Information access when FMIs rely on third-party providers

CPMI and IOSCO · Discussion paper response ·

Proposes how a financial market infrastructure (FMI) can test that its right to information from a critical third-party provider works in an incident, and how that right holds up under stress: a service-specific schedule of records with three deadlines; retrieval drills, including drills run while the provider’s normal support channel is unavailable; and four further contract terms, covering preservation of records, delivery during a fee or liability dispute, subcontractors, and access that survives termination and the provider’s insolvency.

Read the response (PDF, 5 pages)

The document

Title
Information an FMI can use in an incident
Discussion paper
FMIs’ reliance on third-party service providers: challenges and risks, CPMI and IOSCO, September 2026
Questions answered
Q1, Q2 and Q5: whether the paper’s challenges are accurate and complete, possible solutions, and further contractual aspects
Capacity
Personal capacity. As founder of True Primary, he declares its commercial interest in the safe adoption of agentic payments (paragraph 15)
Submitted
, by email to the CPMI and IOSCO Secretariats
Length
5 pages, numbered paragraphs 1 to 15
Confidentiality
None. “No part is confidential. It may be published in full, with my name.”

The four proposals

  1. Test that the information right works. The PFMI already call for timely access to all necessary information. A review of each critical contract should check three things separately: the right, the provider’s ability to deliver the records, and the FMI’s ability to use them before its decision falls due.
  2. A service-specific information schedule. For each critical service, the FMI and its provider agree which records are needed, who holds them, their form and route, and three deadlines: acknowledgement, first usable records and a full account.
  3. Retrieval drills. Exercises test retrieval through the agreed route, through subcontractors and while the provider’s normal support channel is unavailable. A shared exercise can stand in for one per client where it tests the same service and deadlines.
  4. Four further contract terms. Preservation of records on notice of an incident; delivery that continues through a fee or liability dispute; access duties that can be enforced down the subcontracting chain; and access that survives termination and the provider’s insolvency.

The starting point: explanatory note 3.17.20 of the PFMI already asks for timely access to all necessary information. The response proposes specifying the evidence that shows the right can be exercised: the FMI should identify the record holder, the contractual route to that holder and the means of obtaining an intelligible copy, then test that route under disruption. The schedule, deadlines and drills are practices an FMI can adopt under the PFMI as they stand.

Deadlines derived from the FMI’s decisions

The FMI should derive each deadline from the decisions it must make to continue or resume its critical services. Principle 17 expects critical IT systems to “resume operations within two hours following disruptive events”, and the CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures asks FMIs to “exercise judgment in effecting resumption so that risks to itself or its ecosystem do not thereby escalate”. The FMI should identify which provider records that judgement needs inside the two hours, and hold its own copy of any it cannot rely on receiving in time, where lawful, technically practicable and proportionate to the service’s criticality. The full account of the incident can follow later.

The response considers a hypothetical payment system that uses an external messaging service. After an interruption, a participant and the system hold different accounts of whether an instruction was delivered, and a service-availability report does not settle that question. The agreed record should identify the instruction, its receipt time, delivery status, acknowledgement and any retry, and the test should establish whether these records can be reconciled with the system’s own records before it decides how to resume processing. The list fits this service; other services need their own.

Shared dependencies and repeated refusals

To expose shared dependencies, each FMI should record the legal entity supplying each critical component and its role in the service, and check whether two direct suppliers depend on the same subcontractor. Section 3.4 of the FSB toolkit suggests identifying each provider by a unique identifier such as its Legal Entity Identifier; the response applies the same practice here. The FMI should supply this information to its relevant authorities through agreed confidential channels. Authorities can then match submissions within their own jurisdiction; matching across jurisdictions depends on cooperation between authorities and on legal gateways for sharing the data.

Where a provider offers only pre-set terms, the FMI should record the gap and raise it with its relevant authority in ordinary oversight, so that a refusal repeated across several FMIs becomes visible to authorities.

Sources