What the PRA's Third-Party Rules Ask of the Receiving Bay

In March 2021 the Prudential Regulation Authority published Supervisory Statement 2/21, which asks firms to assess the materiality and risks of every third-party arrangement, whether or not it counts as outsourcing (Prudential Regulation Authority, 2024). It applies to UK banks, building societies, insurers and PRA-designated investment firms. Its chapters run from data security and audit rights through sub-outsourcing to exit plans. Most of that vocabulary belongs to risk and compliance teams, yet much of the evidence behind it is made earlier, where goods or services arrive and someone checks them against the paperwork.

On the stores accounts I have run, the routine at that point is simple. Goods arrive, someone checks them against the paperwork, and any difference is logged and chased until it is settled. This piece reads the statement from that desk. It is my reading of published material and is not regulatory advice.

A ledger before a policy

The statement asks firms to decide which arrangements are material or high risk and to apply controls in proportion (Prudential Regulation Authority, 2024). A contract register cannot make that decision alone. It records what a firm pays each supplier, while what each one could break, and how many services lean on the same supplier, sit elsewhere. A list of fifty suppliers can still fail at a single point, which is the argument in my piece on supplier concentration, tier by tier.

A stores account has the same problem. Some lines carry real financial exposure and some only look busy, and the classification that matters starts from exposure, with spend as one input among several. In my view a materiality assessment built on spend alone will rank suppliers in the wrong order.

A record someone made

The statement expects an outsourcing agreement to give the firm the right to monitor the provider's performance on an ongoing basis, for example through key performance indicators (Prudential Regulation Authority, 2024). A performance report written by the provider is the provider's account of itself. A goods-in record is the firm's own observation. When a delivery arrives short, damaged or late, the discrepancy log shows how the supplier performed, whatever its own report says.

A bank buys services, data and cloud capacity far more often than pallets, so the mechanics differ. The principle still carries over: some of the monitoring should rest on a record that someone other than the supplier made. Three examples are a reconciliation of invoices to the service actually delivered, a restore test that was actually run, and a periodic check on who the supplier's subcontractors are today. The PRA expects controls in proportion to the risk, and checks of this kind cost little beside the exposure they cover.

Handover is where exits fail

The statement expects exit plans to cover stressed exits and to be documented and tested as far as possible (Prudential Regulation Authority, 2024). Its own testing example is a reconciliation. A firm that keeps copies of outsourced data outside the cloud can test by checking that both sets of data stay consistent and reconciling them as appropriate. I would call that a stock-take: two records of the same thing, compared on a schedule.

On a stores account the weak point is handover, when one person signs the account over to the next. The record has to match the stock on the day, and the incoming holder inherits any gap the outgoing holder left. I build controls so that a successor can run them without me in the room. An exit plan can be held to the same standard. Until someone has run it against a real record, it remains a document.

Where the first line stops

The first line produces evidence, and independent oversight belongs to the second and third lines. Concentration across suppliers, long chains of subcontractors and cyber exposure all need that outside challenge, and no receiving check replaces it.

At system level, the critical third parties regime puts designated providers under direct regulatory oversight. Its rules took effect on 1 January 2025 but apply only to providers that HM Treasury designates, and the first four designations were made on 10 July 2026, effective 13 July (Morrison Foerster, 2026). In my view a firm still has to manage its own dependence on those providers. The regime adds oversight above the firm and leaves firm-level evidence where it was.

In my view most of what the statement asks for comes down to records made by someone with no reason to flatter the supplier. A firm that holds those records gives its second line something to test. A firm without them gives its second line only the supplier's word.

The views expressed here are my own and are based on general observations about third-party risk and financial regulation. They draw only on published sources and do not represent the position of the Royal Navy, the Ministry of Defence or any organisation with which I work. Nothing published here reproduces any organisation's internal policy, procedure or assurance output.