UK designates four tech firms as critical to financial system

The Government has announced the first firms it will designate under its critical third parties regime. 

In a press release HM Treasury has announced it will designate entities from the Microsoft, Google, Amazon and Oracle groups as critical third parties. The formal designations, which are made via the Critical Third Parties (Designation) Regulations 2026, will take effect from 13 July 2026. More designations are expected to be made over time on a rolling basis where HMT considers that service providers meet the relevant criteria.

Critical third parties need to comply with operational resilience rules in relation to the systemic services they provide to the UK financial sector. These rules are set, overseen and enforced by the Financial Conduct Authority, Prudential Regulation Authority and Bank of England. The regulators will establish an ongoing supervisory relationship with CTPs, requiring them to submit annual self-assessments evidencing compliance with the CTP regime and attend annual review meetings to discuss key risks.

In their press release, the regulators note that the CTP regime complements, but does not replace, existing operational resilience rules for regulated firms. From next year regulated firms will also need to report more detailed information to the regulators about the third parties they rely on to deliver their financial services.

Earlier this year the Treasury Committee released a report on AI in financial services in which they called on HMT to designate major AI and cloud service providers under the critical third parties regime before the end of the year. 

The CTP regime is the UK version of the oversight regime under the EU’s Digital Operational Resilience Act. So far 19 ICT third party service providers have been designated under DORA.

Get in touch with us for access to our guide to the UK’s critical third party regime.