.webp)
New regulations aim to mitigate risks posed by tech providers in the UK financial sector.
Financial regulators in the United Kingdom have announced new rules governing "critical third parties" that provide essential services to financial firms. These rules will come into force on January 1, covering major technology firms that do business with the UK's financial sector, such as cloud computing service providers, like Google and Amazon. These regulations address a rising dependence of financial firms and market infrastructures on just a few third-party service providers, whose failures would have devastating consequences for the financial system.
The UK's Financial Conduct Authority has emphasized that though such third parties improve competitiveness in the sector, any disruption—cyberattack or power outage—could threaten the stability of the UK financial system. With these new regulations, financial regulators like the FCA and the Prudential Regulation Authority (PRA) gain increased powers to take action if any critical third parties pose a risk to the financial system.
Furthermore, the rules state that such third-party service providers must engage well with regulators at the moment of an operational failure and provide ways of demonstrating management of security risk. This follows as a response to incidents like that of the CrowdStrike outage. According to Bank of England statistics, nearly 70% of banks and some 80% of insurers have only two cloud infrastructure providers on their books, where a lack of diversity raises several red flags around the concentration of power among handfuls of firms.
The latest regulatory framework parallels recommendations by Britain's Treasury back in 2022 policy paper aimed to make sure the financial services sector resists shocks so as not to hit consumers and businesses on equal terms.
.webp)
