This article introduces PRA SS2/21 and its expectations for outsourcing and third-party risk management in UK financial institutions. It explains key requirements, including governance, outsourcing classification, materiality assessments, supplier due diligence, contractual controls, ongoing monitoring and exit planning. Through practical examples and a case study, learners explore how TPRM analysts can identify regulatory gaps, assess evidence and support compliance with PRA expectations.
Imagine you are a Third-Party Risk Management (TPRM) Analyst working for a UK bank.
Your organisation is planning to engage a technology provider to host and manage the infrastructure supporting its online banking platform. The provider has a strong reputation, holds ISO 27001 certification and has supplied satisfactory security documentation.
Your assessment indicates that the provider has implemented appropriate security controls. The technology team is satisfied, and the business wants to proceed.
Can you recommend approval?
Not necessarily.
You have assessed some of the supplier's security risks, but several important questions remain.
These questions go beyond a conventional supplier security assessment. They concern the bank's ability to remain operational, meet its regulatory obligations and maintain effective control over activities performed by external providers.
This is where PRA Supervisory Statement SS2/21: Outsourcing and Third Party Risk Management becomes relevant.
In this article, we will examine the purpose and scope of SS2/21, its main supervisory expectations, and how a TPRM analyst can apply them in practice.
By the end of this article, you should be able to:
PRA SS2/21 is a supervisory statement issued by the Prudential Regulation Authority (PRA), which is part of the Bank of England.
The PRA supervises banks, building societies, insurers and certain other financial institutions. Its objectives include promoting the safety and soundness of regulated firms and contributing to the protection of insurance policyholders.
SS2/21 sets out the PRA's expectations for how regulated firms should manage risks associated with outsourcing and other third-party arrangements.
The statement was first published in March 2021 and became effective in March 2022. It has subsequently been updated.
Its central principle is straightforward:
A financial institution can outsource an activity, but it cannot outsource accountability for managing the risks associated with that activity.
Consider a bank that engages an external provider to operate part of its payment-processing infrastructure.
The provider may be responsible for maintaining servers, applying security patches and restoring services following an outage.
However, the bank remains accountable for meeting its own regulatory obligations. If the provider fails and customers cannot access an important banking service, the bank cannot simply transfer its regulatory responsibility to the provider.
The bank must have taken appropriate steps to understand, assess and manage the associated risks.
No.
SS2/21 is a supervisory statement explaining the PRA's expectations regarding compliance with relevant regulatory requirements.
The underlying obligations arise from sources including the PRA Rulebook and applicable legislation.
This distinction matters when conducting regulatory assessments.
An analyst should not automatically describe every paragraph of SS2/21 as a standalone legal requirement. Instead, the analyst should identify the applicable rule or obligation, understand the PRA's supervisory expectations and assess whether the firm's controls adequately address them.
SS2/21 is principally relevant to:
Certain requirements and expectations are also relevant to credit unions and non-directive firms, although the full range of detailed expectations does not apply equally to all such firms.
Not every UK financial-services business is automatically subject to SS2/21.
For example, a fintech company authorised solely by the Financial Conduct Authority (FCA) would not necessarily fall directly within SS2/21's scope.
It may instead be subject to applicable FCA rules and guidance on outsourcing, governance, systems and controls, and operational resilience.
Nevertheless, such a fintech could encounter SS2/21 through its commercial relationships.
If it provides important services to a PRA-regulated bank, the bank may require contractual commitments, security evidence, audit rights and resilience assurances to support its own regulatory compliance.
Before assessing compliance with any regulatory framework, establish whether the organisation is within its scope.
Do not assume that an organisation is subject to a particular regulation simply because it operates in a related industry.
One of the first decisions a TPRM analyst must support is determining whether a proposed supplier relationship qualifies as outsourcing.
Under the PRA's definition, outsourcing involves a service provider performing a process, service or activity that would otherwise be undertaken by the regulated firm itself.
In assessing an arrangement, the firm should also consider whether the provider will perform the relevant function on a recurrent or ongoing basis.
