meta_id 3315644

On July 10, 2026, the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) announced they will begin jointly overseeing the first critical third parties (CTPs) on July 13, 2026, following designation by HM Treasury (HMT). HMT has designated four global cloud services and technology providers as CTPs: Amazon Web Services EMEA SARL; Google Cloud EMEA Limited; Microsoft Ireland Operations Ltd; and Oracle Corporation UK Limited. CTPs are technology and other service providers whose services underpin the UK financial system. As many firms rely on these services, disruption or failure could affect multiple firms or markets simultaneously, potentially affecting UK financial stability and services used by millions of consumers and businesses. The three regulators will jointly oversee these CTPs under a new, proportionate regime focused on the resilience of critical services provided to the UK financial sector. The regime complements, but does not replace, existing outsourcing and operational resilience rules for regulated firms, which remain responsible for managing their own third-party arrangements including due diligence, risk management and contingency planning. CTPs must identify and manage risks to their critical services effectively and maintain open, timely communication with regulators and reliant firms, particularly during major incidents. The Critical Third Parties (Designation) Regulations 2026 will come into effect on July 13, 2026. HMT retains responsibility for designating and de-designating CTPs, while the regulators will periodically review whether CTPs continue meeting designation criteria and make recommendations to HMT. The regulators will continue working closely with HMT, the financial services industry and designated CTPs as the regime is implemented. The regulators have signed a memorandum of understanding with EU regulators to support coordination and information sharing on CTP oversight.