How the Consumer Duty impacts outsourcing arrangements

The Consumer Duty applies to all firms in a distribution chain that can influence material aspects of the design, target market or performance of a financial services product or service targeted at retail customers. It will apply even where those firms do not have a direct contractual relationship with the retail customer.

Outsourcing agreements that may be in scope

It is likely that many financial services outsourcing arrangements will not be in scope for the Duty because the service provider does not engage with end customers or provide services that are critical to the end customer experience. For those that are in scope, robust outsourcing agreements that comply with regulatory outsourcing and operational resilience requirements are likely to support financial institutions in meeting Consumer Duty requirements. 

Key triggers in an outsourcing for the application of the Duty would be where the service provider has direct customer interaction in the context of services, such as a business process outsourcing of pensions administration services, where they may be handling customer complaints or where they are directly involved in making decisions that will affect a customer. The authorised firm will in any event need to consider whether the contract provides appropriately for the oversight required of their outsourced service provider, whether that provider is authorised or not, since, as with most regulatory areas, outsourcing does not absolve the financial institution of responsibility.

Changes to outsourcing agreements may be necessary

Financial services outsourcing is already the subject of significant regulation: in the UK the PRA and FCA have issued guidelines relating to outsourcing and other material services arrangements.

In addition, the regulators’ focus on operational resilience in the context of outsourcing and services arrangements requires financial institutions to be comfortable, and back up that comfort contractually, that an arrangement will not lead to an inappropriate risk to resilience. In each case the regulatory requirements translate into direct and indirect contractual requirements to be flowed to third party service providers.

Even where there is no direct customer interaction or decision-making input, if the service being provided is critical to the end customer experience, the Duty is still likely to be relevant. This would be the case, for example, where there is a contract to provide all the technical support to maintain a key customer platform through which customers make their investments and manage their accounts. In this case there is a clear potential for customer harm if the support is not provided and the platform fails as a result.

If an outsourcing arrangement is subject to the Consumer Duty, it is quite likely that the kind of provisions the authorised firm will want to include to address this are already covered as part of meeting regulatory outsourcing or operational resilience requirements. For example:

• requirements for the service provider to comply with law;
• management information and reporting requirements to help the firm monitor service delivery;
• ·obligations to engage appropriately trained staff to deliver the services and to ensure training and continuous development of staff.

If the Consumer Duty is relevant to the arrangement, there are some areas that may not be covered already that firms may want to consider. For example, often service providers will agree in an outsourcing contract to comply with “supplier laws”, which are those laws applicable to them as a service provider, rather than all laws applicable to the authorised firm. The argument is that the service provider is not a regulated entity and so cannot know what is required to ensure the firm’s compliance.

If this is the position in the contract then, in the context of the Consumer Duty, the firm should ensure that it is in a position to instruct the service provider on what is required to ensure compliance with the Consumer Duty, as a sub-set of “customer laws”. That way the firm can be comfortable that it can ensure compliance since it will be responsible for that compliance.