UK and EU regulators sign Memorandum of Understanding to strengthen oversight of critical third parties

Assertion

The Monetary Conduct Authority, Financial institution of England and Prudential Regulation Authority (UK regulators) have collectively signed a Memorandum of Understanding (MoU) with the European Supervisory Authorities to boost cooperation and oversight of crucial third events (CTPs) that fall underneath the UK’s CTP regime.

The MoU establishes a framework for coordinating and sharing info on the oversight of CTPs underneath the UK regime and Important Third Occasion Suppliers (CTPPs) underneath the EU’s Digital Operational Resilience Act (DORA), together with throughout incidents reminiscent of energy outages or cyber-attacks.

The MoU goals to handle potential dangers to monetary stability and market confidence, in addition to strengthen worldwide cooperation. It should additionally assist cut back duplication and regulatory burden on CTPs and CTPPs.

The UK’s CTP regime enhances comparable worldwide requirements and is designed to be appropriate with DORA. The settlement demonstrates UK regulators’ dedication to cross-border cooperation and strengthening operational resilience to assist development and promote market stability.

Background

• In 2024, UK regulators introduced new rules to bolster the resilience of crucial third events offering key providers to the monetary sector.
• These guidelines got here into impact on 1 January 2025 and apply as soon as a CTP is designated by HM Treasury (HMT).
• HMT is chargeable for deciding which third get together service suppliers ought to fall underneath the brand new CTP regime. The principles would require designated CTPs to offer common assurance, undertake resilience testing and report main incidents.
• The designation course of has begun and the regulators will proceed to work with HMT all through the designation course of.
• The regime doesn’t cut back the duty of economic corporations and Monetary Market Infrastructures (FMIs) to handle their very own operational resilience and third-party dangers in keeping with current outsourcing guidelines.