Global menu

Our global pages


Discussion Paper: proposals to regulate critical third parties to UK FS sector

  • United Kingdom
  • Commercial agreements
  • Technology
  • Financial services


The draft Financial Services and Markets Bill (FSM Bill), which was put before Parliament on 20 July 2022, establishes a framework for the supervisory authorities (The Bank of England, the PRA and the FCA) to manage the systemic risks posed to the financial services sector by entities designated by HM Treasury as “critical third parties” or “CTPs”.

In their discussion paper ‘DP3/22 – Operational resilience: Critical third parties to the UK financial sector’ (DP), the supervisory authorities set out how they could use their proposed powers in the FSM Bill in order to manage the risk of systemic disruption. The DP is the financial regulators’ joint discussion paper that was promised in HM Treasury’s Policy statement: ‘Critical third parties to the finance sector (June 2022)’, which was the subject of our previous briefing. The DP sets out the supervisory authorities’ proposals for: 

  • identifying entities to be designated as CTPs;
  • setting minimum resilience standards that CTPs would have to comply with in respect of material services provided to firms and FMIs; and
  • testing the resilience of those services.

The context to this is the increasing reliance by financial services firms and FMIs (financial market infrastructure firms) on the services provided by third parties and the systemic risk this poses to individual firms and FMIs, the supervisory authorities’ objectives and the wider financial system. While the evolving regulatory framework has helped to increase the focus on operational resilience within firms and FMIs, there is recognition of the limitations of the current regulatory framework to manage risks that arise because multiple firms have decided to rely on a common third party for certain services (creating a ‘concentration’ of risk in the market) and that additional measures are needed.

In presenting their proposals, the supervisory authorities recognise the challenges posed by regulatory and supervisory fragmentation and the corresponding need for ongoing international regulatory and supervisory alignment. The DP refers to a number of international initiatives relevant to CTPs, including the EU’s Digital Operational resilience act (DORA), and notes that global regulatory and supervisory coordination amongst financial supervisory authorities will continue to be important in the future. The supervisory authorities also recognise the need to coordinate with relevant UK competent authorities and public bodies outside the finance sector with a potential interest in certain CTPs. The DP therefore sets out potential ways to improve international and cross-sectoral coordination.

Impact and actions

The Discussion Paper will have most significant impact third party providers to the financial sector who are designated by HMT as CTPs. If the FSM Bill receives Royal Assent, an entity designated by HMT as a CTP will be subject to minimum resilience standards in respect of material services they provide to firms and FMIs, additional testing of the resilience of those material services, and additional information requirements to the supervisory authorities. This is a step-change in supervision of third party arrangements, as it gives the FCA and PRA the ability to directly supervise CTPs and, if necessary, bring enforcement action.

The potential measures set out in the Discussion Paper would focus on material services that CTPs provide to the financial sector. The supervisory authorities would not have any responsibility or powers for wider regulation of CTPs or services they provide to other sectors besides financial services.

The measures would seek to complement but not replace firms’ and FMIs’ own responsibilities to manage potential risks to their operational resilience. The minimum resilience standards for CTPs would align to and build on the operational framework for firms and FMIs.

Ultimately, HMT would be responsible for deciding whether to designate certain third parties as CTPs, via secondary legislation. The DP outlines the potential factors that the supervisory authorities could use (including materiality of services, concentration risk and potential impact of failure), as well as how the supervisory authorities could coordinate amongst themselves (and, if appropriate, with relevant UK competent authorities and public bodies outside the finance sector) before recommending the designation of a third party as a CTP to HMT.

Next steps

Responses to the DP are due by 23 December 2022.

We anticipate that the following stakeholders will want to consider submitting a response: 

  • Organisations that are likely to be designated as CTPs should respond to the discussion paper, taking the opportunity to shape policy that will directly impact them.
  • Firms and FMIs should respond, as the supervisory authorities emphasise that the new rules will not detract from firms’ accountability for their own operational resilience.

In responding to the DP, stakeholders should consider the ‘Questions’ at the end of each Chapter, which identify the points on which the supervisory authorities are particularly requesting feedback.

The supervisory authorities intend to use responses to inform their policy making in relation to CTPs and they expect to issue a consultation on the topic next year, subject to the FSM Bill’s passage.

As part of the wider push by supervisory authorities in relation to operational resilience, Firms and FMIs may want to consider auditing their current contracts and supply chains to ensure that their service providers are contractually obliged to maintain sufficient levels of operational resilience, security and integrity.