How will the new critical third party regime affect you?

Home
Knowledge
The Financial Services and Markets Act 2023: evolution or revolution?
How will the new critical third party regime affect you?

How will the new critical third party regime affect you?

{95E73A5F-2DE5-4F96-AC91-6EB6538F9F02}

August 4, 2023

Third-party service providers are an increasingly significant element of the global financial services (FS) ecosystem. They have been described as too important to fail and are perceived to present an increasing risk to financial stability.¹

These third-party suppliers provide a range of services to FS firms but perhaps the most important at the moment, particularly for banks and insurance companies, is critical cloud-based services (for example, using the cloud to run software or provide additional capacity, or supporting IT infrastructure).² Even if these third-party suppliers do not directly supply a particular FS firm, they will often support others in the firm’s supply chain. The increasing significance of these services to the FS system is recognised at a supra-national level, with various bodies issuing standards for elements of the ecosystem.³ However, despite their increasing significance, these third-party suppliers are not currently inside the perimeter of UK financial services regulation.

When third-party service providers are well-managed, they add value to FS firms by reducing costs, providing innovation and improving efficiency. However, they also potentially pose unique systemic risks to the UK’s financial system. These risks arise from a combination of:

the dependency of firms on a limited number of third-party service providers. This concentration in the provision of key services within the sector continues to increase, with HM Treasury noting in its June 2022 policy statement on critical third parties to the FS sector that, as of 2020, more than 65% of UK firms used the same four cloud providers for cloud infrastructure services.⁴ The Bank of England (the Bank) has similarly concluded that there was a significant concentration of cloud-based service providers for banks and insurance companies;⁵
the limited number of firms with the capacity to provide the required services at scale means that service recipients would be unlikely to recover or substitute a third party’s services following disruption, particularly when all other recipients are also looking for a replacement provider;
the heightened risk of cyber threats arising from geopolitical issues. The National Cyber Security Centre’s (NCSC) Annual Review 2021 noted that there were a rising number of cyber incidents which highlighted the targeting of viability, effectiveness and global reach of supply chain operations as a means of compromising otherwise comparatively well-defended targets.⁶ Accordingly, FS firms are increasingly at risk of supply chain attacks on a small number of providers, with few alternative suppliers.

Under the current system, the financial regulators, principally the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA), but also the Bank, have developed operational resilience frameworks with which firms must ensure that their contractual arrangements with third-party service providers comply. These frameworks include requirements relating to areas such as data security, business continuity and exit planning.⁷ The frameworks are designed to ensure that FS firms and financial market infrastructure firms (FMIs) have robust plans in place to deliver essential services, no matter what the cause of the disruption, which include man-made threats such as physical and cyber attacks, IT systems outages and third-party supplier failure.⁸ These are important features for financial services firms operational risk management, because traditional risk mitigation (such as capital requirements) cannot mitigate against these technology/third-party supplier risks and so operational resilience requires new and different mitigation mechanisms.⁹

However, in light of the risks identified above, the regulators and HM Treasury have concluded that the existing regulatory powers and frameworks are not, by themselves, sufficient to tackle the systemic risk that disruption at a third-party supplier providing key services to multiple firms could cause. Contractually, individual firms are unable to manage these systemic risks (and it is not their role). There may also be power imbalances between certain third parties and smaller firms, which may prevent firms from obtaining adequate assurances that their agreements are at the appropriate level of operational resilience.¹⁰

Filling the regulatory gap

In order to fill the regulatory gap, the Financial Services and Markets Act 2023 (the Act) establishes a new Critical Third Party (CTP) regime. Sections 18 and 19 of the Act insert a new chapter (chapter 3C of Part 18) into the Financial Services and Markets Act 2000 (FSMA) and make consequential amendments to other legislation. The CTP regime establishes a new suite of powers for the regulators to directly regulate CTP service suppliers, rather than rely on FS firms to manage risks through contractual arrangements. It is important to note that the new regulatory regime will only apply to third-party suppliers that are designated by HM Treasury as “critical”. We anticipate that those firms that are designated as CTPs are likely to be a small percentage of the total number of third parties providing services to the financial sector.

The new regime will combine the following measures which will be discussed in this note.

A framework for identifying potential CTPs for designation.
Minimum resilience standards for designated CTPs.
Resilience testing tools.

Shortly after the Act was introduced into Parliament, the PRA and FCA issued a joint discussion paper (PRA DP3/22, FCA DP22/3) (the Joint Discussion Paper)¹¹ setting out in detail how they might exercise the statutory powers granted to them under the Act. Accordingly, we have a good idea about how the new regime will look in practice.

