Harper James advises financial services businesses on commercial contracts and FCA regulatory requirements under the laws of England and Wales. A well-drafted agreement does more than allocate commercial risk. It sets out how the parties will evidence compliance, respond to regulatory enquiries and maintain services when circumstances change.
Start by identifying each party’s regulatory status, permissions and responsibilities. The agreement should cover financial promotions, customer communications, record keeping, complaints, data protection and cooperation with the FCA, PRA or other relevant bodies. Recent regulatory focus on the Consumer Duty means firms also need clear processes for monitoring customer outcomes, sharing management information and correcting poor outcomes. These obligations should appear in service descriptions, reporting schedules and governance provisions, not only in background policies.
Outsourcing clauses need to reflect current expectations around third-party risk and operational resilience. Include service levels, audit and information-access rights, incident notification, business continuity testing, subcontracting controls and assistance with regulatory reviews. Termination provisions should provide a workable exit plan, including data return, migration support and continued access to records. Practical regulatory guidance can help boards and contract owners compare these provisions against the firm’s risk framework.
Regulated agreements should explain what happens when legislation, FCA rules, a permission or the firm’s business model changes. A structured change-control process can allocate costs, set implementation dates and prevent informal changes to regulated services. Keep approval records, due diligence, risk assessments, training evidence and performance reports in a form that supports internal audit and supervisory enquiries. The legal team, compliance function and operational owners should review these records together before signature and throughout the relationship.
A useful review sequence is: map the regulated activity, identify the accountable senior owner, test the agreement against outsourcing and resilience requirements, then run a realistic incident or exit exercise. This exposes gaps that a clause-by-clause review often misses, particularly around notification times, access to information and responsibility for customer communications. Regular reviews are appropriate after regulatory change, a material service change, a serious incident or the appointment of a new supplier.