Not every supplier relationship qualifies as outsourcing.
Consider the following fictional examples:
| Arrangement | Initial classification | Reasoning |
|---|---|---|
| A provider operates the bank's customer contact centre | Likely outsourcing | The provider performs an ongoing operational function on behalf of the bank |
| A company supplies office furniture | Generally not outsourcing | It supplies goods rather than performing an ongoing bank function |
| A provider processes recurring customer transactions | Likely outsourcing | An operational activity is being performed for the bank |
| A consultancy conducts a one-off strategic review | Generally not outsourcing | It provides a discrete professional service |
| A cloud provider hosts an application | Requires further assessment | The classification depends on the nature of the service and the activities being performed |
These are illustrative classifications, not definitive regulatory determinations.
Outsourcing arrangements are subject to specific requirements and supervisory expectations. However, other third-party relationships can still introduce significant operational, cybersecurity, concentration and resilience risks.
A supplier does not become low risk simply because its relationship is classified as non-outsourcing.
For example, a software provider supplying a product that the bank operates internally might not qualify as an outsourcing provider. Nevertheless, a serious vulnerability or failure in that product could disrupt critical operations.
The firm must still manage the risks proportionately.
Practical lesson: Classification determines which obligations apply. Risk assessment determines the level and nature of exposure. Both are necessary.
After establishing whether an arrangement qualifies as outsourcing, the next important consideration is materiality.
Materiality concerns the significance of the arrangement to the regulated firm's operations, regulatory compliance, financial position and resilience.
A material outsourcing arrangement is one where failure or disruption could have sufficiently serious consequences for the firm.
Materiality should not be determined solely by the supplier's contract value or reputation.
For example, a relatively inexpensive technology service may support an important business service. Its failure could have a disproportionate operational impact.
Conversely, a costly professional services contract may not necessarily be material.
When supporting a materiality assessment, an analyst should examine:
These factors should be assessed collectively, with reference to the applicable regulatory criteria and the firm's documented methodology.
Provider A: Supplies an internal meeting-room booking application used by a bank's administrative teams.
Provider B: Operates infrastructure supporting the bank's online payment-processing service.
Both providers may handle information, use cloud infrastructure and introduce cybersecurity risks.
However, their potential operational consequences are very different.
A prolonged outage affecting Provider A might inconvenience employees. A similar outage affecting Provider B could prevent customers from completing transactions and disrupt an important business service.
Provider B would therefore warrant particularly close consideration during the materiality assessment.
The final determination must be documented and approved through the firm's established governance process.
Remember: Materiality is not the same as the likelihood of a supplier experiencing a security incident. It concerns the significance of the arrangement and the consequences of its failure or disruption.
SS2/21 addresses outsourcing and third-party risk management across ten chapters.
Rather than memorising every provision, a TPRM analyst should understand the main areas and how they relate to the supplier lifecycle.
A regulated firm must maintain appropriate governance over its outsourcing activities.
Its board and senior management remain responsible for ensuring that outsourcing risks are managed effectively.
The organisation should have suitable policies, responsibilities, approval processes and oversight arrangements.
For a TPRM analyst, this means understanding who:
A common governance weakness occurs when procurement, technology, information security and business teams each assume another function is responsible for a particular risk.
A documented responsibility model helps prevent these gaps.
Before entering an outsourcing arrangement, the firm should undertake appropriate assessments.
These include determining materiality, identifying relevant risks and conducting proportionate due diligence on the proposed provider.
Depending on the arrangement, due diligence may cover:
Due diligence should provide evidence that the provider can deliver the agreed service while maintaining an appropriate level of risk.
An ISO 27001 certificate or SOC 2 report can support this assessment, but neither automatically establishes compliance with SS2/21.
The analyst must consider whether the evidence covers the services, systems and controls relevant to the proposed arrangement.
For material outsourcing arrangements, SS2/21 sets expectations for the content of written agreements.
These cover matters such as the services provided, responsibilities, information security, performance, audit and access rights, subcontracting and termination arrangements.
