FCA Outsourcing Due-Diligence Checklist

1. Governance — Name the accountable executive and operational owner.

Record who approves the arrangement, who manages it day to day, who challenges performance, and how issues reach the appropriate committee or board.

2. Governance — Define the business purpose and expected customer or operational outcome.

Describe the problem being solved, the service boundary, expected benefits, affected customers, and the evidence that will show whether the arrangement works.

3. Governance — Apply the firm’s own outsourcing and third-party policy.

Confirm the policy, risk appetite, approval route, record keeping, review cycle, and any enhanced requirements for higher-risk arrangements.

4. Governance — Check conflicts, incentives, and concentration at group level.

Consider related-party arrangements, commercial incentives, common subcontractors, geographic concentration, and dependency on the same technology or facility.

5. Classification — Decide whether the arrangement is outsourcing and which rules apply.

Map the activity against the FCA definition and the rules applicable to the firm’s type and permissions. Do not assume every third-party service is outsourcing—or that non-outsourcing services are risk-free.

6. Classification — Assess materiality, criticality, importance, and regulatory notification.

Document the classification and check the applicable notification route and timing, including Principle 11, SUP 15, sector rules, and the third-party reporting requirements due from 18 March 2027.

7. Classification — Identify important business services and impact tolerances.

Where the provider supports an important business service, map the dependency and confirm how provider failure could affect the firm’s ability to remain within its impact tolerance.

8. Provider — Verify legal identity, ownership, permissions, and operating locations.

Confirm the contracting entity, beneficial ownership, registrations, service locations, data locations, and any regulatory status relevant to the outsourced activity.

9. Provider — Assess financial and operational viability.

Review evidence proportionate to the risk: financial statements, insurance, staffing capacity, key-person dependency, business model, and ability to continue through disruption.

10. Provider — Test competence, staffing, vetting, and training.

Verify role requirements, screening, references, professional credentials, supervision, training, quality assurance, staff turnover controls, and replacement arrangements.

11. Provider — Review information security, technology, and physical controls.

Assess identity and access management, encryption, logging, endpoint controls, secure development where relevant, vulnerability management, incident response, workplace security, and independent assurance.

12. Contract — Put the scope, responsibilities, and service levels in writing.

Define services, locations, hours, inputs, outputs, acceptance criteria, performance measures, reporting, escalation, charges, change control, and responsibility for customer outcomes.

13. Contract — Preserve information, audit, inspection, and regulatory access rights.

Where applicable, ensure the firm, its auditors, the FCA, and other competent authorities can obtain information and effective access to relevant data and premises.

14. Contract — Control subcontracting and material service changes.

Require disclosure and an agreed approval or notification process for subcontractors, location changes, control changes, and developments that may materially affect delivery or compliance.

15. Contract — Set termination, continuity, cooperation, and confidentiality terms.

Include termination rights, cooperation with regulators, protection of confidential information, continuity during termination, assistance, data return or destruction, and transition responsibilities.

16. Data — Map personal, confidential, and regulated information.

Record categories, systems, locations, users, purposes, retention, onward disclosures, privileged or special-category data, and the minimum access needed.

17. Data — Put UK GDPR processor and international-transfer arrangements in place.

Where applicable, execute Article 28 terms. For a restricted transfer, select a lawful transfer route; if relying on an appropriate safeguard, complete the required transfer risk assessment or data protection test and apply additional measures.

18. Data — Agree security-incident and personal-data-breach procedures.

Define immediate containment and escalation, information the provider must supply, decision rights, evidence preservation, regulatory assessment, customer communications, testing, and notification timeframes that support the firm’s legal duties.

19. Resilience — Review business continuity and disaster recovery.

Confirm recovery objectives, alternative facilities and connectivity, backup arrangements, staffing contingencies, crisis contacts, dependency maps, test evidence, and remediation of failed tests.

20. Resilience — Test severe but plausible provider-failure scenarios.

Include cyberattack, loss of site or connectivity, data corruption, critical subcontractor failure, provider insolvency, sudden staff loss, and an extended outage. Test the firm’s response, not only the provider’s plan.

21. Oversight — Define management information, assurance, and customer-outcome monitoring.

Set thresholds and trends for quality, timeliness, incidents, complaints, vulnerable-customer outcomes where relevant, rework, staff capacity, control failures, and remediation. Review the evidence at a frequency proportionate to risk.

22. Exit — Approve a tested exit and substitution plan before dependency becomes critical.

Specify exit triggers, decision authority, notice, transition resources, data extraction, knowledge transfer, access revocation, records retention, alternative providers or in-house options, customer communications, and continuity during transition.