Changes to FCA rules and guidance on material third party reporting to take effect in March 2027 in UK

Is "outsourcing" out? From March 2027, a new FCA reporting regime will require firms to identify, register and notify the regulators of their material dependencies on third party providers. The shift in terminology from the regulators is deliberate, and the practical implications are material. 

What has changed?

The Financial Conduct Authority (FCA) published its Policy Statement PS26/2 (Operational Incident and Third Party Reporting) and accompanying finalised guidance FG26/3 and FG26/4 in March 2026. 

This created a new UK framework for reporting serious operational incidents and material third party arrangements. This Insight focuses on the material third party reporting requirements set out in PS26/2 and FG26/4. (Please see this Insight for more on the operational incident reporting requirements introduced by PS26/2 and FG26/3.)

The new rules will take effect on 18 March 2027.

Which institutions are in scope?

The material third party reporting requirements apply to a narrower group of firms than the operational incident reporting requirements. Firms in scope include (but are not limited to) enhanced scope Senior Managers and Certification Regime (SMCR) firms, banks, designated investment firms, building societies, authorised electronic money institutions and authorised payment institutions.

Dual-regulated firms need to bear in mind that the Prudential Regulation Authority (PRA) has its own updated guidance in this area (updated SS2/21: Outsourcing and third party risk management) which also takes effect on 18 March 2027.

Material third party arrangements

Under the new rules, a "third party arrangement" (TPA) is broadly defined as any arrangement between a firm and a person who provides a product or service to the firm, regardless of whether it would otherwise be:

• performed by the firm itself;
• provided directly or via a sub-contractor; or
• provided by a company within the same group.

A TPA becomes "material" where a disruption or failure in the performance of that product or service could:

• cause intolerable levels of harm to the firm's clients;
• pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system; or
• cast serious doubt on the firm's ability to satisfy the threshold conditions, or meet its obligations under the FCA Principles or under SYSC 15A (Operational resilience).

Firms must assess on a case-by-case basis whether a TPA is material. Relevant factors include the connection to the firm's regulated activities, the size and complexity of the business areas supported, the potential impact of disruption on business continuity and regulatory compliance, and the firm's ability to substitute the provider or bring the service back in-house. FG26/4 provides some examples of TPAs which are likely to be material and non-material, although a case-by-case assessment will still be needed.

Main requirements in relation to third party arrangements 

Two main requirements are identified in FG26/4: maintaining an annual register and making notifications.

Firms must maintain and annually submit a standardised register of all their material third party arrangements, which regulators will use to identify potential Critical Third Parties (CTPs) for recommendation to HM Treasury for designation. Firms submit the register when invited to do so, via the FCA's reporting platform, with 90 calendar days to complete their submission.

For notifications, the FCA, the PRA and the Bank of England now use a single shared notification template and register template for firms to submit through a single portal. Firms must notify the FCA of any planned material third party arrangement, or any significant change to an existing one. There is no prescribed timeline, but the FCA expects notification at an early stage in the decision-making process and for it to be submitted before making any internal/external commitments. Where relevant, the FCA will transfer the notification submission to the PRA and the Bank of England.

To reduce the reporting burden, most firms are only required to report intragroup arrangements where there is an external third party dependency (except UK RIEs).

Osborne Clarke comment

The adoption of a unified "third party arrangement" concept (rather than focusing solely on "outsourcing") consciously broadens the scope of arrangements subject to oversight, reflecting the increasing importance of non-outsourcing third party arrangements to firms. While this means that more arrangements will fall within scope, it simplifies the threshold question of whether an arrangement needs to be recorded – a question that has historically caused confusion for firms.

This shift also more closely aligns with the EU's approach under the Digital Operational Resilience Act (DORA) and the European Banking Authority (EBA)'s revised guidelines relating to non-ICT third party arrangements, both of which move from a narrower "outsourcing" framework to a broader "third party arrangement" concept. 

Firms operating across both the UK and the EU should therefore be alert to the convergence in regulatory direction, while noting the differences in detail: in particular, DORA and the new EBA guidelines impose specific requirements that do not have direct equivalents in the FCA's regime.

While it is currently unclear whether the UK regulators will seek to adopt the new EBA guidelines within the UK regulatory regime, there has been a conscious effort on the part of the UK regulators to broaden firms' focus towards third party arrangements in alignment with the approach of their European counterparts. 

Although the deadline for compliance with FG26/4 is not until 18 March 2027, firms should start preparing now. Firms should focus on the following:

• Reviewing existing frameworks. Firms should review their existing frameworks for managing third party arrangements (including outsourcing, non-outsourcing, and intragroup arrangements) and assess any gaps against the new requirements.
• Developing assessment methodologies. Firms should establish a consistent methodology for assessing both existing and planned TPAs against the materiality criteria set out in the guidance, and record their interpretation of the criteria when assessing each TPA.
• Building reporting infrastructure. For the annual register, firms should put in place processes for collecting and updating the required data on an ongoing basis. This includes designating a specific person or team responsible for keeping the register accurate and ensuring that sufficient information is captured at the point of onboarding a new TPA or when a TPA is significantly changed.

Given the concepts in FG26/4 build on existing regulatory principles around outsourcing, firms should consider whether they can build on existing processes and documentation to progress the above.

We have already been helping clients to navigate the new material third party reporting regime, and would be happy to assist with any queries you may have. Please do get in touch if you would like to discuss how to prepare during this transition period to ensure full readiness by 18 March 2027.