Standards and regulations

The PRA's expectations for outsourcing and third party risk management: materiality, governance and record keeping, due diligence, contracts, data security, access and audit rights, sub-outsourcing, business continuity and exit.

Applies to: UK banks, building societies, PRA-designated investment firms, insurers and reinsurers in scope of Solvency II (including Lloyd's and managing agents) and UK branches of overseas banks and insurers, including intragroup arrangements

Regulation (EU) 2022/2554 on digital operational resilience: ICT risk management, incident reporting, resilience testing, ICT third party risk (including the Register of Information and the Article 30 contract terms) and oversight of critical ICT providers.

Applies to: Twenty categories of EU financial entity, and their ICT third party providers through contractual requirements

EBA/GL/2019/02 on outsourcing arrangements: the assessment of critical or important functions, governance, the outsourcing register, due diligence, contractual safeguards, oversight and exit.

Applies to: Credit institutions, investment firms, payment institutions and electronic money institutions

The Interagency Guidance on Third-Party Relationships from the Federal Reserve, FDIC and OCC, the NYDFS Part 500 service provider security policy and the SEC Regulation S-P amendments on service provider oversight.

Applies to: Banking organisations supervised by the Federal Reserve, FDIC or OCC; entities licensed by NYDFS; and broker-dealers, investment companies, registered investment advisers and transfer agents covered by Regulation S-P

Outsourcing rules from SAMA, the CBUAE, DFSA, FSRA, QFCRA, Qatar Central Bank and the CBB. They share themes of board accountability, materiality, due diligence, written agreements, data location, continuity and exit.

Applies to: Regulated financial institutions in Saudi Arabia, the UAE, Qatar and Bahrain

The MAS Guidelines on Outsourcing, Technology Risk Management Guidelines and Business Continuity Management Guidelines, with fuller expectations for material outsourcing.

Applies to: Banks and merchant banks (Notices 658 and 1121) and other MAS-regulated financial institutions

Annual slavery and human trafficking statements under section 54 of the UK Modern Slavery Act 2015, alongside wider ESG supply chain rules such as EU sustainability due diligence.

Applies to: Organisations supplying goods or services in the UK with turnover of £36 million or more, and the suppliers they ask for evidence

ISO/IEC 27001:2022 and its supplier relationship controls in Annex A (5.19 to 5.23): supplier security, supplier agreements, the ICT supply chain, monitoring supplier services and cloud services.

Applies to: Organisations certified or working towards certification, and suppliers asked to evidence information security