Outsourcing, new technologies and new technology risks: Current and trending UK regulatory themes, concerns and focuses

Abstract

‘Traditional’ information technology and business process outsourcing is declining. Cloud computing is growing. Regulated financial services firms are increasingly deploying automation, software robotics, artificial intelligence, algorithmic processing and digitisation. The UK and other national and supranational regulators are concerned about the consequences of such technologies, new business models (eg FinTech, cloud computing), third-party service provision and new supply chains. Adoption of these new technologies, supply chains and operating models presents a rapidly growing cyber risk. The biggest issues facing the global financial services industry and its regulators are cyber risk and resilience. Regulators are clearly focusing on those issues, though not to the exclusion of other concerns about outsourcing, cloud computing and third-party risk. Cyber risk and resilience and third-party/supply chain compliance will become the foremost and most pervasive regulatory concerns over the coming years. Regulators in many jurisdictions are aware of the tension between supervising outsourcing, third-party IT services, digital and cyber risk, and facilitating (1) technological innovation in financial services (FinTech) and (2) social and financial inclusivity (‘redlining risk’). They seem to be struggling to resolve that tension. This paper focuses on UK regulation, but refers to and cites throughout national and supranational regulatory statements, guidance and rules.