS 6/24 lists requirements subject to transition period.
