Teal blue graphic

Transfer of consumer credit regulation to the FCA - implications for outsourcing by consumer credit firms

The regulation of consumer credit is due to transfer from the Office of Fair Trading (OFT) to the new Financial Conduct Authority (FCA) in April 2014. With the new regime in the pipeline and secondary legislation being developed, consumer credit firms should be considering the impact of the forthcoming changes now. In particular, there will be implications for firms who outsource aspects of their operations either to group companies or to independent third parties. Among the requirements, it is notable that:

  • a firm's regulatory obligations cannot be outsourced so firms must take reasonable care to supervise the discharge of outsourced functions;
  • a firm must give prior notice of a proposal to enter into or significantly change a material outsourcing agreement; and
  • guidance advises that all authorised firms should have written agreements in place governing the arrangement and that this should include specific rights and obligations.

Firms will need to need to incorporate appropriate obligations on the part of suppliers into any new outsourcing contracts and may need to amend existing contracts to comply with the new regime.

The government's consultation response

On 27 June 2013 the government published a summary of responses to high level proposals for the new regulatory framework for consumer credit under the FCA. A tiered framework of high level standards and more detailed conduct standards is proposed. This will include the FCA’s Principles for Businesses, which establish behaviour required from firms, which will be applicable to all their consumer credit activities. Other high level standards which will apply include the FCA’s senior management arrangements and systems and controls (known as SYSC). Conduct standards setting detailed standards for firms’ conduct will be based on current conduct standards set out in the CCA and OFT guidance.

We set out below some of the implications for consumer credit firms who outsource aspects of their operations.

Compliance with Principles for Business

Under Principle 3 of the FCA Handbook a firm must take reasonable care to organise and control its affairs responsibly and effectively, which includes having adequate systems and controls. Firms’ outsourcing arrangements must meet these requirements. 

The FCA considers that the firm’s management is accountable for failings and this applies equally to any arrangement outsourced to a third party. A firm cannot outsource its regulatory obligations and must take reasonable care to supervise the discharge of outsourced functions by its contractor, including obtaining information from its contractor to enable it to assess the impact of outsourcing on its systems and controls. In practice this means carrying out due diligence in relation to suppliers, ensuring that suppliers are contractually obliged to meet appropriate performance standards and monitoring performance in practice.

Under Principle 11 a firm must deal with its regulators in an open and cooperative way and disclose anything relating to the firm of which that regulator would reasonably expect notice. This includes giving prior notice of a proposal to enter into or significantly change a material outsourcing arrangement.

In addition firms must ensure their suppliers permit representatives of their regulator to have access to their business premises, including to records and computer systems. A firm must also take reasonable steps to ensure that any such supplier gives the firm’s auditors the same rights of access to books and accounts of the firm held by the supplier.

In practice firms need to incorporate appropriate obligations on the part of suppliers in their outsourcing contracts. Where outsourcing contracts are already in place the FCA will expect appropriate amendments to be made on their next renewal.

Provisions relating to outsourcing in SYSC8

In addition to the above SYSC8 sets out additional rules governing outsourcing, which only apply to certain authorised firms. However all authorised firms including consumer credit firms are required to take account of these rules as if they were guidance. Firms cannot ignore guidance if they are to demonstrate compliance with the FCA’s Principles for Business.

The rules in SYSC8 include the following:

  • Where a third party is carrying out functions critical for the performance of regulated activities or ancillary services, the firm must take reasonable steps to avoid undue additional operational risk.
  • If important operational functions are outsourced, or relevant services or activities, the firm remains responsible for discharging its regulatory obligations and in particular, the relationship and obligations of the firm to its clients must not be altered. (So, for example, the firm must remain liable to the client for any failing of its service provider.)
  • Firms are under an obligation to exercise due skill, care and diligence when entering into, managing or terminating any arrangements for the outsourcing of important operational functions or relevant services.
  • Firms must comply with the following specific conditions:
  • the service provider must have the ability, capacity and authorisation required by law to perform the outsourced services.
  • it must carry out the outsourced services effectively and the firm must establish methods for assessing the standard of the performance (for example, by use of service standards and appropriate remedies for failure to meet them).
  • the service provider must supervise the carrying out of the outsourced functions and adequately manage the risks associated with the outsourcing (for example by requiring the provision of regular performance reports and the holding of supervision meetings).
  • appropriate action must be taken if it appears the service provider is not carrying out the functions effectively and in compliance with all legal and regulatory requirements (the right to take different courses of action should be set out in the service provider’s contract).
  • the firm must retain necessary expertise to supervise the outsourced functions.
  • the service provider must disclose to the firm any development that may have a material impact on its ability to carry out the outsourced functions.
  • the firm must be able to terminate the arrangement for the outsourcing where necessary without detriment to the continuity and quality of its provision of service to clients (this will necessitate provisions in the contract dealing with exit and preparation of an exit plan).
  • a service provider must protect any confidential information relating to the firm and its clients.
  • the firm and service provider must establish and maintain a contingency plan for disaster recovery and periodic testing of back-up facilities.

In addition the firm must ensure there is a written agreement with the service provider recording rights and obligations of both parties. This agreement will need to reflect most of the above conditions.

Where important functions are outsourced to a member of the same group, the extent to which the firm controls the service provider can be taken into account in determining whether the firm has complied with its obligations under SYSC8.

The proposed timetable is such that a final draft of the proposals to be introduced into the FCA Handbook is unlikely to be available until early 2014, that is, not long before firms become subject to the new regime.

What you need to do now

Firms would be sensible to review all current outsourcing and new outsourcing arrangements at an early stage, bearing in mind the above rules and guidance. Firms should seek to insert appropriate obligations into their arrangements with service providers to ensure that they will be able to demonstrate compliance in readiness for next April.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at June 2013. Specific advice should be sought for specific cases; we cannot be held responsible for any action (or decision not to take action) made in reliance upon the content of this publication.

TLT LLP is a limited liability partnership registered in England & Wales number OC 308658 whose registered office is at One Redcliff Street, Bristol BS1 6TP England. A list of members (all of whom are solicitors or lawyers) can be inspected by visiting the People section of this website. TLT LLP is authorised and regulated by the Solicitors Regulation Authority under number 406297.

Insights & events View all