My Lords, I understand regulators’ desire to have more insight into the risks that critical third parties present to the provision of financial services. The regulators have been fretting about the provision of cloud services for some time—not always with good cause, because cloud providers offer some significant benefits to financial services firms in a range of areas. The PRA and the FCA have already increased their focus on critical third party suppliers by way of operational resilience requirements on regulated firms, and they already have the ability to get information via the regulated firms.
I was not hugely surprised to find a regulatory power grab regarding critical third parties in this Bill, but I was genuinely shocked to find 10 whole pages of legislation giving the regulators huge powers over critical third parties: the power to make rules, a power of direction, information powers, censure and disciplinary powers, and so on. This is typical regulatory gold-plating of the kind that I hoped we had left behind when we exited the EU. The Treasury ought to be on the alert against this kind of thing, rather than being complicit in it.
The regulators will have to exercise real care when they use these new powers. It would be a very bad outcome if some—for example, the cloud providers or the major ICT providers—decided to exit the UK financial services market because of heavy-handed regulation. If that happened it would likely increase the concentration risk within the financial services sector, as well as reducing competition in the provider market.
My Amendment 37 is in fact extremely modest. TheCityUK has called for one of the regulators to be in the lead for any critical third party, so that the likelihood of duplicative requirements and other burdens between the regulators involved would be minimised. TheCityUK is not comforted by the co-ordinating duty in the new Section 312U of FSMA because just about everybody who has been involved in financial services has been on the receiving end of unco-ordinated regulator action, despite the existence of co-ordinating duties already in FSMA. Those duties have not been a resounding success, and I may return to the idea of a lead regulator on Report.
For today, my Amendment 37 would delete subsection (3) of new Section 312U and replace it with a more third-party friendly version. Subsection (3) says that the duty to co-ordinate
“applies only to the extent that compliance with the duty does not impose a burden on the relevant regulators that is disproportionate to the benefits of compliance.”
This is typical of regulation, in particular financial services regulation. It sees things through the prism of the regulators, not the persons impacted by the regulation. My amendment would replace this with a requirement to minimise the burden placed on critical third parties so far as is reasonably practicable.
I do not regard this rebalancing of the new rules as a radical proposition in the context of the radical new powers that are being taken. The impact on third parties really does need to be taken into account, and it is curiously absent from the 10 pages of the Bill dedicated to the new powers over critical third parties. The need for rebalancing of the new regulatory provisions ought to go wider than the duty to co-ordinate, and I should probably have drafted something broader to consider in our Committee today. My purpose is to probe how the Government see the new provisions impacting on third-party suppliers, not just on the regulators, and whether they even acknowledge that they might have created something of a monster in these new rules. I beg to move.