Understand the PRA's new material third-party reporting requirements effective March 2027. Learn about regulatory notifications, annual registers, materiality assessments, reporting data and practical readiness activities.
You are a Third-Party Risk Management (TPRM) Analyst at Northbridge Bank, a fictional UK retail bank.
The bank maintains a register of outsourcing arrangements and has established processes for notifying the Prudential Regulation Authority (PRA) about material outsourcing.
However, the Compliance Manager has identified a significant regulatory change.
From 18 March 2027, the PRA is introducing updated requirements for the notification and reporting of material third-party (MTP) arrangements.
These changes extend regulatory reporting beyond arrangements classified as material outsourcing.
Northbridge may have important relationships with technology providers, infrastructure companies and other suppliers that do not qualify as outsourcing but could still pose significant risks to the bank.
For example, a technology supplier might provide software that Northbridge operates internally.
The relationship may not meet the regulatory definition of outsourcing, but failure of the software could significantly affect the bank's operations.
Under the revised framework, the bank must consider whether the relationship qualifies as a material third-party arrangement.
The Compliance Manager asks you three questions:
These questions form the basis of this article.
We will examine the changes introduced by Policy Statement PS7/26, their relationship with PRA SS2/21 and how a TPRM analyst can support an organisation's readiness.
By the end of this article, you should be able to:
Financial institutions increasingly rely on external technology, infrastructure and service providers.
These relationships can introduce operational dependencies that extend beyond traditional outsourcing.
For example, a bank may rely on third-party software, cloud infrastructure or specialist technology to deliver important services.
A serious disruption affecting one provider could affect several firms simultaneously.
The PRA needs sufficient information to understand these dependencies and identify potential vulnerabilities affecting individual institutions or the wider financial sector.
Historically, the PRA's reporting arrangements focused significantly on material outsourcing.
This provided information about firms that delegated important activities to external providers.
However, not every significant third-party dependency qualifies as outsourcing.
Consider a bank that purchases a software product and operates it internally.
The supplier may not be performing an outsourced function.
Nevertheless, a serious defect or failure affecting the software could disrupt important business operations.
A regulatory reporting framework limited to outsourcing may not fully capture such dependencies.
On 18 March 2026, the PRA published Policy Statement PS7/26: Operational Resilience – Operational Incident and Third-Party Reporting.
The policy introduces changes intended to improve the consistency, accuracy and timeliness of regulatory information about material third-party relationships.
The information will help the PRA:
The PRA also revised the reporting arrangements following consultation to reduce unnecessary reporting burdens and improve alignment with the Financial Conduct Authority (FCA).
The new rules and accompanying supervisory guidance take effect on:
18 March 2027
As of November 2026, firms should be preparing for implementation.
The November 2024 version of SS2/21 remains effective until the revised statement takes effect.
One of the most important changes is the wider focus on material third-party arrangements.
A material outsourcing arrangement involves the external performance of a function that meets the applicable outsourcing definition and materiality criteria.
A material third-party arrangement is broader.
It may involve outsourcing or another third-party relationship whose disruption or failure could pose significant risks to the PRA's objectives.
These objectives include the safety and soundness of regulated firms and, for insurers, the protection of policyholders.
The revised framework therefore considers the importance and potential consequences of the relationship, rather than relying solely on whether it qualifies as outsourcing.
| Arrangement | Outsourcing? | Could be a material third-party arrangement? |
|---|---|---|
| External provider operates payment-processing functions | Likely | Yes |
| Provider operates customer authentication infrastructure | Likely | Yes |
| Supplier provides important internally operated software | Not necessarily | Yes |
| Supplier provides routine office furniture | Generally not | Generally unlikely |
| Consultancy provides a one-off minor business review | Generally not | Generally unlikely |
These classifications are illustrative.
The actual determination depends on the nature of the arrangement and the applicable regulatory criteria.
A relationship does not become material simply because it involves technology or a well-known supplier.
The firm must consider the potential consequences of disruption or failure.
Relevant considerations may include:
The revised Chapter 5 of SS2/21 provides additional expectations and examples to help firms identify material third-party arrangements.
