A handful of cloud providers now carry so much of the UK financial sector that their failure could threaten financial stability, and since July 2026 four of them are directly overseen by the Bank of England, PRA and FCA. The UK critical third parties (CTP) regime, created by the Financial Services and Markets Act 2023, lets HM Treasury designate service providers whose disruption could threaten the stability of, or confidence in, the UK financial system, and lets the regulators make rules for them. The rules took effect on 1 January 2025 and the first designations came into force on 13 July 2026. This guide summarises who is covered, the CTP Fundamental Rules and Operational Risk and Resilience Requirements, incident reporting, enforcement and what the regime means for the identity and access layer that firms build on top of designated cloud platforms. It is for resilience, cloud and third-party risk leads at UK financial firms and at providers that may be designated. Status line: checked against legislation.gov.uk and the FCA Handbook on 27 October 2026. This page is not legal advice.
Key takeaways
- Designation is by Treasury regulations. Under section 312L of FSMA 2000, HM Treasury may designate a provider if a failure or disruption of its services could threaten UK financial stability or confidence, after consulting the regulators and hearing the provider.
- Four cloud providers are designated. The Critical Third Parties (Designation) Regulations 2026 (SI 2026/777), in force 13 July 2026, designate Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited.
- Six Fundamental Rules and eight resilience requirements. The FCA's CTPS sourcebook (mirrored by the PRA and Bank) sets conduct rules and requirements for governance, risk, supply chain, technology and cyber resilience, change, mapping, incident management and termination.
- Clocks start at designation. An interim self-assessment is due within 3 months, mapping and the first incident management playbook within 12 months, and a playbook exercise with customer firms within 12 months then at least every two years.
- Firms keep their own duties. The regime does not change financial firms' responsibility for their operational resilience and outsourcing, including how they configure and secure identities on a designated platform.
Scope: who and what is covered
| Element | What the law says | Source |
|---|---|---|
| Who can be designated | A person providing services to authorised persons, relevant service providers (such as e-money and certain payment institutions) or FMI entities (such as recognised clearing houses, CSDs and payment systems); the Bank of England cannot be designated | FSMA 2000 s.312L(1), (5) |
| Threshold | Treasury's opinion that failure or disruption of the services could threaten the stability of, or confidence in, the UK financial system | s.312L(2) |
| Factors | Materiality of the services to essential activities, services or operations, and the number and type of firms served | s.312L(3) |
| Process | Treasury consults the FCA, PRA and Bank and gives the provider written notice and a reasonable period for representations; regulators may recommend candidates | s.312L(4); FCA PS24/16 |
| Services in scope of most rules | "Systemic third party services" to firms; Fundamental Rule 6 (dealing with regulators) applies to all services the CTP provides to firms | CTPS 3.1.1 |
| Origin | Chapter 3C of Part 18 of FSMA 2000, inserted by FSMA 2023 s.18, in force 29 August 2023 | legislation.gov.uk |
The four designated entities in SI 2026/777 are all cloud service providers. Designation reaches the named legal entity and its systemic services to UK firms, not every service it sells, and not the financial firms themselves.
Key obligations
CTP Fundamental Rules (CTPS 3.2)
- Conduct business with integrity (honest, ethical conduct).
- Conduct business with due skill, care and diligence.
- Act in a prudent manner.
- Have effective risk strategies and risk management systems.
- Organise and control affairs responsibly and effectively.
- Deal with the regulators in an open and co-operative way and disclose anything they would reasonably expect to be told about.
Operational Risk and Resilience Requirements (CTPS 4)
| Requirement | Core duty | Rule |
|---|---|---|
| Cross-cutting | Sound, effective and comprehensive strategies, controls, processes and systems, proportionate to the CTP's activities | CTPS 4.1 |
| 1 Governance | Named central point of contact with regulators, clear roles and escalation, an approach to prevent, respond to, adapt to and recover from incidents, lessons learned, approval of information sent to regulators | CTPS 4.2 |
| 2 Risk management | Identify and monitor internal and external risks to delivering systemic services and update processes from incidents and testing | CTPS 4.3 |
| 3 Dependency and supply chain | Manage supply chain risks; take reasonable steps so key nth parties know the duties, co-operate and give regulators access to information | CTPS 4.4 |
| 4 Technology and cyber resilience | Strategies, processes and systems for technology and cyber risk, regularly tested and exercised | CTPS 4.5 |
| 5 Change management | Risk-assess, record, test, verify and approve changes before implementation to minimise incident risk | CTPS 4.6 |
| 6 Mapping | Within 12 months of designation, document the people, assets, services and technology behind each systemic service and their interdependencies, and keep it updated | CTPS 4.7 |
| 7 Incident management | Respond and recover so as to minimise impact on UK stability or confidence, set a maximum tolerable level of disruption for each systemic service, maintain a playbook (first version within 12 months), co-ordinate with regulators and firms | CTPS 4.8 |
| 8 Termination | Orderly, timely termination and transfer of a systemic service, with firms able to access, recover and receive back their assets in an accessible format | CTPS 4.9 |
Testing, self-assessment and information sharing
- Scenario testing: regularly test the ability to keep each systemic service within its maximum tolerable level of disruption in a severe but plausible scenario, across a range of adverse circumstances (CTPS 5.2).
