FCA revises position on EBA outsourcing guidance deadlines

Yvonne Dunn of Pinsent Masons, the law firm behind Out-Law, was commenting after the FCA confirmed that it no longer expects the firms it regulates to notify it of their progress towards meeting the 31 December 2021 deadline imposed by the European Banking Authority (EBA) for reviewing and updating legacy outsourcing agreements for critical or important functions. The statement marks a change in the FCA’s previously stated position.

The EBA outsourcing guidelines began to apply from 30 September 2019 to all new outsourcing arrangements entered into after that date. However, the EBA also set a hard deadline of 31 December 2021 for institutions to review and update contracts for legacy outsourcing arrangements of critical or important functions that they had entered into prior to the new guidelines taking effect. The EBA's guidelines also require institutions to notify their national regulator if they are unable to meet that deadline, including the measures planned to complete the review or the possible exit strategy.

However, although the FCA continues to expect banks and other financial institutions to apply the EBA outsourcing guidelines to the extent that they remain relevant post-Brexit, Brexit does mean that the UK’s financial services regulators are no longer bound to implement the decisions of the EU’s supervisory authorities in the sector, including the EBA.

In March, the Prudential Regulation Authority (PRA) issued a policy statement and associated finalised supervisory statement that purports to implement the EBA outsourcing guidelines and which also sets out its expectations of the firms it regulates in relation to third party risk management more generally. At the time, the PRA said that it "considers that it is no longer proportionate for firms to make every effort to comply with the indicative timeline and process for reviewing their material (ie critical or important) legacy outsourcing arrangements" as set out by the EBA. It also confirmed it no longer expects firms to inform it if they have not met the EBA's deadline.

Instead, the PRA said firms should review and update pre-existing legacy outsourcing agreements "at the first appropriate contractual renewal or revision point" so that they comply with the new supervisory statement "as soon as possible on or after Thursday 31 March 2022".

Asked by Out-Law whether it would similarly alter its regulatory approach to the EBA’s deadlines, the FCA initially confirmed that the EBA’s guidelines, and the associated 31 December 2021 deadlines, still applied to the firms it regulates. However, it has now updated its position.

The FCA said: “Firms are not expected to report to us on their progress towards meeting the timeline of 31 December 2021 in the EBA guidelines regarding legacy outsourcing arrangements. Firms should aim to review any outstanding critical or important outsourcing arrangement at the first appropriate contract renewal following the first renewal date of each existing outsourcing arrangement or revision point. Where arrangements of critical or important outsourcing arrangements have not been finalised by 31 March 2022, firms should inform us.”

The FCA said the new timeframe for notification “aligns” with the PRA’s position on the issue, but Yvonne Dunn of Pinsent Masons said that the statements do indicate a difference in expectations as between the two regulators. She said this is likely to influence how dual-regulated firms manage the remediation.

Dunn said: “The PRA is saying that firms should aim to remediate legacy contracts at the next appropriate opportunity on or after 31 March 2022.The FCA has said that firms should inform it if they have not remediated critical or important outsourcing arrangements by 31 March 2022 and we imagine that firms would prefer not to have do this, which will drive remediation of legacy critical or important outsourcing arrangements to be complete by 31 March 2022.”

“In addition, the FCA has reiterated that the timeline of remediation of legacy arrangements in the EBA guidelines on outsourcing remains 31 December 2021 – it is only the date for firms to inform the FCA of progress against that exercise that has changed. Overall, it is unfortunate for dual-regulated firms that the timetable seems different as between the PRA and FCA in relation to remediation of legacy outsourcing arrangements. We assume that firms will err on the side of caution and continue with remediation programmes,” she said.