You Can Outsource the Work, Not the Responsibility

The principle is simple and long-established. The FCA’s outsourcing rules in SYSC 8 require firms that outsource important functions to take reasonable steps to avoid undue additional operational risk, and they make clear that the firm remains fully responsible for meeting its regulatory obligations. The Prudential Regulation Authority has set out similar, more detailed expectations for the firms it supervises on outsourcing and third-party risk management.

Under the Senior Managers and Certification Regime, that firm-level responsibility becomes personal. The Senior Manager responsible for the outsourced activity remains accountable for it. Where a firm has a Chief Operations function, responsibility for outsourcing arrangements often sits there. In other firms, it may sit with the Senior Manager responsible for the business area concerned.

What Regulators Expect

Due Diligence Before Contracting

Firms should assess a provider’s capability, financial position, security, resilience and ability to meet regulatory requirements before appointing them, proportionate to how important the service is.

Proper Contracts

Contracts should give the firm the rights it needs: clear service standards, access and audit rights for the firm and its regulators, data protection, notification of incidents, sub-outsourcing controls and exit arrangements.

Ongoing Oversight

Firms must monitor performance and risk throughout the relationship, not just at the start. That needs people inside the firm with enough expertise to understand what the provider is doing and to challenge it.

Resilience and Exit

Firms should know how they’d continue to serve customers if a critical provider failed, and how they’d move to another provider or bring the service in-house. Operational resilience rules require firms to identify their important business services and stay within impact tolerances, including when third parties are involved.

Concentration Risk

Where many firms rely on the same small number of providers, particularly in cloud services, a single failure can affect large parts of the market. UK law now allows HM Treasury to designate critical third parties so that the regulators can oversee them directly. That doesn’t reduce each firm’s own responsibility for its outsourcing arrangements.

Where Accountability Sits in Practice

The Business Owner

The Senior Manager responsible for the business area remains accountable for the outcomes the provider produces. If an outsourced customer service provider treats customers poorly, the Consumer Duty applies to the firm, and the Senior Manager responsible for that area will be asked what they did about it.

Operations and Technology

The SMF24 Chief Operations holder, where there is one, typically owns the framework for managing third parties: the policy, the inventory of arrangements, due diligence standards and resilience testing. At smaller firms, this often sits with an executive director.

Risk and Compliance

The Chief Risk function and compliance oversight challenge whether third-party risks are understood and controlled. Outsourced compliance itself raises a particular question: the firm can buy compliance support, but the Senior Manager responsible for compliance oversight remains accountable.

The Board

The board approves the firm’s approach to outsourcing and should be told about material arrangements, significant incidents and concentration risks. Non-executives with technology or operational experience can greatly improve the quality of challenge.

Common Failings

• No complete inventory. The firm doesn’t know all the third parties it depends on, especially smaller or informal arrangements.
• Weak contracts. Missing audit rights, incident notification or exit provisions, particularly with large technology providers on standard terms.
• Oversight without expertise. Nobody in the firm understands the service well enough to challenge the provider.
• Untested exit plans. Plans that exist on paper but have never been tested and wouldn’t work in practice.
• Hidden sub-outsourcing. Providers relying on their own suppliers without the firm’s knowledge.
• Unclear ownership. No Senior Manager clearly responsible for a particular arrangement.

Cloud and Large Technology Providers

Cloud services have become the backbone of many regulated firms, from core banking platforms to customer data and analytics. They raise particular challenges. Large providers often contract on standard terms, which can make it harder to negotiate the audit, access and exit rights regulators expect. Firms should understand exactly what those terms give them, where they fall short, and how the gap is managed, for example through pooled audits, independent certifications or additional contractual assurances.

Exit planning is also harder. Moving a critical system from one cloud provider to another, or back in-house, can take months or years. Regulators don’t expect firms to be able to exit overnight, but they do expect a realistic, tested plan for a stressed exit, and a clear understanding of how the firm would keep serving customers in the meantime. The Senior Manager responsible should be able to explain that plan, not just point to its existence.

Outsourcing and Operational Resilience

Operational resilience rules have changed how firms think about outsourcing. Firms must identify their important business services, set impact tolerances for how much disruption they could tolerate, and map the people, processes, technology and third parties behind each service. That mapping often reveals dependencies the firm hadn’t fully appreciated, including providers several steps down the chain. Scenario testing should include the failure of key third parties, and the results should inform both contracts and exit plans. SMF Capital’s analysis of where operational resilience expectations stand covers the regulators’ current focus.

Intragroup Outsourcing

Many firms rely on services provided by other companies in their group, such as technology, operations, compliance or finance. Regulators treat intragroup arrangements as outsourcing too. They may be lower risk in some respects, but they still need clear agreements, oversight and exit planning, and the regulated firm’s Senior Managers remain accountable. This is especially important for UK subsidiaries and branches of overseas groups, where key services may be delivered from outside the UK.

Questions for Senior Managers

• Which third parties does my area depend on, and which are critical?
• Do the contracts give us the access, audit, notification and exit rights we need?
• Who in my area has the expertise to oversee each provider?
• What management information do I receive about provider performance and incidents?
• Have we tested what happens if a critical provider fails?
• Is my responsibility for these arrangements clear in my Statement of Responsibilities?

Questions for Boards

• Does the board have a clear view of the firm’s material outsourcing arrangements?
• Is each arrangement owned by a named Senior Manager?
• Where does the firm depend on a single provider, and what’s the plan if it fails?
• Does the board have enough technology and operational expertise to challenge effectively?

Where the answer to the last question is no, adding an independent non-executive with technology, operations or resilience experience is often the most effective fix. NED Capital, a sister practice of SMF Capital, specialises in non-executive and board appointments, including technology expertise for regulated boards.

The Bottom Line

Outsourcing lets regulated firms access capabilities they couldn’t build themselves, but it doesn’t reduce their accountability. Regulators expect firms, and their Senior Managers, to understand their dependencies, contract properly, oversee providers with real expertise and be ready for failure. The firms that do this well treat third-party risk as part of running the business, not a procurement exercise. For more on how Senior Manager responsibilities are allocated, see SMF Capital’s guides to Senior Manager Functions and the Responsibilities Map.