FCA sticks with EBA legacy outsourcing contracts review deadline

The FCA's approach differs to that of the UK's Prudential Regulation Authority (PRA) which earlier this week advised the institutions it regulates that it does not expect them to necessarily meet the EBA's deadline. Many UK institutions are regulated by both the FCA and PRA, which have different regulatory remits.

The EBA outsourcing guidelines began to apply from 30 September 2019 to all new outsourcing arrangements entered into after that date. However, the EBA also set a hard deadline of 31 December 2021 for institutions to review and update the documentation for legacy outsourcing arrangements of critical or important functions – other than in respect of outsourcing arrangements to cloud service providers – that they had entered into prior to the new guidelines taking effect. The EBA's guidelines also require institutions to notify their national regulator if they are unable to meet that deadline, including the measures planned to complete the review or the possible exit strategy.

On Monday, the PRA said that it "considers that it is no longer proportionate for firms to make every effort to comply with the indicative timeline and process for reviewing their material (ie critical or important) legacy outsourcing arrangements" as set out by the EBA. Nor, it confirmed, does it expect firms to inform it if they have not met the EBA's deadline.

The scope for divergence by the UK regulators from the approach taken by EU supervisory authorities such as the EBA has arisen as a result of Brexit. In light of the PRA's statement, Out-Law asked the FCA to clarify its position on the matter.

A spokesperson for the FCA told Out-Law that, for the purposes of the entities it regulates which are in scope of the EBA's outsourcing guidelines, those guidelines still apply – including the 31 December 2021 deadline for institutions to review and update the documentation for legacy outsourcing arrangements of critical or important functions. The spokesperson said that if that position changes in the period ahead then the FCA would say so publicly.

The fact that the FCA was taking a different position to that of the PRA on the legacy outsourcing contracts deadline is consistent with statements it has published on its website.

According to the FCA's guide to Brexit and its approach to EU non-legislative materials, the regulator expects firms to "continue to apply the guidelines [developed by the European supervisory authorities] to the extent that they remain relevant, as they did before [the Brexit transition period expired]…", and that it will "continue to apply such guidelines" in respect of its own functions "in the same manner as before..." – in both cases subject to the potentially different interpretation of those guidelines as a consequence of changes made to UK legislation in light of Brexit.

In its statement on outsourcing and operational resilience, the FCA specifically referenced the EBA's outsourcing guidelines, confirming that it had "notified the EBA that we will comply with the EBA guidelines on outsourcing" and pointing to the transitional arrangements, including "the review of existing ‘critical or important’ outsourcing arrangements entered into before 30 September 2019".

The PRA set out its position on the legacy outsourcing contracts review deadline as it set out a finalised supervisory statement of its own in relation to outsourcing and third party risk management. It said it had made the decision not to insist firms it regulates meet the EBA's 31 December 2021 deadline "due to the disruption and reprioritisation caused by the Covid-19 pandemic and changes to the UK, EU, and global regulatory landscape in this area (some of which are still under development at the time of publication), and in consideration of responses to [the PRA's consultation on its outsourcing supervisory statement]".

The PRA's supervisory statement will begin to apply on 31 March 2022. The regulator expects outsourcing arrangements entered into on or after 31 March 2021 to be compliant with its new supervisory statement by that date, but has given firms additional time to review and update pre-existing legacy outsourcing agreements "at the first appropriate contractual renewal or revision point" so that they comply with the new supervisory statement "as soon as possible on or after Thursday 31 March 2022".

In an additional statement provided to Out-Law in relation to the PRA's deadline for review and updating pre-existing legacy outsourcing agreements, a spokesperson for the PRA said: "To clarify, the policy position is that firms should seek to update contracts that were entered into before 31 March at the first appropriate renewal point. The PRA recognises that some contracts will not have an appropriate renewal or revision point before 31 March 2022. In such cases the contracts should be updated at the first available opportunity to bring it into line with the expectations in the supervisory statement as soon as possible on or after that date."