UK Designates Its First Four Critical Third Parties From July 13, 2026, Giving the Bank of England, PRA and FCA Power to Set Rules for Cloud and Technology Providers

The United Kingdom has begun directly supervising the technology companies that financial firms depend on most. HM Treasury announced on July 10, 2026 that four major global cloud and technology providers have been designated as critical third parties, known as CTPs, and the designations took effect on July 13, 2026. The details in this article come from two law-firm summaries, one by A&O Shearman and one by Morrison Foerster. Neither summary names the four providers or lists the specific services designated, and this article does not guess at them. The designation notices themselves, published by HM Treasury, were not reviewed.

What a critical third party is

Banks, insurers, asset managers and other regulated firms buy cloud computing and other technology services from outside suppliers. When a supplier fails, many customers can be affected at once. The CTP regime lets the authorities regulate a supplier directly, even though the supplier is not itself a regulated financial firm. The legal basis is the Financial Services and Markets Act 2023. The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority will jointly oversee the critical services the designated providers supply to the UK financial sector. According to A&O Shearman, the regime is intended to let the regulators gather information, assess resilience and, where necessary, make and enforce CTP-specific rules.

The rules that now apply

Morrison Foerster notes that the CTP rules took effect on January 1, 2025, but they apply only once an entity has been designated, which is why the July designations matter. Designated providers must meet operational resilience rules in several areas: governance and risk management, supply chain risk, cyber resilience, change management, and incident management and reporting. They must also meet six Fundamental Rules, which broadly mirror the principles the FCA applies to regulated firms. The summaries reviewed do not describe the content of incident reporting or testing requirements in detail, so readers who need them should consult the regulators' rulebooks.

Sanctions and the proportionality question

The regulators have powers to prohibit a CTP from entering new arrangements with authorised firms or from continuing to serve them, to impose conditions on its services, or to issue a public censure. They say they will take a proportionate approach. Morrison Foerster observes that what proportionate means in practice is unclear. That uncertainty is natural for a regime on its first day: it will be defined by how the regulators use their powers over time.

What the list is, and is not

The list of designated providers is not exhaustive. HM Treasury may designate more providers or withdraw existing designations, and the regulators are expected to review the position periodically, although there is no fixed cycle. Morrison Foerster also notes that a January 2026 report by the Treasury Committee recommended that HM Treasury designate major artificial intelligence and cloud providers as CTPs by the end of 2026, and it links the designations to concerns about cloud and AI providers. The UK regulators have also signed a memorandum of understanding with the European Supervisory Authorities to coordinate oversight of CTPs and the critical ICT third-party providers designated under the European Union's Digital Operational Resilience Act, known as DORA.

What financial firms still have to do

The designations do not move responsibility from financial firms to their suppliers. Both summaries stress that regulated firms remain responsible for managing their own third-party risk, including due diligence, risk management and contingency planning. The regime complements the existing outsourcing and operational resilience rules and does not replace them. One new dated obligation applies to firms: they must maintain registers of their material third-party arrangements and submit them annually, starting from March 18, 2027. The FCA has said this data will help it identify future CTP candidates, so a firm's register may influence which providers are designated next.

Why insurers and brokers should pay attention

Insurers and brokers use the same cloud platforms as banks. A designated provider that fails to deliver a critical service to the financial sector could disrupt policy administration, claims systems and customer portals across many firms simultaneously. The new regime does not guarantee that outages will not happen, and it does not change a firm's duty to plan for them. What it adds is a direct line of supervision of the supplier, which the firm's own contract could not provide. For smaller firms, the register requirement is the nearest practical step: knowing which suppliers support which important services is the basis for any contingency plan.

A worked illustration

Consider a hypothetical broker whose quoting, document storage and telephone systems all run on one cloud supplier. Under the new regime, if that supplier were designated, the regulators could set rules for how the supplier manages its resilience and incidents. The broker would still need its own plan for a day when the service is down, and from March 2027 it would need to record the arrangement in its register. This is an invented example for illustration and not a description of any particular firm or provider.

What the summaries leave open

Neither summary names the four providers, lists the designated services or says what the regulators plan to do first. Neither gives dates for the first supervisory reviews. Those details will matter to firms deciding how closely their own suppliers' conduct affects them.

Limits

This article relies on two law-firm summaries and not on the designation notices. It is general information, not legal or compliance advice.