General outsourcing requirements: relying on a third party to perform operational functions, including critical or important functions

FCA Handbook, SYSC 8.1

In force since 3 Jan 2018.

An AI sector rules rule binding private bodies.

Criminal exposure: No
Enforcement body: Financial Conduct Authority
Instrument type: a regulation made under an act
Obligation class: Governance
Audit expectation: continuous
Who audits it: Self, Regulator
Where the report goes: Produced on request

As of 10 October 2026.

What it requires

It reaches you if you are a common platform firm, meaning a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator (SYSC 1 Annex 1 3.2G and Table A), and for SYSC 8.1.6R only if you are any other firm apart from an insurer, a UK ISPV, a managing agent, the Society, a full-scope UK AIFM of an unauthorized AIF, a MiFID optional exemption firm or a third country firm (SYSC 1 Annex 1 3.3R): when relying on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services on a continuous and satisfactory basis, take reasonable steps to avoid undue additional operational risk, and do not undertake the outsourcing of important operational functions in such a way as to impair materially the quality of your internal control or the ability of the FCA to monitor your compliance with all obligations under the regulatory system (SYSC 8.1.1R).
If you are a common platform firm and you outsource critical or important operational functions, remain fully responsible for discharging all of your obligations under the UK law on markets in financial instruments, and comply with the conditions that the outsourcing must not result in the delegation by senior management of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6-AR).
If you are a firm other than a common platform firm and you outsource critical or important operational functions or any relevant services and activities, remain fully responsible for discharging all of your obligations under the regulatory system, and comply with the conditions that the outsourcing must not result in the delegation by senior personnel of their responsibility, must not alter your relationship and obligations towards clients, must not undermine the conditions with which you must comply in order to be authorized and to remain so, and must not remove or modify any other condition subject to which your authorization was granted (SYSC 8.1.6R).
If you are a common platform firm, exercise due skill and care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any relevant services and activities (SYSC 8.1.7R).
If you are a common platform firm, take the necessary steps to ensure that the conditions in SYSC 8.1.8R are satisfied, among them that the service provider has the ability, capacity, appropriate organizational structure and any authorization required by law to perform the outsourced functions reliably and professionally (SYSC 8.1.8R(1)), that you establish methods for assessing the standard of performance of the service provider and for reviewing on an ongoing basis the services it provides (SYSC 8.1.8R(2)), and that you effectively supervise the outsourced functions and manage the risks associated with the outsourcing, retaining the necessary expertise and resources to do so (SYSC 8.1.8R(5)).
If you are a common platform firm, ensure that you can terminate the arrangement for the outsourcing where necessary, with immediate effect when this is in the interest of your clients, without detriment to the continuity and quality of your provision of services to clients, and that the continuity and quality of the outsourced functions or services are maintained also in the event of termination (SYSC 8.1.8R(7) and (12)).
If you are a common platform firm, ensure that you, your auditors, the FCA and any other relevant competent authority have effective access to data related to the outsourced activities and to the business premises of the service provider, where necessary for the purpose of effective oversight, and that the service provider cooperates with the FCA and any other relevant competent authority in connection with the outsourced activities (SYSC 8.1.8R(8) and (9)).
If you are a common platform firm, ensure that the service provider protects any confidential information relating to you and your clients, and that you and the service provider establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities where that is necessary having regard to the function, service or activity outsourced (SYSC 8.1.8R(10) and (11)).
If you are a common platform firm, set out the respective rights and obligations of you and the service provider clearly in a written agreement, keeping your instruction and termination rights, your rights of information and your right to inspections and access to books and premises, and ensure that the agreement lets the service provider outsource only with your consent in writing (SYSC 8.1.9R).
If you are a common platform firm, make available on request to the FCA all information necessary to enable the FCA to supervise the compliance of the performance of the outsourced activities with the requirements of the UK law on markets in financial instruments (SYSC 8.1.11-AR).
If you are a common platform firm and you outsource functions related to portfolio management provided to clients to a service provider located in a third country, ensure that the service provider is authorized or registered in its home jurisdiction to provide that service and is effectively supervised by a regulatory body in that third country, and that there is an appropriate cooperation agreement between the FCA and that regulatory body (SYSC 8.1.11-BR).

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

SYSC 8.1.1R requires a common platform firm that relies on a third party for the performance of operational functions which are critical for the performance of regulated activities, listed activities or ancillary services on a continuous and satisfactory basis to take reasonable steps to avoid undue additional operational risk. Other firms should take account of the outsourcing rule in SYSC 8.1.1R as if it were guidance, as SYSC 1 Annex 1 3.3R(1) explains.

A common platform firm is a MIFIDPRU investment firm, a bank, a building society, a designated investment firm or a dormant asset fund operator. A firm other than a common platform firm that outsources critical or important operational functions remains fully responsible for discharging all of its obligations under the regulatory system.

For a common platform firm, SYSC 8.1.4AR regards an operational function as critical or important if a defect or failure in its performance would materially impair the continuing compliance of the firm with the conditions and obligations of its authorization or its other obligations under the UK law on markets in financial instruments, or its financial performance, or the soundness or the continuity of its designated investment business.

SYSC 8.1.8R requires a common platform firm to take the necessary steps to ensure that the service provider has the ability, capacity, appropriate organizational structure and any authorization required by law to perform the outsourced functions reliably and professionally, among the other conditions it lists.

For SYSC 8, outsourcing means an arrangement of any form between a firm and a service provider by which that service provider performs a process, a service or an activity which would otherwise be undertaken by the firm itself. Because that definition covers an arrangement of any form, a firm's use of a third party's model or AI service that performs a process, a service or an activity the firm would otherwise undertake itself is outsourcing for SYSC 8. SYSC 8.1.1R took effect on January 3, 2018.

SYSC 8.1.8R took effect on October 23, 2025. A contravention of a rule in the common platform requirements does not give rise to a right of action by a private person under section 138D of the Financial Services and Markets Act 2000.

SYSC Schedule 5 records that the FCA has removed the right of action under section 138D of the Financial Services and Markets Act 2000 for SYSC 4 to SYSC 10A, with a reference to SYSC 1 Annex 1 2.19R. If the appropriate regulator considers that an authorised person has contravened a relevant requirement imposed on the person, section 206 of the Financial Services and Markets Act 2000 lets it impose a penalty of such amount as it considers appropriate.

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example · Lint your app