GB
.png)
In Part 1 of the series, we explored the foundations of the UK outsourcing regime: who it applies to, how outsourcing is defined under the EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) (the "Guidelines"), and why it matters to determine whether the arrangement supports a critical or important function of relevant regulated entities.
We now move into the contractual phase; exploring in more detail what the Guidelines say about the outsourcing agreement itself. For fintech companies, understanding outsourcing regulation in the UK is a key part of building compliant, scalable infrastructure and meeting ongoing FCA compliance obligations for regulated fintech businesses. Strong fintech outsourcing agreements play a critical role in ensuring both regulatory compliance and operational resilience.
The starting point under the Guidelines is straightforward but important: outsourcing agreements must be in writing. This isn’t just a box-ticking exercise, it’s the foundation on which the entire regulatory framework for oversight and accountability is built. An arrangement that isn’t properly documented can’t be effectively supervised, and a regulated entity that can’t point to a clear, complete written contract won’t be able to demonstrate compliance, particularly in the context of FCA expectations for UK regulated fintechs.
For arrangements classified as supporting critical or important functions of a regulated entity, the requirements go further. Paragraphs 74–75 of the Guidelines set out the minimum content that every such outsourcing agreement must include. That said, as a matter of best practice, all outsourcing agreements, regardless of classification, should include these core provisions addressed below.
At its core, the regulator’s message is simple: your outsourcing contract needs to be clear, robust, detailed and workable in practice, particularly where it underpins the financial institution’s services infrastructure such as payments infrastructure, onboarding and KYC services, or core cloud outsourcing.
In this post, we focus on a core subset of those mandatory provisions that go to the structural foundations of the outsourcing arrangement and, more importantly, what they mean in practice for both regulated entities (as service recipients) and service providers supporting fintech businesses. Later instalments in the series will cover the remaining mandatory provisions, including audit rights, sub-outsourcing, data protection and business continuity, all of which are central to fintech regulatory compliance in the UK.
At a minimum, outsourcing agreements for critical or important functions must clearly set out:
None of these concepts are inherently complex. The regulatory expectation, however, isn’t just that these provisions exist, it’s that they’re drafted in a way that enables real oversight and control by the service recipient, and clear accountability for the service provider. A clause that technically “ticks the box” but doesn’t work in practice is unlikely to meet the spirit of the Guidelines.
For regulated entities, the value of these provisions lies in the certainty and control they provide. Each requirement reflects a specific regulatory concern and understanding that concern is what allows regulated entities to push for appropriate protections during negotiation, rather than accepting drafting that works in theory but not in practice. For many, this is where working with a fintech law firm or seeking specialist fintech legal support becomes critical to ensuring outsourcing agreements meet both regulatory expectations and commercial needs.
The services description is, in many ways, the contractual foundation of the entire arrangement. It needs to clearly set out what is being outsourced, how it will be delivered, and what the regulated entity is entitled to receive.
In other words, vague or high-level descriptions lifted from marketing materials probably won’t cut it. Where the function is critical or important, the regulated entity needs to be able to show its regulator exactly what has been outsourced and on what terms.
In practice, this often means detailed schedules or statements of work, and making sure any changes to scope go through a formal variation process rather than being agreed informally.
Term and notice provisions aren’t just about commercial convenience. From a regulatory perspective, they determine whether a regulated entity can exit an arrangement and how easily it can do so.
Termination rights are treated as a core safeguard under the Guidelines. Notice periods need to reflect operational reality, the importance of the service, and how easily the provider can be replaced.
Regulated entities should ensure notice periods are realistic, termination triggers are clearly defined, and the agreement doesn’t create an unintended lock-in. This links directly to exit planning and business continuity, which we’ll cover later in the series.
Governing law is often treated as boilerplate, but it really shouldn’t be. It affects enforceability, interpretation, and the practical ability of both the regulated entity and its regulator to exercise their rights.
A common misconception is that the Guidelines require a specific governing law. They don’t. The only requirement is that it’s clearly specified. That means regulated entities can choose the law that best supports enforceability, audit rights and oversight mechanisms.
If the provider’s preferred law creates gaps, pushing for a different option isn’t just commercial preference, it’s sensible risk management.
The financial provisions should give the regulated entity a clear picture of the total cost of the arrangement. That includes core fees, variable charges, pricing adjustments and exit costs.
A common issue in practice is pricing that looks simple upfront but hides complexity or discretion. The Guidelines aim to ensure that cost exposure is transparent and manageable.
The agreement needs to specify where services are performed and where data is stored and processed and those aren’t always the same thing. Location matters because it affects regulatory oversight and triggers obligations under UK GDPR and, where relevant, EU GDPR.
Regulated entities should expect full transparency across service and data locations, including sub-processing, and ensure there’s a mechanism to notify them of any changes. For certain changes, especially outside the UK or EU, prior approval may be appropriate but is not strictly speaking required under the Guidelines.
A common pitfall is overly broad location clauses that give providers too much flexibility without oversight, creating a gap between regulatory expectations and reality.
Service levels are arguably the most operationally important provisions. The Guidelines require measurable performance targets, alongside mechanisms for monitoring and correcting underperformance.
This means general commitments like “reasonable endeavours” may not be enough. Regulated entities are expected to define measurable standards, receive structured reporting, and have clear escalation and remediation processes.
If performance can’t be measured, it can’t be managed and from a regulatory perspective, that’s a problem.
Service providers aren’t directly subject to the Guidelines. However, as discussed in Part 1, those obligations are effectively passed down through contracts.
That said, understanding where requirements are genuinely regulatory and where there’s room to negotiate is key.
For provisions like services, term, governing law and financials, most providers will already have these in their standard contracts. The requirement isn’t about a specific format, it’s about clarity.
This leaves room to negotiate how those provisions are structured and drafted.
On governing law, for example, the Guidelines don’t mandate a specific choice. Providers can propose their preferred law and push back where there’s no regulatory reason to change it.
Similarly, flexible pricing structures are still possible, as long as they’re transparent.
Providers will want to retain operational flexibility, especially if they operate globally.
A balanced approach is to agree an initial set of locations, allow changes within that scope, and limit approval rights to material changes such as moving to new jurisdictions. A structured notice period can often meet regulatory expectations without restricting operations.
Service levels are where negotiation can get tricky. Regulators expect meaningful standards, but overcommitting can create risk.
The goal is to agree a framework that supports monitoring and remediation, while staying grounded in what can realistically be delivered.
That usually means clear, achievable metrics, proportionate escalation processes, and carefully drafted obligations that reflect real-world constraints.
The aim isn’t to avoid accountability, it’s to make sure it’s fair and workable.
The provisions covered in this post form the structural backbone of the outsourcing contract. Get them right, and everything else has a solid foundation. Get them wrong, and issues tend to snowball as the arrangement evolves.
It’s also worth noting that regulatory requirements and commercial interests aren’t pulling in opposite directions here. A regulated entity asking for clear services, realistic termination rights and measurable SLAs isn’t being difficult, it’s asking for what any well-advised counterparty should want anyway.
And a service provider that understands this is in a much better position to engage constructively, rather than treating every regulatory requirement as a concession.
In the next parts, we’ll move into areas where the regulatory overlay is more visible and where negotiations tend to get sharper: audit rights, regulatory access, and sub-outsourcing controls. These are often the most debated clauses, and where a detailed understanding of the framework really pays off.
Are you a scaling fintech looking for legal support? Drop us a line: [email protected]