Not all third-party arrangements must be reported.
The new reporting framework focuses on arrangements assessed as material under the applicable rules.
A firm may maintain an internal register of all suppliers for governance and operational purposes.
However, the regulatory MTP register is concerned with material third-party arrangements.
The reporting requirements apply to specified categories of PRA-regulated firms.
These include:
The PRA's final policy introduced proportionality measures.
Credit unions with less than £50 million in total assets are excluded from the new MTP reporting requirements.
The threshold and its application should be checked against the relevant rules.
Third-country branches are excluded from the PRA's new material third-party notification and register reporting requirements.
This does not remove their responsibility to manage applicable third-party risks or meet other relevant regulatory obligations.
The final policy also clarifies the treatment of intragroup relationships.
Certain arrangements entirely within a corporate group are excluded from MTP notification and register reporting.
However, an arrangement may become reportable where the relevant group provider relies on an external organisation to provide the product or service to the regulated firm.
Specific provisions also apply to ring-fenced bodies.
Before preparing a regulatory return, confirm:
Do not assume that every PRA-regulated organisation has identical reporting obligations.
The new framework includes two distinct reporting activities:
These activities serve related but different purposes.
| Requirement | MTP Notification | Annual MTP Register |
|---|---|---|
| Purpose | Inform the PRA of a new or significantly changed material arrangement | Provide an overview of the firm's material third-party relationships |
| Trigger | Entering into or significantly changing an MTP arrangement | Annual reporting requirement |
| Submission channel | FCA Connect | FCA RegData |
| Scope | Relevant new or significantly changed MTP arrangements | All reportable MTP arrangements |
| Frequency | Event-driven | Annual |
The two processes should be supported by consistent underlying supplier data.
However, they have separate submission templates and workflows.
The revised reporting framework requires relevant firms to notify the PRA when entering into or significantly changing an MTP arrangement.
The notification requirements cover material outsourcing and qualifying material non-outsourcing relationships.
Two important triggers are:
Entering into a new MTP arrangement
For example, Northbridge plans to engage a cloud technology provider for a service assessed as material.
Making a significant change to an existing MTP arrangement
For example, the scope of a material service is expanded in a way that significantly changes the firm's exposure.
The revised SS2/21 provides additional guidance and examples concerning significant changes.
Firms are expected to assess proposed arrangements sufficiently early to allow the PRA to consider the notification and request additional information where necessary.
The PRA has not established a universal fixed number of days before contract execution for submitting these notifications.
This means the firm needs an effective internal process for identifying relevant arrangements early.
The notification should not be treated as an administrative task left until the final stage of procurement.
This is an important distinction.
Submitting an MTP notification does not mean the PRA has approved the outsourcing or third-party arrangement.
The PRA may request additional information or require further action.
It may also decide that no specific response is necessary.
The regulated firm remains responsible for managing the arrangement and making decisions through its own governance framework.
The final policy introduces FCA Connect as the submission platform for MTP notifications.
This provides a more standardised reporting route and supports information sharing between relevant supervisory authorities.
For a TPRM analyst, this creates a need for coordination with the team responsible for regulatory submissions.
The analyst may prepare supplier information and assessment records without personally submitting the notification.
The actual submission responsibility should be clearly assigned.
The second major change is the requirement for relevant firms to submit an annual register of their material third-party arrangements.
The register gives the PRA a structured view of important third-party dependencies.
The register covers reportable material third-party arrangements.
These include both:
This is broader than a register limited to traditional outsourcing.
The annual MTP register is submitted through FCA RegData using the relevant reporting template.
The PRA has separated the notification and register templates.
This provides flexibility because information required at the point of entering an arrangement may differ from information available when maintaining the full register.
Although the regulatory register is submitted annually, firms need reliable arrangements for maintaining accurate information.
A supplier inventory updated only immediately before submission may contain:
A practical approach is to maintain the underlying information throughout the year.
The regulatory submission can then be prepared from controlled and validated records.
The notification rules principally concern entering into or significantly changing arrangements after the new requirements apply.
