Supplier management for FCA-regulated firms
Outsourcing records, notifications, audit rights and tested exit plans, kept the way the FCA and your auditors expect.
For an FCA-regulated firm, a supplier can be more than a cost line. If it performs a function you would otherwise do yourself, it may be outsourcing under the FCA's rules, and if it supports an important business service, its failure is your operational resilience problem. The FCA is clear that firms can't delegate their regulatory responsibility to a third party. This page summarises what applies and how SupplierVault helps you keep the records.
This is a summary, not regulatory advice. Which rules apply depends on your firm type and permissions. Check with your compliance team.
What's different for regulated firms
- Outsourcing has its own rules. Whether an arrangement is outsourcing, and whether it's critical or important, decides which requirements apply.
- The FCA may need to know. Material outsourcing usually has to be notified to the FCA in advance.
- Contracts need specific terms: audit and access rights for you and the regulator, sub-outsourcing controls, termination rights and exit support.
- Exit plans are expected for critical arrangements, and should be realistic and tested.
- Operational resilience maps services, not suppliers, so you need to know which suppliers support which important business services.
The rules and expectations that apply
Outsourcing: SYSC 8
Chapter 8 of the FCA's Senior Management Arrangements, Systems and Controls sourcebook (SYSC 8) sets requirements for outsourcing. When a firm relies on a third party for critical or important operational functions, it must take reasonable steps to avoid undue additional operational risk, and must not outsource in a way that impairs its internal controls or the FCA's ability to monitor its compliance. Firms remain fully responsible for their regulatory obligations. Notification duties for critical, important or material outsourcing sit in SYSC 8.1.12 and SYSC 13.9.2, alongside the general duty under Principle 11 to tell the FCA about matters with a serious regulatory impact (SUP 15.3.8).
Cloud and IT outsourcing
The FCA's guidance FG16/5 explains how firms should approach cloud and other third-party IT outsourcing, including legal and regulatory considerations, risk management, data security, access and audit, and exit planning. Firms covered by the European Banking Authority's outsourcing guidelines follow those instead, and the FCA's approach aligns with the PRA's supervisory statement on outsourcing for dual-regulated firms.
Operational resilience: SYSC 15A
Firms within scope of SYSC 15A, including banks, building societies, insurers, enhanced scope SM&CR firms, and payment and electronic money institutions, must identify their important business services, set impact tolerances and map the people, processes, technology, facilities, information and third parties each service depends on. Since 31 March 2025, these firms must be able to stay within their impact tolerances in severe but plausible scenarios, which means knowing what happens if a key supplier fails.
Incident and third-party reporting
The FCA has published new rules on operational incident and third-party reporting (PS26/2), which take effect on 18 March 2027. They clarify which material third-party arrangements firms must report, when and how. Check with your compliance lead whether they apply to your firm.
Critical third parties
Under the critical third parties regime, the FCA, the PRA and the Bank of England can oversee certain third parties, designated by HM Treasury, whose failure could threaten financial stability or confidence. The regime doesn't reduce a firm's own responsibility for its outsourcing and operational resilience.
What to record for each arrangement
| Record | Why |
|---|---|
| Is it outsourcing, and its classification (critical or important, material, not material) | Decides which requirements apply |
| Important business services it supports | Links supplier risk to operational resilience mapping |
| Date the FCA was notified, if required | Evidence of meeting notification duties |
| Data location and data protection terms | UK GDPR and FG16/5 expectations on data access and security |
| Audit and access rights, for you and the regulator | Required in outsourcing contracts |
| Termination rights and sub-outsourcing consent | Lets you exit or control the supply chain |
| How easy it is to replace, and the exit plan with the date last tested | Shows the exit plan is realistic |
| Risk assessments and due diligence, with dates | Shows ongoing oversight, not a one-off check |
Where to start in SupplierVault
Choose the FCA-regulated firms starter set-up, or tick "Regulated by the FCA or PRA" in Settings at any time. Then:
- Each supplier can carry an FCA outsourcing record: whether it's outsourcing, its classification, the important business services it supports, when the FCA was notified, data location, audit and termination rights, sub-outsourcing consent, how easy it is to replace, and when the exit plan was last tested, with the plan attached.
- The Outsourcing register (FCA) report lists every arrangement in one table for your board, auditors or the regulator.
- Tiers and risk reviews put critical suppliers on the shortest review cycle, and in the tier assessment, a regulated activity such as FCA outsourcing counts as high regulatory exposure, which puts the supplier in at least T2.
- Contract dates, notice deadlines and exit plans sit on the same record, with a tamper-evident audit trail of every change.
- Give internal audit or an external auditor read-only access that ends on a date you choose, with every view logged.
Every setting can be changed afterwards. SupplierVault records the evidence; your compliance team decides how each rule applies to your firm.
Useful guides and tools
- Third-party risk management
- Supplier risk tier calculator
- Supplier audit checklist
- Supplier offboarding checklist
Sources
- Outsourcing and operational resilience (FCA)
- SYSC 8: Outsourcing (FCA Handbook)
- SYSC 15A: Operational resilience (FCA Handbook)
- FG16/5: Guidance for firms outsourcing to the cloud and other third-party IT services (FCA, PDF)