UK financial regulators have confirmed new rules to bolster the resilience of third parties providing key services to financial firms.
The FCA says financial firms and financial market infrastructures (FMIs), such as payment systems, have become increasingly reliant on the services of a small number of third party providers, known as critical third parties.
While these third parties can enhance competitiveness for the sector, disruption or failure to one of them — such as a cyber-attack or power outage — could affect a large number of consumers and firms.
In 2023 the government gave regulators new powers to oversee the resilience of the services these third parties provide the sector, that may cause risks to financial stability.
Today, the FCA, Bank of England and Prudential Regulation Authority have set out how they intend to use the new powers, working closely with industry to inform the design of the regime. The new rules align closely with international standards and similar regimes, like the EU’s Digital Operational Resilience Act.
The final rules aim to strengthen the resilience of the services that critical third parties provide to individual firms and improve the resilience of the UK financial services sector as a whole.
The government will decide which third parties should fall under the new regime based on advice from regulators.
The rules will require critical third parties, once designated, to:
- provide regular assurance, information and notifications to the financial regulators on their services,
- undertake various forms of resilience testing and scenario-based exercises, including collaborating on some with their firms and FMIs,
- report major incidents like cyber-attacks, natural disasters and power outages.
