FIN.

Treasury to introduce service provider “critical third party” regime

Treasury has been working with BoE, PRA, FCA and other stakeholders to develop a proposal to protect against the failure of key service providers. Over recent years, firms have become increasingly reliant on key service providers and, in 2020, over 65% of firms used the same 4 cloud service providers. Under its recent proposal, Treasury will be able to designate certain third parties which provide services to firms as “critical”.

Treasury will need to consult the financial regulators and other relevant bodies, and the proposed designated firms themselves before making a designation, or the regulators might proactively recommend a designation.  The designation will take into account high-level criteria such as the number and type of services a third party provides to firms; and the materiality of these services. This designation framework will be set out in primary legislation, with the ability to make specific designations in secondary legislation.

The financial regulators will then be able to make rules, gather information, and take enforcement action in respect of material services that critical third parties provide to firms, and set minimum resilience standards that critical third parties will be directly required to meet in respect of any material services that they provide to regulated firms. The new regime will also allow the regulators to require critical third parties to take part in a range of targeted forms of resilience testing, to assess whether these standards were being complied with.

The regulators will have a range of statutory powers, including the power to make or prevent providers from taking specific actions; and enforcement powers including a power to publicise failings, and (as a last resort) to prohibit a critical third party from providing future services, or continuing to provide services to firms.

While Treasury has already decided to introduce this regime, it now needs to legislate for it and then, in due course, the regulators will be publishing a joint Discussion Paper, setting out:

  1. how any powers granted to them in legislation might be exercised, and seeking views from industry on the most effective and proportionate way to do so;
  2. the role of the financial regulators during designation, including how they might make recommendations to  Treasury during consultation; and
  3. ways for the financial regulators to coordinate the exercise of their powers with overseas financial regulators, and UK authorities and regulators from outside the financial services sector.

Harshil Patel