The FCA's Outsourcing Framework
FCA-regulated firms increasingly rely on third-party providers for critical operational functions: from payment processing and core banking technology to compliance monitoring, customer service and IT infrastructure. The FCA recognises that outsourcing can deliver efficiency and expertise, but also introduces risks that must be managed through robust due diligence and ongoing oversight.
SYSC 8 requires a regulated firm that outsources an important function to check the provider first, put a written contract in place with specific terms, monitor the provider and keep an exit plan. It binds common platform firms, such as banks and MiFID investment firms, as rules and other SYSC firms as guidance. Payment and e-money institutions follow equivalent rules in their own regulations. From 18 March 2027 new FCA reporting rules add an annual register of material third-party arrangements for larger firms, authorised payment institutions and EMIs.
The FCA's outsourcing requirements are set out primarily in SYSC 8 (Outsourcing) and reinforced through operational resilience requirements, the Senior Managers and Certification Regime (SM&CR) and sector-specific rules. The fundamental principle is clear: outsourcing an activity does not outsource regulatory responsibility. The firm remains fully accountable for any outsourced function as if it were performing the function itself.
When Does SYSC 8 Apply?
SYSC 8.1.1R is a rule for common platform firms. SYSC 8.1.1A tells other SYSC firms, such as insurance intermediaries and consumer credit firms, to take it into account as if it were guidance. Authorised payment institutions and e-money institutions are covered by regulation 25 of the Payment Services Regulations 2017 and regulation 26 of the Electronic Money Regulations 2011. These require the firm to notify the FCA before outsourcing any operational function and to meet five conditions where the function is important.
| Firm type | Outsourcing rules | FCA notice before outsourcing |
|---|---|---|
| Common platform firms (banks, MiFID investment firms) | SYSC 8 as rules | Yes, for critical or important functions under SUP 15 |
| Other SYSC firms | SYSC 8 as guidance | Under SUP 15 where material |
| Authorised PIs and EMIs | PSRs regulation 25 or EMRs regulation 26 | Yes, before any operational function is outsourced |
The detailed requirements apply most strongly when a firm outsources a critical or important operational function to a third-party provider. The FCA does not define exhaustively what constitutes a critical or important function, but provides guidance indicating that a function is likely to be critical if:
- A defect or failure in its performance would materially impair the firm's continuing compliance with its regulatory obligations
- A defect or failure would materially impair the firm's financial performance
- The function involves core business activities that are fundamental to the firm's regulated services
- A defect or failure would materially affect the firm's ability to deliver services to customers
Common examples include outsourced payment processing, core IT systems, AML/KYC screening, customer onboarding, regulatory reporting, complaint handling and cloud infrastructure.
Pre-Outsourcing Risk Assessment
Before entering an outsourcing arrangement, the firm must conduct a formal risk assessment covering:
Operational risk. What is the impact on the firm's operations if the provider fails, underperforms or ceases to provide the service? Can the function be brought back in-house or transferred to an alternative provider?
Concentration risk. Is the firm relying on a single provider for multiple critical functions? Is the same provider used by a significant number of other regulated firms, creating systemic concentration risk?
Jurisdictional risk. Where is the provider located? Are there cross-border data transfer issues, legal or regulatory barriers, or geopolitical risks?
Data security risk. What data will the provider have access to? How will it be protected? Does the provider meet appropriate information security standards?
Regulatory risk. Could the outsourcing arrangement affect the firm's ability to meet its regulatory obligations? Will the FCA have adequate access to the provider for supervisory purposes? For payment and e-money firms, could it weaken internal controls or change the firm's obligations to customers? Those are two of the five conditions in PSRs regulation 25 and EMRs regulation 26. Our guides to the UK electronic money institution licence and the UK authorised payment institution licence explain how outsourcing is assessed at authorisation.
Due Diligence on the Provider
Pre-appointment due diligence should cover:
Competence and track record. Assess the provider's expertise in the specific function being outsourced. Review case studies, client references and the qualifications and experience of key personnel. Verify that the provider has a track record of delivering similar services to regulated firms.
Financial stability. Review the provider's financial statements for the previous three years. Assess revenue stability, profitability, debt levels and cash flow adequacy. Consider obtaining credit reports or bank references. A provider in financial difficulty may cut corners on service quality or fail entirely.
Information security. Evaluate the provider's information security arrangements, including ISO 27001 certification, SOC 2 reports, data encryption standards, access controls, vulnerability management and incident response procedures. For cloud service providers, assess shared responsibility models and data residency arrangements.
Business continuity and disaster recovery. Review the provider's business continuity plan and disaster recovery arrangements. Verify that they are tested regularly and that recovery time objectives (RTOs) and recovery point objectives (RPOs) are adequate for the firm's needs.
Regulatory compliance. Assess whether the provider is subject to any regulatory requirements in its own right and whether it has adequate compliance arrangements. For providers processing personal data, verify GDPR compliance, including data processing agreements, privacy impact assessments and cross-border transfer mechanisms.
Sub-outsourcing. Identify whether the provider sub-outsources any elements of the service. If so, assess the sub-contractor's capabilities and ensure the firm has visibility and control over the sub-outsourcing chain.
Contractual Requirements
SYSC 8 and FCA guidance require outsourcing agreements to include specific provisions:
- Scope of services. Clear description of the outsourced function, including service levels, performance standards and key performance indicators (KPIs).
- Audit and access rights. The firm's right to audit the provider's operations, access records and inspect premises. The FCA must also have the right of access for supervisory purposes.
