Outsourcing and third party risk management part of the Code of Practice

The PRA has published a so-called Outsourcing and third party risk management part of the Code of Practice for RPSOs and SSPs which shall apply to all firms operating in the UK unless firms are located in a third country for which the Bank of England has determined equivalence as far as the rules and regulations of the third country regulatory authority for the supervision over the RPSOs or SSPs is concerned.
The Code sets out requirements upon RPSOs and SSPs prior to concluding any outsourcing arrangements and following any such agreement. The key obligations are briefly noted below:
(1) Governance requirements including the obligation of the Board to „approve, implement and regularly review a written outsourcing and third party risk management policy“ and keep records of any of the outsourcing arrangements;
(2) Pre-outsourcing obligations including the identification of the criticality of the service, due diligence as regards the outsourcing provider (screening of its capabilities), or the prior notification of the Bank of England as regards new outsourcing arrangements;
(3) Outsourcing agreement obligations such as the necessity to conclude any agreements in written form only, the necessity to include provisions as to possible audits of the third party service provider, or the need to include in the agreement provisions to require the service provider to get approval from the RPSO and SSP prior to the conclusion of any sub-outsourcing arrangements;
(4) Data security obligations including the necessity to „establish, implement and maintain appropriate measures“ to safeguard transferred data or access to transferred data and the need to require the third party service provider to implement robust oversight and control measures in this context; and
(5) Business continuity and exit plan requirements including the obligation to establish, maintain, test, and – if necessary – revise a business continuity plan and the obligation to maintain a so-called exit strategy which must cover both an orderly exit or an exit under „stressed conditions“.
—————————–
The new Code* will come into force on February 9, 2024.