Regulated processes: outsource the work, keep the duty

Key takeaways

Outsourcing regulated activities is allowed in most UK sectors, but the regulated firm keeps the legal responsibility. FCA-regulated firms remain fully responsible for outsourced functions under SYSC 8. CQC-registered providers remain responsible for the care they deliver. Firms under the Money Laundering Regulations stay liable for their due diligence. Outsource the work; keep the duty and the oversight.

• The regulated firm keeps responsibility, always.
• Outsource preparation and admin; keep sign-off.
• Tell your regulator where rules require it.
• Keep the right to audit the provider.

Can regulated firms outsource processes?

Yes. UK regulators generally accept outsourcing, provided the firm keeps responsibility, oversight and the ability to give the regulator access. SYSC 8 says an FCA-regulated firm must not outsource in a way that impairs its internal controls or the FCA's ability to monitor it. The same principle, outsource the work but keep control, runs through most sector rules.

• Which business processes should you outsource?
• Admin outsourcing for mortgage brokers
• A simple BPO governance model

Which stages of a regulated process can move?

The preparation and admin stages usually move safely, while the regulated judgement and sign-off stay. In an accountancy practice, document collection for AML checks can move; the risk assessment and acceptance decision stay. In a care provider, rota admin and records upkeep can move; care decisions stay. In a broker, renewal admin can move; advice stays.

• Move: document collection, data entry, chasing, records upkeep.
• Keep: risk decisions, advice, sign-off, regulatory filings.
• Split: drafting moves, review and approval stay.

• AML check admin: client due diligence without a backlog
• Insurance renewal admin for brokers: start earlier
• Care provider admin: what can be outsourced?

What should the contract include for regulated work?

Beyond normal terms, include the regulator's right of access, your right to audit, notification of any incident affecting the regulated activity, continuity arrangements, and an exit plan that returns records in usable form. Record the outsourcing in your own compliance file, and check whether your regulator requires notice before you outsource a critical function.

• BPO contract terms to check before signing
• An outsourcing risk register for each process

When should regulated processes stay in-house?

When the stage requires a qualified or approved person, when the regulator or a customer contract forbids it, or when you cannot oversee the provider properly. If you cannot explain to a regulator how you check the outsourced work, it is not ready to move.

• When not to outsource
• Processes with sensitive data: can they be outsourced?

What does this look like in practice?

A pattern we see: regulated firms assume nothing can move, then find that half the hours in a regulated process are admin around the regulated decision. Moving that admin frees qualified staff for the work only they can do.

• See client work
• BPO Solutions for UK businesses

Regulated outsourcing checklist

Confirm these before moving any stage.

• Identify which stages are regulated decisions.
• Keep sign-off with an authorised person.
• Include regulator access and audit rights.
• Check notification requirements.
• Record the arrangement in your compliance file.
• Review the provider at least annually.

• Process criticality: rate the damage if it fails
• Compliance monitoring: owners, evidence and early warnings

Next step

Tell us your sector and the regulated process you are looking at. We will tell you which stages we would expect to move and which should stay with your authorised people.