The annual register, by contrast, covers existing arrangements that meet the applicable MTP criteria.
This distinction is important.
A firm should not assume that an arrangement is excluded from the register simply because the contract was signed before March 2027.
Accurate reporting begins with reliable supplier and arrangement information.
The official reporting templates determine the precise required data fields.
However, a firm preparing for implementation should consider whether its internal systems capture the information needed to support the templates.
| Category | Illustrative Information |
|---|---|
| Firm information | Regulated legal entity responsible for the arrangement |
| Provider identity | Legal provider name and relevant identifiers |
| Arrangement details | Service description and contract information |
| Classification | Outsourcing or non-outsourcing |
| Materiality | Documented determination and supporting rationale |
| Business dependency | Relevant business services or functions supported |
| Service delivery | Relevant delivery locations and arrangements |
| Subcontracting | Relevant subcontractor dependencies |
| Governance | Business owner and assessment or approval information |
| Reporting status | Notification and register reporting records |
This is an illustrative internal readiness checklist, not a reproduction of the PRA's reporting template.
Each field should be mapped to the actual regulatory template before it is treated as mandatory reporting information.
A supplier may operate under different trading names or through different legal entities.
For example, Northbridge might record:
If different teams use different naming conventions, the bank may struggle to reconcile supplier records.
A consistent approach to legal entity identification improves data quality.
A supplier may provide several services to the same firm.
Not all arrangements will necessarily have the same materiality.
For example:
SecureAccess may provide a customer authentication platform and a separate internal administrative application.
The authentication arrangement may be material while the administrative application is not.
The firm should therefore be able to identify and assess the individual relationships.
Every reportable arrangement should have an appropriate accountable business owner.
Without clear ownership, regulatory reporting teams may struggle to obtain current information, confirm materiality or validate changes.
A TPRM analyst can help prepare the organisation by performing a supplier data gap assessment.
The objective is to determine whether existing records can support the new reporting requirements.
Relevant sources might include:
Identify potentially material third-party arrangements.
This should include a review of relevant non-outsourcing relationships.
For example, the bank may need to examine software providers or infrastructure dependencies that were previously excluded from its outsourcing register.
Confirm that the existing methodology addresses the revised MTP criteria.
Where classification is unclear, document the uncertainty and obtain the required information.
Compare the information already maintained with the official MTP notification and register templates.
Identify missing fields, inconsistent formats and unclear ownership.
Consider whether records are:
Where gaps exist, recommend practical actions.
For example:
The objective is to improve the reliability of the underlying information rather than create a separate manual register that quickly becomes outdated.
The new notification requirements should be integrated into existing third-party governance.
A practical workflow might include the following stages.
The business owner or Procurement team initiates the relevant process.
TPRM coordinates the assessment using the approved methodology.
Relevant business and specialist functions provide supporting information.
The firm determines whether the arrangement triggers notification obligations.
Compliance or Regulatory Affairs confirms the applicable requirements.
The responsible functions gather and validate the required reporting information.
The authorised reporting function submits the notification through FCA Connect.
Any PRA request for additional information or action is coordinated and addressed.
The firm retains appropriate records of the assessment, submission and subsequent changes.
This is an illustrative operating process.
It should be adapted to the firm's governance and regulatory reporting framework.
Consider a bank where Procurement handles contracts, TPRM assesses supplier risks and Compliance manages regulatory submissions.
If Procurement does not notify TPRM about a significant contract change, the arrangement may not undergo reassessment.
If TPRM identifies the change but does not inform Compliance, a required notification may be missed.
The control weakness is not necessarily a lack of knowledge about the regulation.
It may be an ineffective handover between functions.
Clear responsibilities and escalation triggers are therefore essential.
PS7/26 introduces changes covering both material third-party reporting and operational incident reporting.
These are related but distinct regulatory processes.
This concerns the firm's relationships with significant external providers.
It includes notifications and the annual MTP register.
The focus is on identifying and reporting material dependencies.
This concerns certain operational incidents meeting the applicable regulatory reporting thresholds.
