FCA material third-party arrangements: a guide to preparing for the new reporting requirements

The countdown is on. From 18 March 2027, firms will be required to identify, assess and report their material third-party arrangements under a new reporting framework introduced by the Financial Conduct Authority (FCA).

The new regime represents a significant expansion of the FCA's existing reporting requirements, moving beyond traditional outsourcing arrangements to encompass both material outsourcing and material non-outsourcing arrangements.

The requirements form part of a broader regulatory initiative developed by the FCA, Prudential Regulation Authority (PRA) and Bank of England to strengthen oversight of firms' third-party dependencies and support operational resilience across the UK financial services sector. The new regime will also bring UK standards into line with international frameworks, including the EU’s Digital Operational Resilience Act (DORA). Firms increasingly rely on third parties to deliver critical services, drive efficiencies and support innovation. Regulators are therefore seeking more detailed, accurate and consistently structured information regarding material third-party arrangements to help identify, monitor and address systemic risk and support firms’ operational resilience. So, what could firms be doing to prepare for the new regime?

In this article, we explore what constitutes a material third-party arrangement, which types of firms are in scope, the key reporting requirements, and the practical steps firms should be taking now to prepare for implementation.

What is a material third-party arrangement?

As set out in the FCA Handbook, a third-party arrangement will be considered material where its disruption or failure could:

• Cause intolerable levels of harm to the firm’s clients
• Pose a risk to the soundness, stability, resilience, confidence or integrity of the UK financial system
• Cast serious doubt on the firm’s ability to satisfy the threshold conditions, or meet its obligations under the Principles, or under SYSC 15A (Operational resilience)

Materiality must be assessed on a case-by-case basis, considering factors such as the importance of the service to the firm's business, the impact of any disruption, operational resilience considerations, and the firm's ability to replace the provider or bring the activity back in-house if necessary.

In practice, many firms may find that the number of material third-party arrangements potentially falling within scope is greater than anticipated. The increasing integration of cloud services, AI models and other critical technology services means firms should carefully assess whether these dependencies could be considered material under the FCA's new framework.

Which firms are in scope of the new regime?

The requirements apply to a range of firms, including:

• Enhanced scope SMCR firms
• Banks
• Designated investment firms
• Building societies
• Solvency II firms
• CASS large firms
• UK Recognised Investment Exchanges (RIEs)
• Authorised electronic money institutions and authorised payment institutions
• Consolidated tape providers

Firms that fall within scope should begin preparations now, particularly where they operate complex supplier ecosystems or rely heavily on third parties to support important business services. Early identification of potentially material arrangements will be key to ensuring firms can meet the new reporting requirements by March 2027.

New reporting requirements under the regime

The new regime introduces two key reporting obligations:

1. Firms must inform the FCA when they are entering into a new material third- party arrangement, or significantly changing an existing one.

The FCA has provided a template for firms to submit a notification online. This notification should be made at an early stage in the firm's decision-making process and before the firm becomes contractually or operationally committed to the arrangement. A significant change may include, for example, a material change to the scope of services being provided, changes to how sensitive data is stored or processed, the appointment of a new subcontractor, or a material change in the third-party's ownership or financial position.

Certain arrangements may fall outside the notification requirements. For example, the FCA rules contain exclusions for some intragroup arrangements, meaning firms should carefully assess whether a reporting obligation applies on a case-by-case basis.

2. Firms must report annually to the FCA by submitting a register of their material third-party arrangements.

Firms will be required to maintain a register of their material third-party arrangements. When invited to do so, firms must submit that register to the FCA annually using a prescribed template. The FCA will notify firms of their register reporting requirements when the annual submission window opens. Firms will have 90 calendar days to make their submission. The register requires firms to provide detailed information about each arrangement, including the third-party involved, the services provided, links to important business services, data locations, risk assessments, governance approvals and exit planning arrangements.

The register is intended to provide regulators with greater visibility over firms' third-party dependencies and help identify potential concentration and systemic risks across the financial services sector.

Certain arrangements are excluded from the annual register requirements under the FCA rules, and firms should consider whether any exclusions apply when compiling their submission.

What should firms be doing now? Five practical steps firms can take to prepare for implementation

With only six months remaining before the new regime comes into force, firms should already be assessing whether their existing third-party risk management frameworks can comply with the new reporting requirements.

1. Identify and categorise third-party arrangements

Firms should review their existing third-party arrangements and assess which may meet the FCA's materiality threshold. This exercise should extend beyond traditional outsourcing arrangements and consider technology, data and other service providers that may have a significant impact on the firm's operations or resilience.

2. Assess materiality and operational resilience dependencies

Once potential material arrangements have been identified, firms should assess these against the FCA's materiality criteria. Firms should consider whether disruption or failure of the arrangement could have a significant impact on the firm's operations, resilience or clients.

3. Review governance and accountability frameworks

Firms should ensure that responsibility for identifying, assessing and reporting material third-party arrangements is clearly defined. Governance frameworks should support ongoing oversight of material arrangements and provide appropriate escalation routes where new arrangements or material changes are proposed.

4. Assess data availability and record keeping

The annual register requires firms to maintain detailed information about their material third-party arrangements. Firms should assess whether the required information is readily available and identify any gaps that may need to be addressed before reporting obligations take effect.

5. Prepare for reporting requirements

Firms should familiarise themselves with the FCA's reporting templates and consider how the required information will be collected, maintained and submitted. Establishing processes now will help reduce implementation challenges once the regime takes effect.

With 18 March 2027 approaching, firms should be assessing their readiness for the new regime. Our Financial Services Regulatory team can support with materiality assessments, governance and contractual reviews, and preparation for the FCA’s reporting requirements. Please get in touch to discuss how the new rules may affect your organisation.

Related News, Insights & Events