The regulatory position in the UK is complex and depends on the activities of the regulated entity in question (e.g., asset management/investment businesses or operating as a banking entity).

Senior Management, Arrangements, Systems and Controls ("SYSC") sourcebook 8.1.1R in the Financial Conduct Authority ("FCA") Handbook provides that if a firm relies on third parties for the performance of "relevant services and activities," it must take reasonable steps to avoid undue operational risk. This provision also requires that firms cannot outsource operational functions that would impair the quality of internal controls or the regulator's ability to monitor a firm's compliance position. Section 2 of the Outsourcing Part of the Prudential Regulation Authority's ("PRA") Rulebook makes similar provisions. Under Rule 2.3(1)(e) in the Notifications Part of the PRA Rulebook, institutions must notify the PRA when "entering, or significantly changing a material outsourcing arrangement" (see paragraph 5.14 of PRA Supervisory Statement SS2/21). The PRA expects these notifications to be made before entering into the outsourcing arrangement.

Material outsourcings

Certain types of outsourcing are considered to be "material outsourcings." These are defined in the FCA Handbook and PRA Rulebook as outsourcings where, if there was a weakness or failure in the delivery of the services, this would cause the regulators to doubt whether the firm would be able to continue to comply with the conditions of its authorization or with the FCA Principles for Businesses or PRA Fundamental Rules. The PRA considers that a "material outsourcing arrangement" encompasses a "critical or important" outsourcing arrangement in relevant retained EU legislation.

Regulated entities cannot undertake a material outsourcing without giving appropriate notice to the regulator in advance of the outsourcing (notice would be dependent on the size, nature and materiality of the outsourcing). Where firms are dual regulated, separate notices are required for both the FCA and the PRA. Although the period for notification is not fixed and will depend on the event in question, the regulators expect this to happen at an early stage and before the firm has made any internal or external commitments. 

Where the activity being outsourced is itself regulated, the regulated entity would need a Part 4A permission from the FCA to outsource this activity.