Supplier Vetting for Financial Services — UK Checklist

The FCA Handbook (SYSC 3.2.6R, COBS 2.1R) requires firms to take reasonable care to ensure suppliers have adequate systems and controls. The PRA's Operational Resilience framework (SS2/21) mandates firms identify and manage third-party dependencies critical to delivering important business services. The Money Laundering Regulations 2017 require customer due diligence extended to beneficial owners of supplier counterparties. GDPR Article 32 mandates risk assessments for data processors. Non-compliance attracts FCA/PRA enforcement action and fines up to 10% of global revenue or £20 million (whichever is higher). The 2023 FCA annual report documented 34 enforcement actions against suppliers and third-party managers, with average fines of £4.2 million per case.

High PSC concentration (>14.1 average sector score) requires enhanced due diligence including: (1) documented approval from the supplier's board confirming governance oversight; (2) contractual protections mandating successor approval rights if the controlling PSC exits; (3) increased financial monitoring frequency (quarterly vs. annual); (4) enhanced cybersecurity audits given single decision-maker risk; (5) contingency supplier identification for critical services. For PSC scores exceeding 18, firms should consider whether the concentration level justifies continuing the relationship or negotiating governance improvements. The FCA expects firms to document rationale for accepting concentrated ownership risk in critical supplier relationships.

Initial vetting must occur before contract execution and service delivery begins; the FCA expects this pre-signature for new suppliers, with completion within 10 business days for low-risk administrative suppliers and 30 days for critical providers. Annual renewal vetting is mandatory for all suppliers, with enhanced frequency (quarterly) for critical dependencies. Where supplier risk signals emerge mid-year (director changes, regulatory actions, financial distress indicators), re-vetting must commence immediately. The PRA's operational resilience expectations require firms to maintain real-time monitoring of critical suppliers using continuous automated screening. Firms accepting contracts before vetting completion face regulatory censure; the FCA fined one major bank £22 million in 2023 for failing to complete supplier vetting within required timelines.

Financial services firms should require minimum Professional Indemnity Insurance (PII) of £10 million for payment processors, £5 million for standard service providers, and £25 million+ for critical infrastructure/cloud providers. Firms must verify coverage extends to regulatory fines, data breaches, and operational disruptions specific to financial services—not standard commercial policies. Required documentation includes: current insurance certificate naming the financial services firm as interested party, insurer financial strength rating (A- or better), written confirmation coverage remains valid if insurer is acquired. Red flags include exclusions for cyber incidents, regulatory breaches, or sanctions violations. For critical suppliers, firms should maintain copies of renewal documents and conduct annual certificate audits to prevent coverage lapses during service delivery.

Companies House records provide the legal foundation for supplier vetting transparency. The director register (233,943 records in the financial services sector) confirms governance legitimacy—firms identify disqualified directors, excessive directorships (>20 indicates conflicts), and management stability. PSC records (216,696 records, avg. concentration score 14.1) provide beneficial ownership transparency critical for detecting shell companies, sanctions evasion, and undisclosed related-party relationships. Filed accounts reveal financial viability, leverage, and cash generation capacity. Companies House notifications of strike-off, administration, or insolvency provide early warning of supplier distress before service disruption occurs. The FCA explicitly references Companies House verification as mandatory first-step due diligence; firms bypassing this check face enforcement action. Regular monitoring of Companies House updates (via automated feeds) allows firms to detect governance changes, director appointments, or financial filing delays that signal emerging risks.