Meeting the Financial Conduct Authority’s requirements on outsourcing to cloud computing providers could prove difficult for some firms, according to Rob Walton.
The chief operating officer of Intelliflo was speaking after the FCA yesterday (7 July) published its guidance on how financial advisers should outsource to cloud computing providers.
The FCA said firms using cloud services and other third-party IT providers must have a clear and documented business case or rationale if using them for “critical or important operational functions or material outsourcing”, as well as carrying out a risk assessment.
But some aspects of the rules have been criticised, with some claiming they are too burdensome and onerous such as the requirement that firms must have physical access to a provider’s data centres.
Mr Walton said the requirements could create difficulties for firms but said a provider’s ability to help an adviser meet them could become a big selling point.
He said: “At Intelliflo we see the guidance provided by the FCA to be a big step forward and welcome many of the aspects detailed, especially around the keys areas that a regulated firm should consider when selecting an outsourcing technology provider.
“It is pleasing to see that many of the checks and controls we have built in to the Intelliflo service platform are listed as key areas of consideration by the regulator.
“However, we do also recognise the overhead and difficulty this can create for regulated firms when looking to achieve the sentiment set out in this guidance; but it is our expectation that the ability of technology service providers to help their clients to easily evidence the necessary assurance and assessment of incurred risks will become a key aspect of providing services to FCA regulated firms and will ultimately become a competitive advantage for those technology firms that embrace the framework of this guidance in an effective and transparent way.”
Following some criticism the FCA made changes to its guidance, for example it initially required that firms should identify all service providers in the supply chain, and make sure the firm’s requirements can be complied with throughout the chain
But in its final guidance the FCA restricted the requirement to identifying service providers to those services in the supply chain relating to regulated activity only.
Yvonne Dunn, partner at law firm Pinsent Masons, questioned whether some of the changes the FCA had made would actually benefit financial services firms.
Ms Dunn said one area where the guidance is less clear is on how firms meet their regulatory obligations when outsourcing in ensuring they, their auditors and regulators have “effective access to data” as well as to “the business premises of the service provider”.
