UK Regulators Begin Overseeing Critical Technology Providers to Finance

The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority have begun overseeing the first Critical Third Parties under a new regime that took effect in mid-July, following designation by HM Treasury. Critical Third Parties are technology and other service providers, such as major cloud and infrastructure firms, whose services underpin the smooth functioning of the UK financial system. The regime is designed to strengthen the resilience of these essential providers, recognising that a severe outage or cyber incident at a widely used supplier could ripple across many banks, insurers and market participants at once. Importantly, designation is not the same as authorisation, and oversight is limited to the resilience of the services the providers deliver to UK financial firms rather than their broader business. HM Treasury decides which suppliers fall within scope, generally based on recommendations from the regulators, and the roster is expected to evolve as further designations are considered. The move comes as authorities intensify their focus on operational and cyber resilience, with cyberattacks recently ranked among the top systemic risks by financial firms. Regulators say they will continue working closely with industry and designated providers while supporting innovation and competitiveness.