The FCA, PRA, and Bank of England have published their finalised critical third party (CTP) rules (and accompanying guidance) in PS24/16 Operational resilience: Critical third parties to the UK financial sector.[1]The new rules, which come into force on 1 January 2025, will see designated technology providers whose failure is deemed to pose a systemic risk to the UK financial system become subject to new principles-based, outcomes-focused rules and requirements overseen by the financial services regulators. This is timely given the increasing trend in third-party related incidents affecting operational resilience at financial services firms.  On 31 October, the FCA published its “lessons for operational resilience” following its review of the financial services sector’s response to the recent CrowdStrike outage, which noted that third-party related issues were the leading cause of operational incidents reported to it in 2022-2023. This only serves to bolster the regulatory case for the CTP rules, given the risk posed to the stability of financial markets by dependence on a small number of third party service providers.  The new CTP rules sit alongside the wider rules on operational resilience set-out in PS21/3 Building operational resilience, which become fully operational on 31 March 2025.

The much-promised financial promotions gateway has now become law. The UK financial promotions regime is undergoing a large amount of change at the moment, which we discussed previously.