From 13 July 2026, UK financial regulators have taken a significant step to strengthen the resilience of the financial system. The Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) are now jointly overseeing a small number of organisations identified as Critical Third Parties. These organisations provide services that are fundamental to the operation of financial institutions across the UK.
This is not simply a regulatory update. It reflects a broader shift in how systemic risk is understood. Financial institutions are no longer viewed in isolation. Increasingly, resilience depends on the stability of the third‑party providers they rely on every day.
A response to growing dependency
Over the past decade, financial services firms have become more dependent on a concentrated group of technology providers. This has brought clear benefits in terms of scale, efficiency and access to advanced capabilities. However, it has also introduced a new form of risk. If a small number of providers face disruption, the impact can spread quickly across multiple firms and markets.
The new oversight regime directly addresses this challenge. It allows regulators to focus on the resilience of the services that matter most to the financial system. The aim is straightforward: reduce the likelihood of widespread disruption and ensure continuity when incidents occur.
For business leaders, this should prompt a shift in perspective. Third‑party risk is no longer just a procurement or compliance concern. It is a core part of operational resilience and long‑term stability.
The organisations in scope
HM Treasury has designated four global providers as the first Critical Third Parties under this framework. These are Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. Each of these organisations plays a central role in supporting the infrastructure of the UK financial sector.
Their designation reflects their importance rather than any specific weakness. It acknowledges that the services they provide are deeply embedded in the operations of banks, insurers and financial market infrastructure. As a result, their resilience has system‑wide implications.
A targeted and proportionate approach
The regime has been designed to be focused and proportionate. Regulators are not seeking to oversee every aspect of these organisations. Instead, their attention is directed at the resilience of the services delivered to financial firms.
This includes understanding how those services perform under stress, how quickly they can recover from disruption, and how effectively they can limit the impact on customers and markets. By concentrating on outcomes rather than organisational structure, the approach avoids unnecessary complexity while still addressing the underlying risk.
This balance is important. It ensures that resilience is strengthened without restricting innovation or the continued use of large‑scale technology providers.
What remains unchanged for firms
While the introduction of this regime is significant, it does not change one fundamental principle: financial institutions remain responsible for their own resilience.
The oversight of Critical Third Parties is designed to complement existing outsourcing and operational resilience requirements, not replace them. Firms must continue to carry out due diligence, manage risks actively, and maintain credible contingency plans. Responsibility for managing third‑party relationships remains firmly in their hands.
This is where many organisations will need to focus. Regulatory oversight provides additional assurance, but it does not remove the need for strong internal governance.
Practical implications for leadership teams
For leadership teams, this development is an opportunity to reassess how third‑party risk is managed across the business. It is a chance to move beyond compliance and build a more structured, strategic approach to resilience.
In practice, this means understanding where dependencies exist, how concentrated those dependencies are, and what would happen if a critical service became unavailable. It also means ensuring that contingency plans are realistic and tested, rather than theoretical.
Organisations that take this approach will be better positioned to respond to disruption, protect customer outcomes and maintain operational continuity. Just as importantly, they will be more confident in their ability to scale and adapt in a rapidly changing environment.
A broader shift in accountability
This framework builds on powers introduced through updates to the Financial Services and Markets Act and reflects a wider direction of travel. Responsibility for financial stability is expanding beyond regulated firms to include the providers that support them.
That shift matters. It recognises that the financial system now operates as an interconnected ecosystem. Resilience cannot be achieved by focusing on individual organisations alone. It requires a coordinated approach across all of the critical components that enable the system to function.
Looking ahead
The introduction of Critical Third Party oversight marks a clear step forward in how systemic risk is managed in the UK. It strengthens the foundations of the financial sector while maintaining flexibility for innovation and growth.
For firms, the message is clear. Resilience cannot be outsourced, and it cannot be treated as a one‑off exercise. It needs to be actively managed, continuously improved and embedded into decision‑making at every level of the organisation.
Those that respond early and take a proactive approach will not only meet regulatory expectations. They will build stronger, more reliable operations that support long‑term success.
