If your firm is regulated by the FCA, outsourcing your IT does not outsource your responsibility for it. The regulator expects you to understand how your provider supports your business, to oversee it, and to be able to carry on if the arrangement fails.

This article sets out what we think a good provider should give you. It is general information, not legal or compliance advice; your compliance adviser should confirm how the rules apply to your firm.

Operational resilience

Firms within scope of the FCA’s operational resilience rules must identify their important business services, set an impact tolerance for each and show they can stay within those tolerances in severe but plausible scenarios. Most of those services depend on technology your IT provider runs.

Your provider should help you:

  • map the systems, suppliers and people behind each important business service
  • set recovery time and recovery point objectives that fit inside your impact tolerances
  • test recovery, and give you records of the results for your self-assessment
  • tell you promptly about incidents that could affect those services

Outsourcing and third-party risk

The FCA’s outsourcing rules in SYSC 8 expect firms to carry out due diligence on providers, agree clear contracts and keep the ability to monitor and audit them. Your contract with an IT provider should cover, at a minimum:

  • the services, service levels and how they are measured
  • security standards and how the provider evidences them
  • your right to audit, and the regulator’s right of access
  • incident notification
  • sub-contractors the provider relies on
  • an exit plan, so you can move to another provider without disruption

Recordkeeping and recording

MiFID II firms must record and retain relevant telephone conversations and electronic communications. If your IT provider supplies telephony, Teams or mobiles, it should also supply recording that captures all of them and lets your compliance team retrieve records quickly.

How we approach it

We document every client environment in full, test backups and recovery on a schedule, and give clients the evidence they need for auditors, investors and the regulator. We are happy to agree audit rights and exit support in our contracts. If you would like a review of your current arrangements, get in touch.