The Bank of England, PRA, and FCA’s New ‘Critical Third Parties’ (CTPs) Regime Comes into Effect from 1 January 2025

Pictured (Left to Right): Sam Woods (CEO at the PRA); Andrew Bailey (Governor at the BoE); and Nikhil Rathi (Chief Executive at the FCA)

Why the ‘Critical Third Parties’ Regime?

The regulatory bodies are growing increasingly concerned about firms and financial market infrastructures' growing reliance on services offered by third parties, most notably technology. The extent to which firms are now relying on these third parties carries significant risk since, in the case that these systems fail or encounter problems, the UK financial system could be threatened.

By introducing the CTP regime, the regulatory bodies hope to “address the potential risks to the stability of, or confidence in, the UK financial system”.

What’s Involved in the CTP Regime?

The regime consists of a suite of regulatory requirements pertaining to operational resilience and will apply to ‘critical’ third-party service providers. The UK Treasury will designate the CTPs to be subject to the new regime and its designation orders will further specify when the new regime will take effect for those specific providers.

The Six Fundamental Rules

Under the new regime, providers designated will be subject to six fundamental rules, much like the high-level principles that UK-regulated firms must adhere to in, for example, the FCA Handbook.

Impact on Businesses

By following these rules, firms will have to: conduct their business with integrity; and with due skill, care and diligence; act in a prudent manner; have effective risk strategies and risk management systems; organise and control their affairs responsibly and effectively; and deal with each regulator in an open and cooperative way, and disclose to each regulator appropriately anything relating to the CTP of which it would reasonably expect notice.

Businesses Affected

The scope of the fundamental rules is limited to services deemed ‘systemic third party services’ that providers provide to firms. However, the exception to this is the sixth rule covering regulatory cooperation and disclosures – it is wider in scope and applies to all the services providers offer.