The Financial Industry Needs Technology Escrow to Mitigate Third-Party Risks

Opinion

The financial services industry has been grappling with digital threats for years. To mitigate these risks, many financial organizations have considered technology escrow. However, recent regulations from the Bank of England (BoE) make it clear that technology escrow is not just recommended but necessary to protect businesses from supplier failure, service deterioration, and concentration risk.

The BoE’s new regulatory framework sets out new requirements for organizations to protect their processes and data. This move should facilitate greater resilience and adopting of the cloud and other new technologies. Complementing its requirements for third-party risk management in other parts of the financial services industry, the new framework marks a trend toward greater regulation of the sector’s outsourcing practices.

The supervisory statements in the BoE’s framework ensure that firms have robust risk management frameworks for managing their relationships with third-party providers. It will significantly impact the industry as FMIs are encouraged to review their third-party software portfolio. Firms must identify business-critical services and test software for potential risks using risk assessment tools or an independent specialist.

Related Facts

• Technology escrow involves storing software code with an independent third party if the software supplier goes out of business or fails to maintain the software’s functionality.
• The financial services industry is especially vulnerable to supply chain attacks, where attackers target vulnerabilities in the supply chain to gain access to sensitive data or disrupt business operations.
• The BoE’s regulatory framework is one of several recent initiatives to improve cybersecurity in the financial industry, including the EU’s NIS directive and the U.S.’s Cybersecurity Information Sharing Act.

Key Takeaway

The financial industry needs technology escrow to mitigate third-party risks. The BoE’s new regulatory framework on FMI outsourcing and third-party risk management is a step towards greater regulation of the sector’s outsourcing practices. Financial organizations must prioritize business resilience and have plans in place for managing third-party relationships.

Conclusion

The financial industry’s move towards greater regulation of outsourcing practices is welcome. It highlights the need to prioritize business resilience and ensure that organizations and service providers have plans for managing third-party relationships. Moreover, the BoE’s new regulatory framework indicates that technology escrow is no longer just a recommended practice but a necessary one. As the industry grapples with digital threats, technology escrow will increasingly become essential to protect businesses from supplier failure, service deterioration, and concentration risk.