The critical third parties regime is the UK framework, created by the Financial Services and Markets Act 2023 and the FCA, PRA and Bank of England rules that took effect on 1 January 2025, under which HM Treasury designates third-party providers whose failure could threaten the stability of, or confidence in, the UK financial system, and the three regulators then jointly oversee those providers' systemic services. The first four designations came into force on 13 July 2026, all of them cloud providers. The regime does not move any responsibility away from banks: each remains accountable for staying within its impact tolerances whoever its suppliers are. And the concentration a bank is most likely to miss is not a regulator's designation but a bank's own discovery that two "independent" suppliers run on the same platform. Botminds' Operational Resilience Management is an agentic solution whose Third-party agent traces where each supplier hosts, so that shared failure points show up on the service map before a scenario test or an incident finds them.
The regime's facts are the regulators', linked where they appear. The worked example is the solution's fictional sample bank, Corvane Bank UK, and its two Faster Payments gateways; the suppliers named in it are fictional too.
Two independent gateways, one cloud region: the dependency the contracts did not show
What is the critical third parties regime?
It is a regime for overseeing the providers the whole financial sector depends on, not the suppliers of any one bank. The FCA describes critical third parties as "third party providers whose service disruption or failure could threaten the stability of, or confidence in, the UK financial system", which "may include technology, data and operational service providers of critical services to regulated firms and financial market infrastructures" (FCA, Critical Third Parties). FSMA 2023 gave the regulators and the Treasury powers over such providers, and the joint policy statement PS24/16, published on 12 November 2024, set the rules that apply to a provider once it is designated (FCA, PS24/16).
The critical third parties regime from consultation to the first designations
- Consultation to regime in effect391 days
- Regime in effect, no provider designated558 days
- Designated106 days
The oversight is targeted. The regulators' "targeted oversight prioritises the systemically important third-party services, not the entirety of CTPs' businesses", and may include "regulatory engagement, information gathering and resilience assessments focused on the systemic services" a provider offers the UK financial sector (FCA). One of the regime's stated aims is to "Encourage timely information sharing between CTPs and firms", which matters to a bank mainly as a better source of evidence for its own maps and tests.
Who is designated a critical third party?
As of October 2026, four providers, all designated on 13 July 2026: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited (FCA, Designated Critical Third Parties). "The Treasury decides whether to designate a third party as a CTP, based generally on recommendations from the regulators", may designate without a recommendation, and "can de-designate CTPs or designate new CTPs as markets evolve."
The list will be fed partly by banks' own data. From 18 March 2027 banks must notify the regulators of material third-party arrangements and submit an annual register of them, and the FCA says that information "will also inform our joint work with the PRA and the Bank of England to identify potential critical third parties" (FCA, reporting material third party arrangements). The 2027 reporting rules set out what those notifications contain.
Does the CTP regime cover my suppliers?
Only if your supplier is one of the designated providers, and then only for the services the regulators treat as systemic; everything else about your suppliers remains yours. The FCA is explicit that the regime does "Complement, not replace, firms' own responsibilities for managing third-party risks", and that it "does not change the accountability of firms, their boards and senior management for: Remaining operationally resilient" or for complying with outsourcing and operational resilience rules "when they rely on services provided by third parties" (FCA, operational resilience).
Most of a bank's material suppliers will never be designated: payment gateways, card processors, messaging providers, cash logistics firms, contact centres, software vendors. The sample bank has 38 material third parties behind its 11 services. Several of them host on cloud platforms, and some of those platforms may be designated; the regime oversees the platform's systemic service, not the bank's choice to put two suppliers on the same region of it.
Who is responsible if a supplier breaches impact tolerance?
The bank. The FCA's line is the plainest statement in the operational resilience rules.
If a third-party provider supporting or delivering your important business services fails to remain within impact tolerance, you should remember that the failure to remain within impact tolerance is your responsibility.
FCA, Operational resilience: insights and observations for firms, May 2024
The PRA says the same: "a firm will remain responsible if a third party provider on whom it relies, whether wholly or in part, to provide an important business service, fails to remain within impact tolerances or causes the firm to do so" (SS1/21, 5.7), and it expects firms to stay within tolerance "irrespective of whether or not they use third parties" (4.5). The FCA adds that where a supplier tests its own services, "The firm is ultimately responsible for the quality and accuracy of any testing carried out" (SYSC 15A.5.5G). A designated CTP failing does not change that sentence.
How do you find third-party concentration risk?
Trace each supplier on a service map to where it actually runs, and look for the places where different suppliers, or a supplier and its backup, meet. The rules point there. SYSC 15A asks firms setting tolerances to consider "the potential aggregate impact of disruptions to multiple important business services, in particular where such services rely on common operational resources as identified by the firm's mapping exercise" (SYSC 15A.2.7G(10)), and expects firms to understand the people, processes, technology, facilities and information "that support the provision by the third party of its services" (15A.4.2G).
