New regulatory powers Powers in relation to critical third parties
Regulated financial services firms and financial market infrastructures are increasingly outsourcing important services to third parties outside the financial services regulatory perimeter. For example, many firms are frequently using a small number of third parties to provide cloud services. Cloud services are digital platforms infrastructure that are hosted by a third party that firms use to support their own business. Where many firms use the same third party to support services that are important to the economy, failure of this ‘critical’ third party could result in significant negative impacts on the functioning of the financial services sector – for example, by disrupting the ability of businesses and individuals to make payments or withdraw funds. The Bank, the PRA and the FCA have powers that are designed to allow them to mitigate serious risks to the financial services sector, but these powers are largely restricted to regulated financial services firms. The regulators can impose requirements on regulated financial services firms designed to limit their risk of failure or disruption, and improve resilience. However, the regulators have no equivalent powers in relation to critical third parties.
	The Bank, the PRA and the FCA can impose indirect obligations on third parties, by requiring firms to incorporate resilience requirements in contracts with these entities. But the nature of the relationship between firms and critical third parties mean indirect contractual obligations are often difficult to enforce, as a small number of critical providers are dominant in the market, so firms may find it difficult to influence these providers, or to find an alternative provider that is more resilient. The Bank and the PRA can also impose direct requirements on third parties, but these are insufficient because they only relate to third parties to payment systems.