The FCA's new material third-party reporting regime comes into force on 18 March 2027. In-scope firms will need to notify the FCA when they enter into a material third-party arrangement or significantly change one, and submit an annual register of material arrangements. The regime covers more than traditional outsourcing.
PS26/2 and FG26/4 deliberately extend reporting to material non-outsourcing arrangements because regulated firms increasingly depend on technology, data, infrastructure and specialist providers that may not fit the historic outsourcing definition. The implementation challenge is therefore to build a complete inventory of relevant dependencies before deciding which are material.
The first filing is not the place to discover that procurement, technology, compliance and operational resilience hold different supplier lists. Firms should use the implementation period to reconcile those sources, establish a materiality methodology and make sure new or changed arrangements enter the reporting workflow automatically.
Confirm whether the new reporting regime applies to the firm
The FCA's material third-party rules apply to a defined subset of firms. Its current implementation page lists enhanced-scope SMCR firms, banks, designated investment firms, building societies, Solvency II firms, CASS large firms, UK Recognised Investment Exchanges, authorised electronic money institutions, authorised payment institutions and consolidated tape providers.
That scope analysis should be done at legal-entity level. A group can contain one entity within the new regime and another outside it, and reporting ownership should not be based only on a group-wide procurement classification.
Firms outside the new regime do not become free of third-party notification obligations. The FCA expressly says they should continue to meet relevant existing obligations, including Principle 11 and current outsourcing notification requirements where applicable.
Material third-party arrangements are broader than outsourcing
Under the new rules, an arrangement is material where its disruption or failure could cause intolerable harm to clients, pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system, or cast serious doubt on the firm's ability to meet threshold conditions, the Principles or SYSC 15A operational-resilience obligations.
That definition means the inventory cannot stop at contracts labelled 'outsourcing'. A cloud platform, market data dependency, communications service, specialist technology provider or other external arrangement can be material even where the firm has not outsourced a regulated function in the traditional sense.
The practical approach is to start from services and dependencies, then classify the legal arrangement. Firms that start from the accounts-payable vendor list often produce too much noise, while firms that start only from the outsourcing register can miss non-outsourcing dependencies the new rules were designed to capture.
Build one authoritative third-party inventory
The register will only be reliable if the source inventory is controlled. Procurement may know the contracting party, technology may know the service, information security may know data access, finance may know spend, and operational resilience may know the business service dependency. Those records need to be connected.
Each arrangement should have a clear internal owner and enough information to assess service, entity, provider, criticality, customer impact, substitutability, data and system dependencies and the affected regulated activities. The FCA has published example notification and register templates that firms can use to understand the information expected.
A central register does not require one technology platform in every firm. A controlled spreadsheet can be proportionate for a smaller population. The key is defined ownership, consistent fields, change control and the ability to reconcile the register with contracting and operational-resilience records.
Materiality needs a documented method and challenge process
Materiality should not be decided solely by contract value. A low-cost infrastructure provider can be operationally critical, while an expensive consultancy can be non-material if service disruption would have limited regulatory or customer impact.
The assessment should consider the FCA's materiality tests and the firm's own business-service mapping. Relevant factors can include the number and type of customers affected, availability of substitutes, concentration, data access, time to recover, financial-system impact and whether failure would undermine a threshold condition or Principle.
The method should also deal with aggregation. Several individually modest arrangements with the same provider can create a material concentration when viewed together. Procurement changes, acquisitions and new technology architecture can therefore require reassessment even where no single contract appears transformative.
The notification trigger needs to sit inside procurement and change management
From 18 March 2027, in-scope firms must tell the FCA when entering into a material third-party arrangement or significantly changing an existing one. That means compliance cannot rely on discovering changes after contracts have already been signed.
Procurement and business owners should have a gate that asks whether the arrangement is within the reporting regime and whether the proposed change is significant. Compliance and operational resilience can then review the assessment before the transaction reaches the point at which a regulatory filing has been missed.