A framework for identifying potential CTPs for designation

The designation framework is set out in new section 312L of FSMA¹² and we anticipate that the financial regulators might, based on their analysis of data and information from firms, proactively recommend to HM Treasury that certain firms should be designated as a CTP. Before designating a firm as a CTP, HM Treasury must have regard to:

the materiality of the services provided to the delivery of essential activities, services or operations; and
the number and type of authorised persons, relevant service providers or FMIs to which the person provides services.¹³

A detailed overview of the high-level criteria for designation is set out in the Joint Discussion Paper.

There are a number of procedural requirements with which HM Treasury must comply. Before it makes a designation order, it must:

consult the relevant regulator(s) and any other persons that HM Treasury considers appropriate;
give written notice to the person to be designated in sufficient time for them to make representations in writing to HM Treasury; and
have regard to any representations which it receives from the person to be designated.¹⁴

The definition of CTP is not limited to services which are currently provided. New potential CTPs may also be identified as the reliance of firms in the financial sector on certain services grows. For example, certain third parties providing data and artificial intelligence (AI) or machine learning (ML) models could emerge as future potential CTPs as a result of the increasing use of such data and models in trading systems. The financial regulators will have to carry out a real-time risk analysis based on evidence showing the reliance of firms in the financial sector and this is a matter that firms should consider as they develop services for such sector.

Minimum resilience standards for designated CTPs

New section 312M of FSMA¹⁵ confers powers on the regulators to set, through rules, minimum resilience standards for CTPs in relation to the services they provide. These may build on the existing operational resilience framework for firms in the financial sector and focus on the ability of CTPs to handle operational disruption. CTPs would have to ensure that any material services they provide to the UK financial sector meet the minimum resilience standards.

The regulators recognise that CTPs may take many forms and a one-size-fits-all approach to CTP resilience testing may not be effective. Accordingly, they propose a flexible approach with a few possible options, such as requesting information directly from CTPs on the resilience of their material services to firms, commissioning an independent “skilled person” to report on certain aspects of a CTP’s services and appointing an investigator to investigate potential breaches of requirements under the legislation, amongst other options. A more detailed list is set out in the Joint Discussion Paper.

Resilience testing tools

Chapter 6 of the Joint Discussion Paper also sets out some potential resilience testing tools that the supervisory authorities could use with CTPs. Overviews of the tools are set out below.

Scenario testing

The financial regulators could introduce a requirement on CTPs to carry out regular scenario testing of their ability to continue providing material services in the event there is a severe disruption to their service. This requirement may mirror the requirement in the financial regulators’ operational resilience framework for firms, which was described as:

“the testing of a firm or FMIs' ability to remain within its impact tolerance for each of its important business services in the event of a severe (or, in the case of FMIs, extreme) but plausible disruption of its operations. In carrying out the scenario testing, a firm must identify an appropriate range of adverse circumstances of varying nature, severity and duration relevant to its business and risk profile, and consider the risks to delivery of the firm or FMIs' important business services in those circumstances.”¹⁶

We would expect any requirement on CTPs to be adjusted to reflect their individual characteristics. In particular, the financial regulators would be particularly interested in CTPs’ ability to prevent operational disruption from creating or amplifying systemic risks.

As the regulators are also focused on the potential systemic risks to their objectives, the scenario testing is likely to involve multiple firms simultaneously requiring the CTP to restore or support the continued provision of material services following disruption. Although the scenarios are likely primarily to comprise issues involving data storage or IT infrastructure, the approach to scenario testing is intended to be more holistic. For example, CTPs could be required to consider climate scenarios in their scenario testing. Similarly, the financial resilience of a CTP could also be tested if deemed as posing a system risk to the regulator’s objective. Where established, it could be appropriate for the regulators to assess the potential implications of the CTP’s financial distress or failure on the continuity of any material services it provides to firms.

Sector-wide exercises

Instead of focusing on the resilience of individual CTPs, sector-wide exercises are designed to validate the ability of the whole financial services sector to respond to severe but plausible sector-wide operational incidents. These exercises involve multiple firms in the financial sector and can be led by financial regulators or industry bodies. There have been many examples of similar sector-wide stress testing and such activities may follow reasonably well-trodden paths.

These exercises can provide valuable lessons for the entire financial sector and can be carried out on a cross-border basis in collaboration with non-UK financial regulators. The main drawback of sector-wide exercises is the level of co-ordination, resources and time required to organise them. The financial regulators could therefore expect to use sector-wide exercises in conjunction with other testing tools that can be used more frequently, such as scenario testing, as described above.

