UK Authorities Publish Discussion Paper on Critical Third Parties

The discussion paper sets out potential measures for how the supervisory authorities could use their proposed powers, which include:

• A framework for identifying potential critical third parties, which would inform the supervisory authorities’ recommendations for formal designation by HM Treasury.
• Minimum resilience standards, which would apply to the services that designated critical third parties provide to firms and financial market infrastructure firms (FMIs).
• A framework for testing the resilience of material services that critical third parties provide to firms and FMIs using a range of tools, including but not limited to scenario testing, participation in sector-wide exercises, cyber resilience testing, and skilled persons reviews of critical third parties.

These measures would complement, not replace, firms and FMIs’ existing responsibilities to manage risks from contracts with third parties. The supervisory authorities would only oversee the systemic risks arising from the services critical third parties provide to firms and FMIs. Subject to the outcome of Parliamentary debates on the Financial Services and Market Bill, and having considered responses to this discussion paper, the supervisory authorities plan to consult on their proposed requirements and expectations for critical third parties in 2023.

The proposals in CP13/22 would result in changes to the Statement of Policy on PRA’s approach to identifying O-SIIs (Appendix 1). The proposals would also result in an amendment to the Statement of Policy on interpretation of EU guidelines and recommendations with respect to BoE and PRA approach after the UK’s withdrawal from the EU (Appendix 2). The PRA’s approach to identifying O-SIIs currently follows the European Banking Authority’s (EBA) guidelines on criteria to assess O-SIIs. The EBA guidelines set out a two stage process for O-SII identification. The first stage is a minimum mandatory framework, which consists of a prescribed set of criteria, indicators, and weights that authorities should use to identify the institutions that must be designated as O-SIIs. The second stage offers authorities the discretion to overlay the mandatory part of the framework, in order to better reflect the specificities of the national banking sector, and if appropriate, designate additional firms as O-SIIs. PRA uses its own scoring methodology under this stage. The proposed amendments involve:

• the removal of EBA’s scoring methodology from the O-SII identification process, and deletion of the EBA guidelines, such that O-SII identification is based solely on the PRA’s scoring methodology
• updates to specific indicators and weights in the PRA’s scoring methodology for O-SII identification.

PRA proposes that the implementation date for the changes resulting from CP13/22 would be on the date of publication of the final revised Statement of Policy. PRA, therefore, expects to carry out the 2022 O-SII designation process under the revised approach. In line with the Statement of Policy, PRA will publish the list of firms designated as O-SIIs under this process by December 01, 2022.

Related Links

• Press Release
• Discussion Paper on Operational Resilience
• Consultation Paper on Identification of O-SIIs

Keywords: Europe, UK, Banking, Securities, Critical Third Parties, Discussion Paper, FMI, O-SII, Statement Of Policy, Regulatory Capital, Basel, Operational Resilience, Cyber Risk, Regtech, Outsourcing Arrangements, Cloud Computing, BoE, PRA, FCA