UK Regime and Third-Party Risk

Under the UK regime, third-party risk is understood through the service: a supplier, outsourcer or group provider that supports a step in an important business service can, by failing, stop or corrupt that service, and the firm that provides the service to its users remains accountable for the harm that follows. The regime therefore captures third-party risk primarily through mapping and testing of the service, rather than through a separate third-party document detached from services. The map shows which suppliers support which service, what each supplier provides, what would happen if it failed, and what alternative exists. Scenario testing then rehearses supplier failure against the service tolerance, to see whether recovery and workarounds would actually function.

That service lens prevents a common error: treating third-party risk as a procurement or contract matter alone. Contracts, due diligence and supplier monitoring all matter, but they do not, by themselves, demonstrate that a service would remain within tolerance if a supplier failed. A contract may promise resilience, a supplier may report strong performance, and monitoring may show no recent issues, yet the service may still fail if the workaround depends on the same supplier, if data cannot be recovered in usable form, or if communications to users depend on a channel the supplier provides. Only service level mapping and testing reveal those links.

Suppliers should appear on a service map as operational links, not as footnotes. For each supplier step, the map should show what the supplier does, which part of the service depends on it, what data or process flows through it, and what the firm would do if that step stopped or produced wrong results. Where several services depend on the same supplier, that concentration should be visible on each affected service map, because a single supplier failure could then affect several services at once. Concentration across services is a resilience fact, not merely a procurement fact, and it should inform scenario design and board discussion.

Supplier failure should be tested as a service scenario, not only as a supplier assurance review. A scenario might involve loss of a payment processor, corruption of data provided by a supplier, unavailability of a hosted system, or failure of a specialist outsourcer during a period of high demand. Participants should work through recovery, workarounds, data reconciliation and customer communications, and observers should record where the plan assumed supplier availability that the scenario had removed. Where a supplier cannot participate in the exercise, the firm should still test its own response, using the best available information about supplier recovery, and should record the limits of that test honestly.

Ongoing oversight involves monitoring supplier performance and resilience information in a way that connects to services, rather than monitoring suppliers in isolation. A supplier performance report should be read for its service implications: does a change in supplier performance, resilience, ownership or subcontracting affect the tolerance, map or test findings for any service that depends on it? A change in a supplier subcontractor, for example, may introduce a new dependency that does not appear on the current map. Oversight that does not update the map in response to such changes gradually loses touch with the service.

A recurring mistake is to record a supplier only as a contract, without showing its operational role in the service. Another mistake is to accept supplier resilience assurances at face value, without translating them into service terms or testing the firm's own recovery steps. A further mistake is to map a supplier once, at onboarding, and never update the map when the supplier changes its systems, subcontractors or service model. Each mistake leaves the same gap: the firm believes it understands its third-party risk, while its service map and test evidence do not reflect the current dependency.

Third-party work can be checked by tracing a supplier step from the service map through to a scenario test and a self-assessment action. A reader can ask: for a named service, which suppliers support it, what happens if each supplier fails, has that failure been tested, and what action followed the test? If the trace breaks at any point, for example where a critical supplier appears on the map but has never been included in a scenario, the work is incomplete for that service. If the trace holds, the firm has at least connected third-party risk to service resilience in the way the UK regime intends.

This guide describes UK third-party risk in general educational terms. It does not assess any particular firm or supplier, and it does not replace FCA and PRA policy statements or supervisory guidance. Firms should also consider any separate third-party expectations that apply to them, and should keep UK service work distinct from DORA third-party work where both regimes apply.