Consider a supplier contract containing detailed service-level commitments but no effective provision for the bank to obtain information needed to assess the supplier's controls.
The contract may be commercially attractive, but it could create a regulatory assurance gap.
A TPRM analyst should work with legal, procurement, compliance and relevant technical stakeholders to identify these issues before the agreement is finalised.
The analyst does not necessarily negotiate or approve contractual terms but can identify risk and control requirements that need to be addressed.
A regulated firm must understand how its information will be accessed, processed, stored and protected by third parties.
Relevant considerations include:
For example, if a cloud provider processes sensitive customer information, the bank should establish which security controls are managed by the provider and which remain the bank's responsibility.
This is particularly important where shared-responsibility models apply.
Regulated firms need sufficient information and assurance to oversee their outsourcing arrangements.
For material outsourcing, contractual rights should support appropriate access, inspection and audit activities, including relevant regulatory access.
An analyst should consider whether the proposed arrangements enable the firm to obtain the information necessary to assess the provider's compliance and control effectiveness.
Independent audit reports, certifications and pooled audits may provide useful assurance where appropriate.
However, the firm must assess whether these mechanisms are sufficient for the particular arrangement.
A supplier may rely on other organisations to deliver part of an outsourced service.
For example:
A bank engages a payment-processing provider. That provider relies on a separate cloud infrastructure company to host the payment application.
The cloud infrastructure company is part of the wider service delivery chain.
This introduces additional dependencies that the bank may need to understand and manage.
Relevant risks include:
The bank should understand the relevant sub-outsourcing arrangements and assess the risks they introduce.
This is one of the most significant areas of SS2/21.
For each material outsourcing arrangement, the PRA expects firms to develop, maintain and test appropriate business continuity plans and documented exit strategies.
Exit planning must consider both planned and stressed circumstances.
A planned exit might arise when a bank decides to change technology providers at the end of a contract.
A stressed exit could arise following a provider's insolvency, serious cyber incident or prolonged operational failure.
The assessment should therefore consider questions such as:
A contract termination clause is not, by itself, an effective exit strategy.
The firm needs a credible approach for maintaining or restoring service delivery.
Return to our opening scenario.
You are assessing a technology provider that will support a bank's online banking platform.
The supplier has provided:
The documentation is useful, but it does not complete your assessment.
A practical review might identify the following:
| Area | Assessment observation | Recommended action |
|---|---|---|
| Materiality | The service supports an important business service, but the materiality decision is not documented | Complete and approve a documented materiality assessment |
| Information security | Security reports are provided, but the scope of assurance needs verification | Validate report scope and assess relevant control gaps |
| Sub-outsourcing | The provider depends on a cloud infrastructure subcontractor | Obtain details and assess the associated dependencies |
| Audit rights | Contractual information and audit provisions are insufficiently defined | Refer to Legal and Compliance for review |
| Operational resilience | The supplier has a recovery plan, but alignment with the bank's impact tolerances is unclear | Review recovery capabilities and supporting evidence |
| Exit planning | No viable stressed exit strategy has been demonstrated | Develop and assess an appropriate exit strategy |
These findings do not automatically mean the supplier must be rejected.
They indicate that the available evidence is insufficient to conclude that all relevant risks and regulatory expectations have been adequately addressed.
Your role is to identify the gaps, assess their significance, recommend appropriate actions and support an informed decision through the firm's governance process.
Finding: Inadequate assurance over stressed exit arrangements.
Observation: The proposed provider supports an important banking service. Although contractual termination provisions exist, the firm has not demonstrated how it would maintain or restore the service if the provider suddenly ceased operations.
Risk: A provider failure could result in prolonged service disruption, potentially exceeding the firm's impact tolerance and affecting customers.
Relevant SS2/21 area: Chapter 10, Business Continuity and Exit Plans.
Recommendation: Develop a documented stressed exit strategy, identify feasible alternative service arrangements, establish recovery dependencies and perform proportionate validation or testing.