Contracts and supplier questionnaires rarely show it, because each supplier answers for itself. The evidence is in hosting notices, assurance reports, subcontractor lists and change notifications, which arrive at different times and are read by different people. In the sample bank, the finding came from a supplier notice that the alternate gateway's operator had moved its hosting. The Third-party agent matched the new region against the hosting already recorded for the primary gateway, and the third-party risk manager confirmed it the same afternoon. The supplier view now shows "Hidden concentration: 1".
Third-party concentration risk, found on the supplier map
Where the sample bank's services concentrate: suppliers under four or more important services
Can two suppliers share the same cloud?
They can; nothing in the rules forbids it, and the question is whether the bank knows, and whether a scenario tests it. Two suppliers on the same platform are not a breach in themselves. They become one when the bank's recovery plan counts them as alternatives, as the sample bank's did: its failover from the primary gateway to the alternate assumed that the two could not fail together.
The FCA has drawn the lesson from recent events. After the July 2024 software outage it found that "some regulated firms affected by the outage also provided services that supported other regulated firms' important business services", which "increased the impact of the disruption", and that firms "that had conducted detailed mapping of third and nth party relationships were able to quickly understand exposure and take mitigating actions" (FCA, October 2024). In its March 2026 review it listed outages at cloud service providers among the 2025 events that were "severe" but "plausible scenarios firms should be considering in their testing" (FCA, March 2026).
What is fourth-party risk?
Fourth-party risk is the risk that comes from a supplier's own suppliers: the cloud a gateway runs on, the subcontractor a card processor uses for tokenisation. The UK rules call it sub-outsourcing. The PRA expects firms to "understand the reliance placed on sub-outsourcing arrangements and if these arrangements pose a threat to their operational resilience" (SS1/21, 5.6), and the FCA's 2026 review noted "more work to do on identifying, assessing and remediating third party vulnerabilities" (FCA, March 2026).
Six tracing questions for every material supplier on a service map
- Where does it host the service you use, by provider and region?
Ask for the region, not "the cloud"; record the source and its date.
- Which of its own suppliers could stop your service?
Its material subcontractors, and where they in turn run.
- Is its backup, or your alternative supplier, on the same platform?
The question that would have caught the sample bank's gateways.
- How will it tell you when any of that changes?
A notification clause with a time limit, and someone who reads the notices.
- Has its recovery been tested against your tolerance?
The PRA expects contracts to require both parties to test contingency plans that take account of your tolerances.
- When does its assurance evidence expire?
Evidence older than your age limit should flag the steps that rely on it.
What is an exit plan for a material supplier, and when does it help?
An exit plan sets out how the bank would move a service away from a supplier, in an orderly way or under stress, and it helps a resilience programme only if it is tested against the tolerance. The PRA, quoting its outsourcing statement SS2/21, wants business continuity and exit plans for material outsourcing to "where possible and relevant … align to, support, or even be a component of firms' scenario testing for operational resilience" (SS1/21, 6.13). After the July 2024 outage the FCA suggested firms "Review vendors' performance, service levels, contractual obligations, continuity arrangements and exit plans against your resilience requirements" (FCA, October 2024).
In the sample bank, 31 of 38 material suppliers have a tested exit plan, 5 have an untested one and 2 have none; one of the missing plans, for a messaging provider used to tell customers about disruptions, is overdue and was escalated to the SMF24. The gateway finding showed the limit of an exit plan on its own: the plan to switch to the alternate gateway existed, and was useless against a regional cloud failure. The fix the bank accepted, a warm standby gateway hosted away from the shared region, was chosen by re-testing each option on the same scenario.
Three fixes for the shared cloud, re-tested on the same clock
A US bank faces a different framework for the same problem: the federal banking agencies' 2023 guidance on third-party relationships, which a September 2026 proposal would replace and which stays the standard until a final version is issued, as interagency guidance on third-party relationships explains. To trace your own suppliers' hosting against your services, start from Operational Resilience Management; how to time a shared-supplier scenario follows the test that proved the breach.
Questions people ask
What is a critical third party in UK financial services?
A provider designated by HM Treasury because disruption to or failure of its services could threaten the stability of, or confidence in, the UK financial system. Once designated, its systemic services are overseen jointly by the FCA, the PRA and the Bank of England under rules in force since 1 January 2025.
Is there a list of critical third parties?
Yes. The FCA publishes the designated providers on its Critical Third Parties page. As of October 2026 it lists four, all designated on 13 July 2026: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited.
Does using a designated CTP reduce a bank's own obligations?
No. The FCA says the regime complements, and does not replace, firms' responsibilities for managing third-party risk, and does not change the accountability of firms, boards and senior management for remaining operationally resilient.
What is the difference between a critical third party and a material third party?
A critical third party is designated by the Treasury for the whole financial system. A material third-party arrangement is defined from one firm's point of view: one whose failure could cause intolerable harm to its clients, threaten the financial system, or put its regulatory obligations in doubt. From March 2027 banks must notify and register material arrangements.
Who regulates critical third parties in the UK?
The FCA, the PRA and the Bank of England jointly, under powers from the Financial Services and Markets Act 2023. HM Treasury makes the designations, generally on the regulators' recommendation.