New regulatory powers Powers in relation to critical third parties
The Bank, the PRA and the FCA’s indirect power over third parties results from their direct powers over the firms they authorise and regulate under the Banking Act 2009 (for the Bank) and FSMA 2000 (for the PRA and the FCA). Under section 180-191 of the Banking Act 2009, the Bank has the power to establish principles, codes of practice and requirements for operators of recognised payments systems. Under section 137A of FSMA 2000, the FCA has the power to ‘make such rules applying to authorised persons’ with respect to their carrying out any activities, regardless of whether these are regulated or not. The PRA has a similar power under section S137G of FSMA 2000 in respect of PRA-authorised persons.
	The Bank, the PRA and the FCA have used these powers to attempt to mitigate risks from third parties. In 2021, for example, the Bank, the PRA and the FCA introduced new rules on operational resilience  . In addition, the PRA introduced modern expectations on outsourcing and third party risk management  .
	In comparison to their powers over authorised entities, the Bank, the PRA and the FCA have very limited direct powers over unrelated third party service providers to authorised firms.
	The Bank can have direct regulatory power over a service provider to a recognised payments system but only if HM Treasury has specified that service provider in an order made under S206A of the Banking Act 2009. HM Treasury has to date specified only one such service provider.
	The PRA has power under section 165A of FSMA 2000 to obtain information or documents from certain third parties, including service providers to PRA- and FCA-authorised firms, where the information or documents are relevant to the stability of the UK financial system or reasonably required by the Bank in connection with the exercise of its functions in pursuit of its financial stability objective. Exercise of the section 165A power is subject to significant procedural safeguards.