Community Trust ScoreVerified
The Bank of England, the PRA, and the FCA are now watching. Not just banks. Not just insurers. The third-party providers those firms lean on — cloud platforms, tech infrastructure companies, anyone essential enough to bring down chunks of the financial system if they stumble — are now formally in scope under a new UK oversight regime.
It’s a pretty significant shift. For years, UK financial regulation basically told individual firms: sort out your own resilience. Build your own recovery plans. Test your own systems. And firms did, more or less. But the problem is that dozens of banks, insurers, and payment companies all rely on the same handful of providers. If one of those providers goes down, the disruption doesn’t stay contained. It spreads. Fast.
Why the Old Model Wasn’t Enough
The financial sector’s dependence on shared infrastructure has grown sharply. Cloud computing, data services, technology platforms — these aren’t niche tools anymore. They’re basically the backbone of how financial services run day-to-day. And that concentration creates a specific kind of risk that firm-level rules can’t really address on their own.
Recent cyber incidents at major corporations made the problem hard to ignore. A single disruption hitting one widely-used provider can ripple outward in ways that no individual firm, however well-prepared, can fully absorb on its own. The regulators seem to have looked at that pattern and decided the system-level view was missing.
In 2025, a significant portion of incidents reported to the FCA involved third-party issues. A notable percentage of those were cyber-related. That’s not a coincidence — it’s probably the clearest argument for why the regime exists at all.
The new framework doesn’t replace what firms already have to do. Banks and insurers still own their own resilience obligations. They can’t point at a third-party provider and say the regulator handles that now. But the regime adds a layer on top, one that looks across the whole system rather than at any single institution.
What Critical Third Parties Must Actually Do
Designation as a critical third party comes with real expectations. These providers must identify and manage risks tied to the services they offer to UK financial firms. They’re expected to test their resilience measures, not just document them. And they need to keep communication open with both regulators and the firms they serve — especially when something goes wrong.
Joint testing exercises are part of it. So is sharing self-assessments with affected firms. The idea is transparency: if a provider knows it’s carrying systemic weight, it should be able to show its work. Regulators want to see the stress tests, the risk assessments, the response plans. Not just hear that they exist.
The goal, as the regime frames it, is for consumers and businesses to see more reliable services and faster recovery times when disruptions do happen. Because disruptions will happen. The regime isn’t pretending otherwise. It’s trying to make sure they don’t cascade.
Proactive Engagement, Not Just Compliance
There’s a tone to the new framework worth noting. It’s not purely punitive. The FCA and PRA seem to want designated providers engaged proactively — testing continuously, sharing information promptly, treating oversight bodies as partners in resilience rather than just auditors to satisfy once a year.
That’s a harder ask than it sounds. Providers that serve multiple regulated firms are often working across different contractual relationships, different data-sharing agreements, different legal frameworks. Getting them to share information broadly, quickly, during an active incident — that takes coordination that probably doesn’t exist yet in most cases.
Still, the regulators have made their position clear. The FCA and PRA websites carry additional guidance for firms and designated providers navigating the new requirements. The information is there. The expectation is that firms use it.
For financial firms specifically, the message is pretty direct: keep identifying your dependencies on critical services. Don’t assume designation of a third party means that provider is now someone else’s problem. The interconnected nature of modern financial services means a failure at one node can hit far more than one firm. The regime is built around that reality.
Whether providers engage genuinely or just check boxes is unclear yet. The regime is now in effect, and the real test comes when something breaks.
Frequently Asked Questions
Which regulators oversee critical third parties under the new UK regime?
The Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA) jointly oversee critical third-party providers under the new framework.
What do designated critical third parties need to do under this regime?
They must identify and manage risks tied to their services, conduct resilience testing, share self-assessments with affected firms, and maintain open communication with regulators — particularly during disruptions.