Under the new framework, relevant firms submit a single incident report that is updated through initial, intermediate and final reporting phases.
The incident reporting regime is supported by PRA SS1/26.
| Area | MTP Reporting | Operational Incident Reporting |
|---|---|---|
| Main subject | Material third-party relationships | Reportable operational incidents |
| Main purpose | Regulatory oversight of significant dependencies | Timely information about material operational disruption |
| Typical trigger | New or significantly changed MTP arrangement; annual register | Incident meeting applicable reporting thresholds |
| Submission approach | MTP notification and register templates | Single incident report updated across phases |
| Main supporting guidance | SS2/21 | SS1/26 |
Yes.
Suppose SecureAccess operates a material authentication service.
Northbridge may need to include the relationship in its annual MTP register.
If SecureAccess subsequently suffers a severe operational incident affecting Northbridge, the bank may also need to assess whether the event meets the applicable operational incident reporting thresholds.
The existence of a reportable third-party arrangement does not automatically make every supplier incident reportable.
Likewise, reporting an operational incident does not replace the relevant obligations concerning third-party arrangements.
A TPRM analyst may support incident reporting by supplying:
The determination and submission of operational incident reports should follow the firm's incident management and regulatory reporting responsibilities.
Northbridge has reviewed its supplier inventory in preparation for March 2027.
The following arrangements have been identified.
| Provider | Arrangement | Initial Assessment |
|---|---|---|
| SecureAccess Cloud Ltd | Managed customer authentication | Material outsourcing |
| PaymentFlow Systems Ltd | Payment processing | Material outsourcing |
| CoreLedger Software Ltd | Internally operated core banking software | Potentially material non-outsourcing |
| OfficePro Ltd | Office furniture supply | Non-material |
| InsightData Services Ltd | Operational analytics platform | Further materiality assessment required |
SecureAccess and PaymentFlow have already been classified as material outsourcing.
These arrangements should be considered for inclusion in the regulatory MTP register.
CoreLedger requires further consideration.
Although Northbridge operates the software internally, a severe failure could significantly affect the bank's core operations.
The arrangement may therefore meet the revised material third-party criteria.
InsightData requires additional information about its operational significance.
OfficePro is unlikely to be material based on the available facts.
The TPRM team discovers:
These are potential readiness gaps.
The bank cannot assume that the existing outsourcing register can be submitted without further work.
Finding ID: MTP-READINESS-001
Title: Incomplete identification and assessment of material non-outsourcing arrangements.
Regulatory context: PS7/26 and revised PRA SS2/21, Chapter 5.
Observation: Northbridge's existing supplier register focuses on outsourcing relationships. The bank has not demonstrated that significant non-outsourcing third-party arrangements have been systematically assessed against the revised materiality criteria.
Risk: Reportable material third-party arrangements may be omitted from the firm's notifications or annual register.
Recommended action: Review relevant non-outsourcing supplier relationships, apply the revised materiality methodology, document conclusions and update the reporting population.
Proposed owner: Head of TPRM, supported by Compliance and business owners.
Status: Open.
This is a readiness finding concerning requirements that will take effect in March 2027.
It should not be misrepresented as a breach of the future reporting rules before their commencement.
A structured implementation plan helps ensure that the organisation is ready before the effective date.
Objective: Confirm the applicable requirements.
Activities:
Output: Approved regulatory requirements and applicability assessment.
Objective: Understand existing reporting capabilities.
Activities:
Output: Regulatory readiness gap assessment.
Objective: Address the identified weaknesses.
Activities:
Output: Updated reporting framework and supporting controls.
Objective: Confirm that the proposed reporting process works.
Activities:
Output: Testing results, identified gaps and remediation actions.
Objective: Prepare for the requirements taking effect.
Activities:
Output: Documented reporting readiness assessment.
The official regulatory templates and reporting instructions should be used when validating operational readiness.
An internally developed checklist may support preparation, but it should not replace the prescribed reporting requirements.
You are a TPRM Analyst at Northbridge Bank.
The Compliance Manager asks you to review the bank's readiness for the March 2027 reporting requirements.