- Data protection. Obligations regarding data security, data processing, confidentiality and compliance with GDPR, including a compliant data processing agreement.
- Business continuity. The provider's obligation to maintain adequate business continuity and disaster recovery arrangements.
- Incident reporting. Obligations to report incidents, breaches and service disruptions to the firm promptly.
- Sub-outsourcing controls. Restrictions on sub-outsourcing or requirements for prior approval and adequate oversight of sub-contractors.
- Termination provisions. Clear termination rights, including for material breach, persistent underperformance, insolvency or regulatory concerns. The agreement should include adequate transition arrangements to enable the firm to migrate to an alternative provider or bring the function in-house.
- Exit planning. Provisions for data return, service continuity during transition and the provider's cooperation with any successor provider.
Ongoing Monitoring
Initial DD is only the starting point. SYSC 8 requires firms to maintain ongoing oversight of outsourcing arrangements:
Performance monitoring. Track the provider's performance against agreed SLAs and KPIs. Regular reporting (monthly or quarterly) should include metrics on service availability, incident volumes, response times and quality measures.
Periodic reviews. Conduct formal reviews of the outsourcing arrangement at least annually. Reviews should reassess the provider's competence, financial stability, information security and compliance arrangements. For critical functions, consider commissioning independent assurance reviews.
Incident management. Establish clear processes for the provider to report incidents to the firm, and for the firm to escalate incidents to the FCA where required. From 18 March 2027 PS26/2 sets standard thresholds and a single submission process for operational incident reports, so contracts should require providers to give the firm the information it needs, quickly.
Risk reassessment. Periodically reassess the outsourcing risk assessment, particularly when there are material changes to the provider's business, financial position or service delivery model.
Exit readiness. Maintain and periodically test exit plans to ensure the firm can transition away from the provider within an acceptable timeframe if necessary.
Common Pitfalls
- Treating DD as a one-off exercise. DD must be ongoing, not just pre-appointment. Provider risk profiles change over time.
- Inadequate contractual protections. Failing to include required provisions, particularly audit rights, termination clauses and sub-outsourcing controls.
- Over-reliance on certifications. ISO 27001 or SOC 2 certifications are helpful but not sufficient. The firm must assess whether the provider's actual practices match the certified standards.
- Ignoring concentration risk. Using the same provider for multiple critical functions without assessing the cumulative impact of provider failure.
- Lack of exit planning. Not maintaining viable alternatives or transition plans, creating lock-in risk.
Regulatory Outlook
Two changes now shape outsourcing oversight.
| Change | What it requires | Date |
|---|---|---|
| PS26/2 third-party reporting | In-scope firms, including enhanced SM&CR firms, banks, authorised PIs and EMIs, keep a register of material third-party arrangements, submit it each year and notify the FCA of new or significantly changed arrangements | 18 March 2027 |
| PS26/2 incident reporting | All firms with a Part 4A permission and payment service providers report operational incidents that meet set thresholds | 18 March 2027 |
| Critical Third Parties regime | Direct oversight of providers designated by HM Treasury. The rules have been in force since 1 January 2025, and the first four providers were designated with effect from 13 July 2026 | In force |
The Critical Third Parties regime regulates the provider, not the firm. Firms remain responsible for their own due diligence, contracts and exit plans, including where they rely on a designated provider. Firms applying for FCA investment firm authorisation or a UK banking licence will be asked to show these arrangements.
Regulatory Counsel reviews outsourcing frameworks, contracts and third-party registers ahead of the 2027 reporting rules. Contact us for a written proposal.
Frequently asked questions
SYSC 8 requires common platform firms, and other SYSC firms as guidance, to conduct thorough due diligence before outsourcing critical or important operational functions. This includes assessing the provider's competence, financial stability, information security, business continuity arrangements, regulatory compliance and sub-outsourcing practices. The firm must also maintain a written outsourcing agreement with specific provisions and conduct ongoing monitoring.
No. The FCA is clear that outsourcing an activity does not outsource regulatory responsibility. The firm remains fully accountable for any outsourced function as if it were performing the function itself. Failures by the provider are treated as failures of the firm for regulatory purposes.
Key provisions include clear scope and service levels, audit and FCA access rights, data protection obligations, business continuity requirements, incident reporting obligations, sub-outsourcing controls, termination rights (including for breach and insolvency), exit planning provisions and transition arrangements.
Formal reviews should be conducted at least annually, with more frequent reviews for critical functions or higher-risk providers. Performance monitoring against SLAs should be ongoing (monthly or quarterly). The outsourcing risk assessment should be reassessed whenever there are material changes to the provider or the arrangement.
Not directly where they are authorised only under the PSRs or EMRs. They follow regulation 25 of the PSRs or regulation 26 of the EMRs, which require notice to the FCA before outsourcing an operational function and five conditions for important functions. Many firms use SYSC 8 as a benchmark.
It is an arrangement whose failure could cause significant harm to the firm, its customers or markets, as defined in the FCA's rules. From 18 March 2027 in-scope firms must record these arrangements in a register, submit it to the FCA each year and notify new or significantly changed arrangements.
A regime under which HM Treasury designates providers, such as large cloud firms, whose failure could threaten financial stability. The Bank of England, PRA and FCA oversee them directly. The rules took effect on 1 January 2025 and the first four providers were designated with effect from 13 July 2026.
Definitive guides on this topic
The permanent reference pages this article relates to.