Prudential Regulation Authority Rulebook

2.1

A firm must:

1. (1) when relying on a third party for the performance of operational functions which are critical for the performance of relevant services and activities on a continuous and satisfactory basis, ensure that it takes reasonable steps to avoid undue additional operational risk; and
2. (2) not undertake the outsourcing of important operational functions in such a way as to impair materially:
1. (a) the quality of its internal control; and
2. (b) the ability of the PRA to monitor the firm’s compliance with all obligations under the regulatory system and, if different, of a competent authority to monitor the firm’s compliance with all obligations implemented pursuant to MiFID II.

[Note: Article 16(5) first paragraph of MiFID II]

2.1A

A MiFID investment firm must extend the arrangements and meet the requirements of the Articles 30, 31 Outsourcing Requirements, so they apply with respect to other matters on the following basis:

1. (1) references to “authorisation” under MiFID II are references to authorisation under section 31(2) of the Act;
2. (2) references to “obligations” implemented pursuant to MiFID II are references to a firm’s obligations under the regulatory system;
3. (3) references to “investment services and activities” are references to relevant services and activities;
4. (4) references to “client” includes anyone who is a client; and
5. (5) references to “competent authority” are references to the PRA or the FCA acting other than in the capacity of a competent authority for the purposes of MiFID II or CRR.

2.1B

A firm that is not a MiFID investment firm must comply with the Articles 30, 31 Outsourcing Requirements on the basis set out in 2.1A and as if references to “investment firm“ refer to a firm.

2.2

2.3

2.4

2.5

2.6

2.7

2.8

2.9