Cyber-resilience testing

The financial regulators could conduct cyber-resilience testing of CTPs. Cyber-resilience testing is a well-established tool in the UK which requires tailoring to different types of CTPs to be effective. Some potential ways to carry out cyber-resilience testing of CTPs could include:

individual cyber-resilience testing of a select group of CTPs overseen by the financial regulators on a rotating basis (for example, each CTP in the group could be tested every three years);
a wider range of CTPs performing their own cyber-resilience testing with limited oversight from the financial regulators. These CTPs could be required to share the results of these tests with the financial regulators and agree a remediation plan if appropriate; and/or
a requirement for relevant CTPs to actively support firms’ cyber-resilience tests.

Cyber-resilience testing has limitations as it is resource-intensive, with individual assessments taking approximately nine months to complete. Furthermore, cyber-resilience testing of certain CTPs, such as cloud service providers (CSPs), would need to consider the complexity of their information and communications technology (ICT) infrastructure, and the fact they provide services to institutions in multiple sectors.

Information-gathering and skilled persons’ reviews

The Act confers on the financial regulators the powers to gather information and contains commission skilled persons’ reviews of CTPs for resilience testing purposes (similar to their powers under section 166 of FSMA and section 195 of the Banking Act 2009). This obligation would extend to any person who is providing (or who has at any time provided) services to the CTP relating to the matter concerned, including “nth parties” in a CTP’s supply chain.

This type of testing can be used selectively, unlike other resilience testing tools which could be used cyclically or regularly. For example, the financial regulators could use them if they had specific concerns about an aspect of the services a CTP provides to firms in the financial sector, or to monitor the implementation of actions they had requested the CTP to take.

The financial regulators could either appoint skilled persons directly from a panel, or approve a skilled person nominated by a CTP.

What does this mean for firms that could be defined as CTPs?

As the proposed regime targets third-party service providers that are unregulated and outside the financial services regulatory perimeter, its introduction is likely to be their first exposure to regulatory oversight by financial regulators in the UK. In light of innovations in other jurisdictions, such as the EU’s DORA, CTPs can expect to come under an increasingly global regulatory burden.

The financial services regulators make it clear that they will only focus on the material services that these third parties provide to firms in the financial sector. They would not be concerned with the entirety of the services they provide to other sectors of the economy, which should be welcome news to potential CTPs.

Although the legislative measures are now finalised, how they will be implemented is less certain, with further consultation planned for 2023. This consultation will contain more concrete proposals and service providers to the financial sector may want to start considering whether any services they offer to UK firms could make them potential targets for designation as CTPs. If so, we would suggest that they familiarise themselves with the proposed rules and respond to the consultation in order to ensure their views are represented in the development of the regime. Because many CTPs provide services across international borders and to clients in multiple jurisdictions, the joint discussion paper makes it clear that the financial regulators’ potential measures would be agnostic about the location of CTPs. This approach recognises that, whilst this can help improve the efficiency and resilience of firms, the risks to UK financial services remains.

The way that the regulators implement the new regime will need to reflect their new secondary growth and international competitiveness objective, which reflects the importance of the financial services sector to the government. We anticipate that this will help to ensure that the proposed CTP regime will be flexible and proportionate, ensuring that the UK is able to harness the benefits of outsourcing, whilst combatting the systemic risk it poses.

A welcome evolution of the regulatory perimeter

The introduction of this regime feels quite revolutionary in that it brings into the regulatory perimeter an activity that has previously not been regulated. However, the mere fact that a previously unregulated activity will now be regulated is not new. Neither is regulation of outsourced service provision. It is the fact that the service providers are to be regulated which is new.

The format of the regulatory regime is not novel. It is firmly based on the FSMA model and will be sufficiently familiar to entities that are currently regulated, but might be unfamiliar to those entities that provide services to financial or non-financial services firms.

It will also be important for financial services firms which receive services from CTPs to consider how this might affect their relationships with these suppliers in terms of how it might affect their contractual arrangements and the commercial terms on which they negotiated these contracts.

Whilst not necessarily revolutionary, this is definitely a significant evolution in the regulation of financial services firms. It reflects a significant evolution in the shape of the markets for financial services and how financial services firms operate their businesses. The financial services ecosystem enjoys an increasing symbiosis with the world of technology, which brings increasing opportunities to both, but also introduces new types of risks, both to firms and the system as a whole.