Context
The Bank of England (the Bank), the PRA and the FCA started overseeing the first critical third parties (CTPs) on Monday 13 July 2026, following designation by the Treasury. CTPs are technology and other service providers whose services underpin the UK financial system. The Treasury has announced its first designations of four global cloud services and technology providers:
- Amazon Web Services EMEA SARL.
- Google Cloud EMEA Limited.
- Microsoft Ireland Operations Ltd.
- Oracle Corporation UK Limited.
Key points to note and next actions
- CTPs must identify and manage risks to their critical services effectively, and maintain open, timely communication with regulators and the firms that rely on them, particularly during major incidents.
- The FCA has, in a new web page, set out why CTPs matter, summarised the new oversight regime, explained what the regime means for CTPs, and explained how CTPs are ‘designated’.
