{
  "created_by": "OI",
  "purpose": "Authoritative source set for outsourcing / third-party oversight in banking and finance for an Italian bank operating in the UK.",
  "sources": [
    {
      "id": "pra-ss2-21-2026",
      "regulator": "PRA / Bank of England",
      "title": "SS2/21 Outsourcing and third party risk management - March 2026 update",
      "url": "https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2026/ss221-march-2026-update.pdf",
      "path": "uk/pra-ss2-21-outsourcing-third-party-risk-management-march-2026-update.pdf",
      "type": "Supervisory Statement"
    },
    {
      "id": "pra-ss2-21-landing",
      "regulator": "PRA / Bank of England",
      "title": "SS2/21 landing page",
      "url": "https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss",
      "path": "uk/pra-ss2-21-landing.html",
      "type": "Landing page"
    },
    {
      "id": "boe-pra-fca-ps16-24",
      "regulator": "Bank of England / PRA / FCA",
      "title": "PS16/24 Operational resilience: Critical third parties to the UK financial sector",
      "url": "https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps16-24-operational-resilience-critical-third-parties-to-the-uk-financial-sector.pdf",
      "path": "uk/boe-pra-fca-ps16-24-critical-third-parties.pdf",
      "type": "Policy Statement"
    },
    {
      "id": "ps16-24-app1",
      "regulator": "PRA / Bank of England",
      "title": "PS16/24 Appendix 1 - PRA Critical Third Parties Instrument / rules",
      "url": "https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app1.pdf",
      "path": "uk/pra-ps16-24-appendix-1-critical-third-parties-rules.pdf",
      "type": "Rules / Instrument appendix"
    },
    {
      "id": "ps16-24-app3",
      "regulator": "Bank of England / PRA",
      "title": "PS16/24 Appendix 3 - Supervisory Statement / Statement of Policy material",
      "url": "https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app3.pdf",
      "path": "uk/boe-pra-ps16-24-appendix-3-supervisory-material.pdf",
      "type": "Supervisory / policy appendix"
    },
    {
      "id": "fca-fg16-5",
      "regulator": "FCA",
      "title": "FG16/5 Guidance for firms outsourcing to the cloud and other third-party IT services",
      "url": "https://www.fca.org.uk/publication/finalised-guidance/fg16-5.pdf",
      "path": "uk/fca-fg16-5-cloud-other-third-party-it-services.pdf",
      "type": "Finalised Guidance"
    },
    {
      "id": "fca-sysc8",
      "regulator": "FCA",
      "title": "FCA Handbook SYSC 8 Outsourcing",
      "url": "https://www.handbook.fca.org.uk/handbook/SYSC/8/",
      "path": "uk/fca-handbook-sysc-8-outsourcing.html",
      "type": "Handbook rules/guidance"
    },
    {
      "id": "fca-sysc15a",
      "regulator": "FCA",
      "title": "FCA Handbook SYSC 15A Operational resilience",
      "url": "https://www.handbook.fca.org.uk/handbook/SYSC/15A/",
      "path": "uk/fca-handbook-sysc-15a-operational-resilience.html",
      "type": "Handbook rules/guidance"
    },
    {
      "id": "fca-ctps",
      "regulator": "FCA",
      "title": "FCA Handbook CTPS Critical Third Parties sourcebook",
      "url": "https://www.handbook.fca.org.uk/handbook/CTPS/",
      "path": "uk/fca-handbook-ctps-critical-third-parties.html",
      "type": "Handbook rules/guidance"
    },
    {
      "id": "eba-gl-2019-02",
      "regulator": "EBA",
      "title": "EBA Guidelines on outsourcing arrangements EBA/GL/2019/02",
      "url": "https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf",
      "path": "eu/eba-gl-2019-02-guidelines-on-outsourcing-arrangements.pdf",
      "type": "Guidelines"
    },
    {
      "id": "dora-regulation-2022-2554",
      "regulator": "EU",
      "title": "Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554",
      "path": "eu/regulation-eu-2022-2554-dora.pdf",
      "type": "EU Regulation"
    },
    {
      "id": "eba-gl-2019-04",
      "regulator": "EBA",
      "title": "EBA Guidelines on ICT and security risk management EBA/GL/2019/04",
      "url": "https://www.eba.europa.eu/sites/default/files/document_library/Publications/Guidelines/2020/GLs%20on%20ICT%20and%20security%20risk%20management/872936/Final%20draft%20Guidelines%20on%20ICT%20and%20security%20risk%20management.pdf",
      "path": "eu/eba-gl-2019-04-ict-security-risk-management.pdf",
      "type": "Guidelines"
    },
    {
      "id": "bdi-circ-285-51",
      "regulator": "Bank of Italy",
      "title": "Circolare n. 285 del 17 dicembre 2013 - Testo integrale al 51° aggiornamento, 3 febbraio 2026",
      "url": "https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/aggiornamenti/Circ-285-Testo-integrale-al-51-aggto.pdf",
      "path": "italy/bank-of-italy-circular-285-51-update-full-text.pdf",
      "type": "Supervisory provisions for banks"
    },
    {
      "id": "bdi-circ-285-landing",
      "regulator": "Bank of Italy",
      "title": "Circolare n. 285 landing page",
      "url": "https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/index.html",
      "path": "italy/bank-of-italy-circular-285-landing.html",
      "type": "Landing page"
    }
  ]
}