The due-diligence checklist,
straight from the Standard.
Joint Standard 1 was published by the Prudential Authority and FSCA on 17 May 2024 and came into operation on 1 December 2024. Pre-existing arrangements must comply within 24 months — by 1 December 2026 — or on first renewal, whichever comes first. This page lists what the Standard actually asks you to establish and keep evidencing, section by section. Print it, or work through it against your outsourcing register.
s 5.3 — before you contract
A due-diligence assessment exists for every outsourced activity, performed before the arrangement was entered into.
The depth of each assessment is appropriate to the nature and materiality of what is outsourced.
s 7.4 — the business case
For material functions: a documented assessment that the benefits outweigh the costs and risks.
Conflicts of interest around the arrangement are identified and managed.
s 7.5 — the eight things to establish about the provider
Governance, risk management and internal controls appropriate to the function.
The ability to comply with all laws that apply to the function (including POPIA and FIC obligations where relevant).
Operational capability: capacity, systems and skilled people at the agreed service levels.
Adequate financial resources to perform reliably for the duration of the arrangement.
Appropriate contingency plans covering the outsourced function.
Key persons meet fit-and-proper requirements (per Prudential Standard GOI 4).
Where required: licences, authorisations or registrations are held and current.
Sub-outsourcing is disclosed, and responsibility for it is contractually retained.
s 10.4 — the standing obligation
Material-function providers are re-assessed regularly on governance/controls, legal compliance, operational and financial capability, and contingency plans.
A re-assessment calendar exists and evidence of each cycle is retained.
Evidence documents (licences, insurance, certifications) are tracked for expiry between cycles.
s 11.3 — the clock
Every arrangement that existed before 1 December 2024 has been identified.
Each has been brought into compliance — the 24-month period ends 1 December 2026, or sooner on renewal or renegotiation.
Scope note: the section 7.5 and 10.4 obligations attach to
material outsourced functions; section 5.3's due-diligence duty applies to every
outsourced activity, proportionate to its materiality. This checklist paraphrases the
Standard for working use — the
official text
governs.