Critical third party
CTPAlso called CTP regime, critical third parties regime
A critical third party (CTP) is a company that supplies services to UK banks, insurers and market infrastructure and has been designated by HM Treasury because a failure or disruption of its services could threaten UK financial stability or confidence. Designated CTPs are overseen directly by the Bank of England, PRA and FCA.
How it works
The regime sits in the Financial Services and Markets Act 2000, as amended in 2023. HM Treasury designates a provider after a recommendation from the regulators. From that date the provider must meet the Fundamental Rules and the operational risk and resilience requirements. It maps its systemic services, runs scenario testing and reports incidents to the regulators. The first designations, covering four cloud providers, took effect on 13 July 2026.
The regime targets concentration risk. Many firms rely on the same few cloud and technology providers, so one outage can hit large parts of the market at once. Designation does not shift responsibility. Banks and insurers stay accountable for their own operational resilience and for managing their outsourcing arrangements, including arrangements with a designated CTP.
The rules
Gives HM Treasury the power to designate critical third parties and gives the regulators direct powers to make rules for them and oversee them.
HM Treasury, the UK financial regulators and designated providersSets the Fundamental Rules and operational resilience requirements for CTPs, in force from 1 January 2025 and binding on a provider once designated.
Designated critical third partiesThe first designations under the regime, bringing four cloud service providers under joint oversight by the Bank of England, PRA and FCA.
Four cloud service providersThe EU counterpart, under which the European Supervisory Authorities designate critical ICT third-party service providers and a lead overseer supervises each one.
ICT third-party service providers critical to EU financial entitiesCommon questions
Who decides which firms are critical third parties?
HM Treasury makes the designation by statutory instrument, after a recommendation from the Bank of England, PRA and FCA. It looks at how material the services are to the financial sector and how many firms depend on the provider.
Which providers have been designated?
HM Treasury designated four cloud service providers with effect from 13 July 2026. These were the first designations since the CTP rules took effect on 1 January 2025. Further designations are expected as the regime develops.
Does a CTP designation reduce a bank's own duties?
No. Firms remain responsible for their own operational resilience and for managing outsourcing and third-party risk. The regulators have stated that the CTP rules do not change those duties, so firms still need contracts, testing and exit plans for designated providers.
How does the UK regime differ from DORA?
Both regimes oversee critical technology providers directly. Under DORA the European Supervisory Authorities designate critical ICT providers and appoint a lead overseer. In the UK, HM Treasury designates and the Bank of England, PRA and FCA oversee jointly. The UK regime is not limited to ICT services.
