A critical third party (CTP) is a company, such as a cloud provider, that supplies services to UK financial firms on a scale where its failure could threaten the stability of the financial system. HM Treasury designates CTPs, and the Bank of England, the PRA and the FCA jointly oversee them.
The regime sits in Part XVIII, Chapter 3C of the Financial Services and Markets Act 2000, and came into force on 1 January 2025. It exists because many firms rely on the same few providers, so one failure could hit many firms and market infrastructures at once.
The first designations
On 10 July 2026, HM Treasury designated its first four CTPs, and oversight began on 13 July 2026, according to the Bank of England:
| Designated provider | Entity named |
|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL |
| Google Cloud | Google Cloud EMEA Limited |
| Microsoft | Microsoft Ireland Operations Limited |
| Oracle | Oracle Corporation UK Limited |
What changes, and what doesn't
| The regulators can | Your firm still has to |
|---|---|
| Make rules for CTPs and gather information from them | Do its own due diligence on each provider |
| Expect CTPs to manage risks to their critical services and communicate openly during major incidents | Manage its own third-party arrangements, including contingency and exit planning |
| Take enforcement action against CTPs in connection with their systemic services | Map which services and Regions each important business service depends on, and test recovery |
The Bank of England states that the regime "complements, but does not replace, existing outsourcing and operational resilience rules", and that designation "is not the same as authorisation by the regulators". It is not a judgement on a provider's quality or security either. On AWS, the shared responsibility model still decides which parts of resilience are yours.
A related date for firms: the FCA's new operational incident and third-party reporting rules, published as PS26/2, take effect on 18 March 2027. The EU's equivalent oversight of critical ICT providers sits under DORA.
For how this fits your impact tolerances, see FCA operational resilience and The FCA's Frontier AI Warning. Mapping your dependencies on AWS and proving recovery is part of a Yemberzal Disaster Recovery Assessment.
