Trestec for financial services
Supervisors in the UK, the EU and beyond expect firms to know which third parties support their important services, to check them before and during the relationship, and to show the evidence on request. Trestec keeps that record in one place.
Third party risk in financial services
Banks, insurers, investment firms and payment firms now run much of their business through cloud, software and outsourced providers. The firm stays accountable for the service when a provider fails, and regulators have shown they will act when oversight falls short.
ICT and cloud concentration
Many important services rely on the same few cloud, data and software providers. One failure can reach several services at once.
Material outsourcing without full oversight
Materiality decisions, risk assessments and approvals sit in spreadsheets and email, so it is hard to show who decided what, and why.
Contracts that miss required terms
Audit and access rights, exit assistance, subcontracting controls and incident reporting are often missing or weak in older agreements.
Fourth parties and exit
Critical providers depend on their own subcontractors, and exit plans for material arrangements are often written once and never tested.
When a supplier fails
Publicly reported events that show how disruption travels through third parties.
April 2018
TSB's IT migration
TSB moved its customers to a new platform run by an outsourced provider within its group. Many customers could not reach their accounts properly for weeks. In December 2022 the FCA and the PRA fined TSB a total of £48.65m, citing failures to manage the operational risk of its IT outsourcing.
July 2024
The CrowdStrike outage
A faulty content update to CrowdStrike's Falcon security software crashed millions of Windows computers worldwide on 19 July 2024. Banks, payment services, airlines and hospitals were disrupted by a supplier many had never classed as a resilience risk.
From January 2025
DORA in force
From 17 January 2025 EU financial entities must keep a Register of Information covering every ICT third party arrangement and send it to their national authority when asked. Many firms built their first register under time pressure.
Rules and expectations that apply
A summary of the main requirements, not legal advice. Confirm what applies to your firm with your advisers.
| Rule or expectation | What it asks of you |
|---|---|
| PRA SS2/21 | Outsourcing and third party risk management for PRA regulated firms, effective 31 March 2022: materiality assessment, due diligence, contractual safeguards, data security, business continuity and exit planning. |
| DORA | EU Regulation 2022/2554, applying from 17 January 2025: ICT third party risk management, a Register of Information on all ICT contracts, Article 30 contract terms, major incident reporting and, for some firms, threat led penetration testing. |
| EBA Guidelines on outsourcing arrangements | Applying since 30 September 2019 to EU banks, investment firms, payment and e-money institutions: assess critical or important functions, keep an outsourcing register, and plan exits. |
| UK operational resilience | PRA and FCA rules from 31 March 2022: identify important business services, set impact tolerances and map the third parties behind them. Firms had to be able to stay within tolerance by 31 March 2025. |
| UK critical third parties regime | In force from 1 January 2025 under the Financial Services and Markets Act 2023 (PS16/24). HM Treasury can designate providers whose failure could threaten UK financial stability. Firms keep their own responsibility for oversight. |
| Gulf and Singapore | Outsourcing and technology risk rules from SAMA, the CBUAE, the DFSA, the FSRA, the QFCRA, the CBB and MAS set similar expectations for registers, assessments and exit plans. |
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
How Trestec helps
Supplier register and tiering
Every supplier, service and owner in one record, tiered with your own versioned rules.
Materiality assessment
Business owners answer guided questions; Trestec proposes a provisional view with its reasons; a named person confirms or overrides it.
Contract analyser
Contracts checked against PRA SS2/21, DORA and EBA markers, with missing or weak terms linked to the source text.
DORA Register of Information
Built from your supplier records, with every value traced to its source and readiness checks before export.
Regulatory registers from the same record
- DORA Register of Information with readiness checks
- Working register of material third party arrangements
- Exit strategies for every material or critical arrangement
- Incident log with reporting deadlines
AI suggests and flags. A named person reviews the evidence and decides.
DORA Register of Information
Readiness by template
Blocking items
0
Blocking items0Talk to us about financial services
See how Trestec would hold your material arrangements, contracts and DORA register in one record.