Equifax Limited
FCA enforcement action, 2023
What failed
Outsourced data processing suffered a major breach with weak oversight of the outsourced provider.
Read the final noticeTurn this case into work
These actions save into your workspace. The first click creates a free, anonymous workspace for you; nothing is created until then.
Log an incident from this case
Start an incident record pre-linked to this enforcement case as its source.
Log an incidentCreate a control change
Adds the control to your workspace if it isn't already there, then opens a pre-filled change proposal referencing this case.
Add to a product risk assessment
Start a PRA with 7 risk-theme typologies pre-selected.
Go to product risk assessmentCreate a follow-up action
The controls that would have caught it
These controls map directly to this failure. Open any one in the Control Builder to set your own thresholds, owners and systems, then export an implementation-ready spec.
In short, the firm needed
- Outsourcing and third-party risk due diligence
- Data-security controls and breach monitoring
- Governance over incident handling and customer treatment
Outsourcing & Third-Party Oversight
PreventiveGovernance & Reporting
When financial crime work is outsourced or done by a partner, the firm still owns the risk, so it must check, oversee and be able to evidence the provider is doing the job.
- Starting threshold:
- 100% of outsourced financial crime activities recorded in the register with completed pre-engagement due diligence; SLAs, audit rights and incident-notification clauses contractually in place; provider performance reviewed at least quarterly and assurance performed at a risk-based cadence; material providers re-assessed annually and on any sub-outsourcing change.
- First-line owner:
- Outsourcing / vendor relationship owner in the business
Typologies behind this case
Related enforcement cases
Next steps
Enforcement data is sourced from the FCA fines dataset. The control mapping is an analyst view of what would have addressed the failings described in the public notice, not a statement of the regulator's findings.