Starting January 1, major tech companies working with UK financial institutions will face stricter oversight under new regulations designed to mitigate risks posed by critical third-party suppliers. The Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) will gain powers to take action if service providers present risks to the financial system.
These critical third parties will be required to co-operate with regulators during incidents, ensuring proper documentation of risk management and security protocols. Additionally, the FCA and PRA could demand section 166 reports from tech companies, similar to existing requirements for the finance sector, to assess internal processes.
As banks increasingly outsource IT infrastructure to tech giants, potential disruptions pose significant risks to market stability. The recent CrowdStrike Holdings outage in July highlighted these concentration risks. Roughly 70% of banks and 80% of insurers rely on just two cloud providers, underscoring the importance of addressing this dependence.
The Bank of England emphasized the dual nature of third-party tech providers: while they can boost competitiveness, disruptions—such as cyberattacks or power outages—could impact a vast number of consumers and endanger the stability of the UK financial system.
The UK Treasury will determine which companies are deemed critical, with input from regulators.
Comments
Post a Comment