HM Treasury Designates Four Critical Third Parties to the UK Financial System

On 10 July 2026, HM Treasury (HMT) published a press release announcing the designation of four major global cloud services and technology providers as critical third parties (CTPs), with effect from 13 July 2026. 

Background

The CTP regime was established through the Financial Services and Markets Act 2023 to strengthen the operational resilience of the UK financial system. It allows the Financial Conduct Authority, the Prudential Regulation Authority and the Bank of England (together, the Regulators) to directly oversee and enforce operational resilience on technology and service providers whose failure could threaten UK financial stability. 

The rules came into force on 1 January 2025, and apply to specific designated CTPs.

CTP designations

As banks, insurers and financial market infrastructures become increasingly reliant on cloud services, disruption at a single major supplier could affect multiple firms simultaneously, potentially impacting the services on which customers depend. The CTP designations are intended to guard against such systemic risk.

The designated firms are:

• Microsoft Ireland Operations Limited;
• Google Cloud EMEA Limited;
• Amazon Web Services EMEA SARL; and
• Oracle Corporation UK Limited.

The designations follow a period of evidence gathering and collaborative engagement with third parties. 

The CTP regime is the UK version of the oversight regime under the EU’s Digital Operational Resilience Act (DORA). To date, the European Supervisory Authorities have designated 19 critical third party service providers under DORA. For further information on such DORA designations, please see our previous article available here. 

Impact of designation

CTPs must comply with operational resilience rules in relation to the systemic services they provide to the UK financial sector. These rules are set, overseen and enforced by the Regulators.

CTPs will be subject to joint oversight by the Regulators. The Regulators can gather information, assess resilience, and work with the third parties to address risks to the continuity of critical services, including by making and enforcing CTP-specific rules where necessary. 

Notably, regulatory oversight applies only to the systemic services provided to the financial sector, not to the firms’ wider operations, and financial firms themselves remain responsible for managing risks arising from their third-party suppliers.

A rolling regime

HMT has stressed that it is taking a targeted, risk-based and proportionate approach to designation. There is no statutory limit on the number of CTPs that may be designated, and further providers may be brought into the regime over time where necessary. 

All four designated CTPs publicly welcomed the announcement, with each confirming its commitment to supporting the resilience of the UK financial sector. 

With the first CTP designations now in force, attention will turn to how the Regulators exercise their new powers going forward, and how far the regime is extended in the months ahead.

The press release is available here.