New regulatory powers Powers in relation to critical third parties Oversight by the financial services regulators
The Act gives the Bank, the PRA and the FCA powers to make rules, gather information, and take limited enforcement actions in respect of the services that critical third parties provide to regulated finance firms and financial market infrastructures. All three of the Bank, PRA and FCA will be granted these powers because critical third are relevant to each of their objectives. To ensure alignment, the regulators will be required to consult one another before issuing rules, gathering information or taking enforcement action. The Bank, the PRA and the FCA will shortly publish a Discussion Paper setting out how they would exercise these new oversight powers in practice, and how they would make recommendations to HM Treasury on potential critical third parties.
	The rule-making powers granted to the Bank, the PRA and the FCA will enable them to introduce resilience standards and resilience testing for the services critical third parties provide to regulated finance firms and financial market infrastructure. Resilience standards will enable minimum levels of resilience to be set, and resilience testing will allow the regulators to evaluate whether resilience standards are met in practice. The information-gathering powers granted to the Bank, the PRA and the FCA will enable them to request documents and appoint an independent third party to provide a view on services critical third parties provide to regulated finance firms, as well as to undertake investigations of potential contraventions.
	The enforcement powers granted to the Bank, the PRA and the FCA under the Act enables them to take action if rules or information-gathering requests are not complied with. The Act provides for a range of enforcement actions appropriate to the nature of this new regime. This will include the ability to direct a critical third party to remediate failings or publish a statement noting the critical third party has failed to comply with requests. As an ultimate sanction, the Bank, the PRA and the FCA will have the disciplinary power to prevent a critical third party from providing new or current services to the financial services sector, or set conditions on the provision of those services, where such action will not harm the UK’s financial stability or any of the regulators’ objectives.