The bank currently maintains a register of material outsourcing arrangements.
However:
Identify at least five readiness gaps.
For each, explain the relevant reporting or governance risk.
Using the worked example in Section 11, identify which arrangements appear likely to require reporting and which need further assessment.
Explain your reasoning.
Propose controls that would help Northbridge:
Prepare a short implementation plan identifying:
Write a management summary of no more than 300 words.
Explain:
Assessment guidance: Strong responses should distinguish outsourcing from material third-party reporting, recognise the importance of data quality and focus on practical governance and reporting controls.
The exercise supports the article. The integrated workplace assessment for the complete PRA SS2/21 pathway will be designed separately.
The revised MTP framework includes qualifying material non-outsourcing arrangements.
The annual register is concerned with reportable material third-party arrangements.
Submitting a notification does not transfer responsibility for the arrangement to the PRA.
The annual register and notifications are separate regulatory activities with different triggers.
Inaccurate provider details, outdated classifications and missing arrangement information can undermine reporting quality.
Materiality should be assessed sufficiently early to support timely notification.
Unclear handovers between Procurement, TPRM and Compliance can result in missed notifications or inaccurate submissions.
These are distinct reporting obligations, although both concern operational resilience and may involve the same providers.
Regulatory readiness findings should be distinguished from breaches of currently applicable requirements.
The March 2027 reporting changes represent an important development in UK regulatory third-party risk management.
The main lessons are:
The reporting scope is broader than outsourcing. Material non-outsourcing arrangements may also be reportable.
Materiality remains central. Firms must assess which relationships meet the applicable MTP criteria.
Notifications and annual registers are different. New or significantly changed arrangements trigger notification considerations, while the annual register provides a broader overview of material relationships.
Accurate supplier data is essential. Regulatory reporting depends on reliable arrangement records and documented decisions.
Governance must support timely reporting. Business owners, Procurement, TPRM and Compliance need effective communication and clearly assigned responsibilities.
Notification is not approval. The regulated firm remains accountable for managing third-party risk.
Operational incident reporting is a separate process. Firms must understand both reporting regimes and their respective triggers.
Preparation should begin before the effective date. Reviewing materiality methodologies, supplier inventories and reporting controls can help firms identify implementation gaps.
For a TPRM analyst, the practical challenge is not simply understanding a revised supervisory statement.
It is helping the organisation maintain accurate information, identify reportable arrangements and establish processes that support timely, complete and defensible regulatory submissions.
You have now covered the main areas of PRA SS2/21 through seven resources:
Together, these resources introduce the regulatory framework and explain how its expectations can be applied through classification, risk assessment, governance, assurance and regulatory reporting.
The next stage is to demonstrate these skills through practical workplace activities.
The integrated workplace assessment will be developed separately, using a fictional evidence pack, structured deliverables and an assessment rubric.
Prudential Regulation Authority: PS7/26 – Operational Resilience: Operational Incident and Third-Party Reporting.
Published 18 March 2026.
Prudential Regulation Authority: SS2/21 – Outsourcing and Third Party Risk Management.
The publication page provides both the November 2024 effective version and the March 2026 future version.
Prudential Regulation Authority: SS1/26 – Operational Resilience: Incident Reporting.
Available through PS7/26, Appendix 2.
Prudential Regulation Authority: Material Third-Party Notification Template, Form M.
Available through PS7/26, Appendix 5.
Prudential Regulation Authority: Material Third-Party Register Template.
Available through PS7/26, Appendix 6.
Prudential Regulation Authority: PRA Rulebook amendments concerning notification of third-party arrangements and operational incident reporting.
Available through PS7/26, Appendix 1.
Regulatory Version Note: The new reporting requirements and March 2026 revised SS2/21 take effect on 18 March 2027. This article was prepared in November 2026 and describes the published future requirements. Readers conducting live assessments should consult the applicable PRA Rulebook provisions, official templates and current supervisory guidance.
Educational Disclaimer: This resource is intended for education and professional development. Northbridge Bank and all associated supplier scenarios are fictional. The material does not constitute legal or regulatory advice.