Thank you for Subscribing to Business Management Review Weekly Brief
I agree We use cookies on this website to enhance your user experience. By clicking any link on this page you are giving your consent for us to set cookies. More info
Thank you for Subscribing to Business Management Review Weekly Brief
By
Business Management Review | Tuesday, February 22, 2022
Wayne Scott, a Regulatory Compliance Solutions Specialist at NCC Group, explores what the latest financial services IT Outsourcing and Third-party risk management regulations & guidelines mean for businesses across the sector.
FREMONT, CA: Operational resilience is more important than ever in the financial services sector, undergoing rapid digital transformation. Regulatory bodies in the UK, Ireland, the EU, and the US have taken new measures due to increased reliance on third parties and outsourced IT solutions, as well as the possibility of cyber threats and other forms of business interruption. Although the regulatory requirements for IT outsourcing in the financial services sector differ by location and regulator, there is a significant link between third-party risk management and operational resilience. Whether it's a standard on-premise application or a cloud-hosted service, regulators emphasize the significance of ensuring service continuity and testing it appropriately. In this post, we look at what the newest regulatory standards and initiatives from around the world entail for businesses in the sector.
The Prudential Regulatory Authority (PRA) issued a Supervisory Statement (SS) on IT Outsourcing and Third-Party Risk Management in response to the increased reliance on third-party technological solutions. Firms must have internal continuity plans in place to restore outsourced services if a third-party relationship fails, according to SS2/21. Internal continuity plans must enable regulated enterprises to bring data, functions, or services back in-house/on-premises; and transfer data, operations, or services to a backup or alternative service provider. Given their similarities in terms of controlling outsourced risk, the PRA has been clear that software escrow is a feasible approach to support compliance, and it stands to reason that the Central Bank of Ireland will be as well. The Central Bank of Ireland stipulates that a corporation should ensure that legally enforceable agreements are in place with third parties after publishing its final guidance on outsourcing at the end of 2021. These written agreements should also specify how essential services will be maintained in the event of a disruption, as well as a contingency plan in case the service cannot be maintained.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
More in News