UK Regulators Begin Overseeing Critical Third-Party Tech Providers

The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority have begun overseeing the first Critical Third Parties under a new regime that took effect on 13 July 2026, following designation by HM Treasury. Critical Third Parties are technology and other service providers, such as major cloud and infrastructure firms, whose services underpin the UK financial system and whose failure could threaten its stability. Under the regime, regulators can set resilience requirements and monitor how these providers deliver services to banks, insurers and other financial firms, aiming to reduce the risk that an outage or cyberattack at a single supplier cascades across the sector. HM Treasury is responsible for deciding which suppliers fall within scope, generally based on recommendations from the regulators, and officials stressed that the list of designated entities will continue to evolve as further providers are considered. Importantly, designation under the regime is not the same as full authorisation; oversight is limited to the resilience of the services provided to UK financial firms. The framework reflects growing concern about the sector's reliance on a small number of major technology suppliers, a theme regulators have flagged repeatedly amid rising cyber and operational risks.