Material outsourcing, the arrangements a regulator wants to hear about

Materiality is a judgement about consequence, not about contract value. The questions supervisors expect a firm to have answered are whether failure would disrupt a service to customers, breach a regulatory obligation, cause reputational damage the firm could not absorb, or make it hard to satisfy the conditions under which it is authorised. A cheap contract supporting a critical process is material; an expensive one supporting a convenience is not.

The determination is made per arrangement and recorded, because the classification drives everything that follows: the depth of due diligence, the terms the contract must contain, the resilience and exit expectations, and — importantly — the obligation to notify the regulator in advance of entering, and of significant changes to, a material arrangement.

Beyond notification: maintain a register of material arrangements; ensure the contract secures access, audit and information rights for the firm and its regulator; assess concentration and sub-outsourcing; define and test an exit plan that could actually be executed; and keep accountability inside the firm. The principle underneath all of it is the one regulators repeat: a firm can outsource a function, but not the responsibility for it.

For firms in scope of both UK rules and DORA, the vocabulary differs — material outsourcing under UK supervisory statements, ICT services supporting critical or important functions under DORA — but the substance overlaps heavily. Mapping the two classifications once, rather than maintaining two registers, is usually the cheaper route.