Why regulators keep returning to this area

It is where the approval and the activity separate.

Third party arrangements attract sustained regulatory attention across sectors for a structural reason: they are the mechanism by which an approval granted to one party can end up governing activity conducted by another who was never assessed.

Where that separation is well managed it is unremarkable and useful. Where it is not, it produces the pattern regulators are actually concerned with, in which an approval effectively becomes a tradeable asset and oversight becomes nominal.

The distinguishing feature between the two is not the contract but whether the principal can demonstrate ongoing knowledge of what is happening. That is what is examined, and it is evidenced by monitoring records rather than by agreements.

This is worth understanding because it explains what an assessment will ask for. Not whether an agreement exists, but what the principal did in response to what it found, and what it would have found had it looked.

Requirements differ substantially between jurisdictions and sectors, and some frameworks require notification or approval of arrangements before they commence. Those should be established directly from the applicable rules.