The same control should capture renewals and restructurings. A provider migration, expanded data access or material change in services can change the risk even where the legal supplier remains the same.
The annual register needs data lineage and reconciliation
The FCA expects annual submission of a register of material arrangements. The first submission window is expected after the 12-month implementation period, and the FCA says firms will then have 90 calendar days to submit the register.
A register should therefore be treated as regulatory data. Each material field should have a source, owner and validation method. Legal entity identifiers, provider details, service descriptions and materiality classifications should not be re-created manually each year if the firm can maintain them as part of normal supplier governance.
Reconciliation is important. The material register should make sense against the outsourcing register, operational-resilience mapping, supplier inventory and significant technology contracts. Differences can be legitimate, but they should be understood rather than discovered during FCA follow-up.
Contracts should support the information the firm needs to report and manage risk
PS26/2 is a reporting regime, not a replacement for the wider outsourcing and operational-resilience rules. Firms still need contractual and oversight arrangements appropriate to the underlying service and applicable requirements.
During implementation, firms should check whether existing contracts provide enough information to keep the register accurate and manage significant changes. Where a provider can materially alter subcontracting, location, data processing or service architecture without timely notice, the regulated firm may struggle to maintain its own reporting and resilience controls.
The review should be risk based. It does not follow that every supplier contract needs to be reopened merely because the new FCA register exists. The focus should be arrangements whose information rights or change controls are insufficient for the firm's regulatory responsibilities.
Operational resilience and third-party reporting should use the same facts
The FCA's materiality definition explicitly connects the new regime with intolerable client harm and SYSC 15A. Firms subject to operational-resilience requirements should therefore avoid creating a reporting taxonomy that conflicts with their existing business-service mapping.
A third party supporting an important business service may not automatically satisfy every reporting test, and materiality still needs to be assessed under the new rules. However, the underlying information about service dependency, recovery, customer impact and substitutability should be consistent across both frameworks.
Using one dependency model reduces duplication and makes management information stronger. It also helps the firm explain why a provider was classified as material in one context and not in another where the regulatory tests differ.
Current notification obligations continue during the implementation period
The new rules are not live until 18 March 2027. Until then, firms should continue using the current Principle 11 and applicable outsourcing notification framework. The FCA's implementation page expressly reminds firms of those existing obligations.
The transition should therefore be managed without a reporting gap. A firm should not defer a current material outsourcing notification because it expects to report the arrangement under the new regime next year.
For firms outside the new PS26/2 third-party scope, existing Principle 11 and relevant outsourcing obligations continue after March 2027 as well. The regulatory change plan should document that distinction clearly.
What should firms do during the remaining implementation period?
The highest-value work is to establish scope, reconcile supplier inventories, design the materiality methodology, populate the FCA example register fields, build procurement and change triggers, and run a dry submission using real data.
Management should then challenge outliers. If a business area says none of its major technology dependencies are material, or if every supplier has been classified as material, the methodology probably needs further scrutiny.
The goal by March 2027 should be a reporting process that is already part of supplier governance, not a one-off compliance exercise assembled when the FCA opens the submission window.
How Regulatory Counsel can support
Regulatory Counsel supports FCA-regulated firms with the regulatory, governance and remediation issues covered in this article. We can review the existing framework, identify gaps and support practical implementation or independent assurance.
Speak to Regulatory Counsel to discuss this area.
Frequently Asked Questions
The new rules take effect on 18 March 2027.
No. The new regime covers material outsourcing and material non-outsourcing third-party arrangements for firms within scope.
The FCA lists enhanced-scope SMCR firms, banks, designated investment firms, building societies, Solvency II firms, CASS large firms, UK RIEs, authorised EMIs and APIs, and consolidated tape providers.
From 18 March 2027, firms must notify the FCA when entering into a material third-party arrangement or significantly changing one, and submit an annual register of material arrangements.
No. Firms should continue meeting current Principle 11 and applicable outsourcing notification obligations until the new regime takes effect.