Proposed owner: Business Service Owner, supported by Operational Resilience, Technology and TPRM.
Status: Open, pending remediation and assurance review.
Notice how the finding connects evidence, regulatory expectations, business consequences and management action.
This is more useful than simply recording that the provider has failed a compliance checklist.
Understanding the supervisory statement is only part of the challenge. Applying it correctly requires judgement.
Not all third-party relationships qualify as outsourcing.
Incorrect classification can lead to inappropriate regulatory mapping and unnecessary assurance activities.
Security certifications and independent assurance reports provide evidence about specified controls.
They do not automatically demonstrate that the regulated firm has satisfied its obligations concerning materiality, governance, contractual rights, resilience and exit planning.
The same supplier may provide different services to different business functions.
The risks, materiality and required controls may differ between arrangements.
Assessment should therefore consider the particular service, its business context and its dependencies.
Supplier risks change.
A provider may experience financial difficulties, introduce new subcontractors, move processing activities or suffer a serious cyber incident.
Ongoing monitoring must identify and address relevant changes throughout the relationship.
The regulated firm remains accountable for its regulatory obligations.
Its governance and oversight arrangements must reflect that responsibility.
Having the legal right to terminate an agreement does not demonstrate that services can be transferred, replaced or recovered within acceptable limits.
Exit planning must address operational feasibility.
SS2/21 continues to evolve.
In March 2026, the PRA published Policy Statement PS7/26, introducing changes relating to operational incident reporting and material third-party arrangements.
The revised SS2/21 takes effect on 18 March 2027.
Among the changes are more standardised arrangements for notifying the PRA about material third-party relationships and maintaining and submitting regulatory information about those arrangements.
The new reporting framework extends beyond material outsourcing to include qualifying material non-outsourcing third-party arrangements.
The detailed application of the requirements depends on the relevant firm's regulatory category and applicable exemptions.
Firms preparing for the changes may need to examine:
For a TPRM analyst, the changes reinforce the importance of reliable supplier information, documented decisions and coordination between procurement, risk, compliance, technology and business teams.
Version note: The November 2024 SS2/21 remains the effective version as of November 2026. The March 2026 revised version takes effect on 18 March 2027. Always check the applicable version when performing a regulatory assessment.
You are a TPRM Analyst at Northbridge Bank, a fictional UK bank.
Northbridge plans to outsource its customer authentication infrastructure to SecureAccess Cloud Ltd.
The proposed arrangement will support customer access to online and mobile banking services.
During your initial review, you establish that:
Using what you have learned, answer the following questions:
Question 1: What additional information would you obtain before determining whether the proposed relationship qualifies as outsourcing?
Question 2: What factors would you consider when assessing the arrangement's materiality?
Question 3: Identify four regulatory assurance gaps from the information provided.
Question 4: Which SS2/21 chapters are most relevant to those gaps?
Question 5: What actions would you recommend before the arrangement is approved?
Your recommendations should distinguish between matters you can assess directly and those requiring decisions or specialist input from other functions.
This is an introductory exercise. A later resource in this pathway will guide you through a more detailed regulatory gap assessment using an evidence pack and a structured assessment workbook.
PRA SS2/21 provides a framework for understanding the regulatory expectations associated with outsourcing and third-party risk management in PRA-regulated financial institutions.
The most important points to remember are:
For a TPRM analyst, the objective is not simply to demonstrate familiarity with a regulatory document. It is to understand the expectations, identify the applicable risks, assess available evidence and help the organisation make defensible decisions.
Next article: Materiality Assessments Under PRA SS2/21: A Practical Guide
In the next article, we will examine how regulated firms assess outsourcing materiality, the factors that influence classification and how analysts can document their decisions.
You will work through practical examples and learn how to support a materiality assessment that can withstand internal audit and regulatory scrutiny.
Educational disclaimer: This resource is intended for learning and professional development. It does not constitute legal or regulatory advice. Regulatory interpretations should be verified against applicable rules and current supervisory publications.