- Playbook exercise: exercise the incident management playbook with a representative sample of firms within 12 months of designation and at least every two years, and report results to regulators as soon as practicable (CTPS 5.3).
- Self-assessment: interim self-assessment within 3 months of designation, then annually, with copies kept for at least 3 years (CTPS 6.1).
- Information to firms: sufficient and timely information to help firms manage risk, including testing results, the redacted annual self-assessment and the maximum tolerable level of disruption for each service the firm receives (CTPS 7.1).
Incident reporting (CTPS 8)
| Report | When | Key contents |
|---|---|---|
| Initial | As soon as practicable after a CTP operational incident | Description and extent, detection time, affected systemic services, geography, cause if known, contact for firms, initial action, expected resolution and recovery time; regulators also get names of affected firms and other authorities notified |
| Intermediate | As soon as practicable after any significant change, including resolution | Further detail, steps taken, resolution time if resolved |
| Final | Within a reasonable time after resolution | Root causes, remedial actions and timeline, likelihood of recurrence, long-term implications, areas for improvement including for firms |
The initial, intermediate and final reports go to both the regulators and affected firms, which gives firms a regulatory basis to expect incident detail from designated providers.
Timeline and current status
| Date | Event |
|---|---|
| 29 August 2023 | FSMA 2023 provisions inserting Chapter 3C (s.312L onwards) into FSMA 2000 come into force |
| 12 November 2024 | FCA, PRA and Bank publish PS24/16, the joint policy statement and supervisory statement, with the CTP sourcebook and enforcement rules |
| 1 January 2025 | CTP rules take effect |
| 13 July 2026 | Critical Third Parties (Designation) Regulations 2026 (SI 2026/777) come into force, designating four cloud providers |
| By 13 October 2026 | Interim self-assessments due (3 months after designation) |
| By 13 July 2027 | Mapping, first incident management playbook and first playbook exercise due (12 months after designation) |
The later dates are calculated from the 13 July 2026 commencement date and the CTPS time limits; regulators may treat the designation date differently, so confirm with the regulators' published approach. Further designations can follow by new Treasury regulations.
Enforcement and penalties
The regulators' powers over CTPs are in FSMA 2000 Chapter 3C:
- Rule-making (s.312M): the FCA, PRA and Bank may each make rules for CTPs to advance their objectives, consulting the Bank where the PRA or FCA makes them.
- Directions (s.312N): a regulator may direct a CTP to do or not do something, with immunity from damages for complying with a direction aimed at a threat to financial stability (except bad faith or a Human Rights Act breach).
- Information and investigations (s.312P): Part 11 powers apply: information and document requirements, skilled person reports, investigators and warrants to enter premises, including for connected persons.
- Public censure (s.312Q): a regulator may publish a statement that a CTP has contravened a requirement.
- Disciplinary prohibitions and restrictions (s.312R): a regulator may prohibit a CTP from providing services to firms, prohibit firms from receiving them, or impose conditions or limits, where this will not threaten stability and advances its objectives.
- Procedure (s.312S): warning and decision notices, with a right to refer to the Tribunal.
In the sections we read, the CTP powers are censure, directions and prohibitions or restrictions rather than fines. For firms, the existing PRA and FCA outsourcing and operational resilience rules continue to apply and are enforced in the usual way. See the Financial Services Cyber Regulation Map and the DORA ICT Third-Party Risk and Register of Information Guide for the EU counterpart.
What it means for AI agents and non-human identities
The CTP regime regulates the provider's resilience, not how each firm uses the platform. Most outages and breaches that firms suffer on cloud platforms come from the shared responsibility layer: identities, keys and permissions that the firm controls. Designation does not move that layer to the regulators.
- Your machine identities stay your problem: service principals, IAM roles, access keys and managed identities on designated platforms remain under the firm's outsourcing and resilience duties. See the Cloud Security Guide and the Azure Managed Identities Security Guide.
- Provider identity infrastructure is systemic: a CTP's own identity and key management, such as token signing keys and operator access, sits behind every systemic service. Its compromise would be a CTP operational incident. See the Storm-0558 and Cloud Key Theft Profile.
- Operator access: the technology and cyber resilience requirement covers provider staff and automated access to customer environments. Ask what the CTP will share under CTPS 7 about operator access controls. See the Cloud Provider Support and Operator Access Controls Guide.
- Termination and portability need identity exit plans: CTPS 4.9 requires the CTP to return firms' assets in an accessible format, but federation trust, workload identities, keys in provider KMS and secrets in provider vaults must be re-created by the firm elsewhere. See the Cloud Concentration Risk and Exit Strategy Guide.
- AI agents on CTP platforms: agents running on designated clouds use the same identity primitives. Their credentials, permissions and logs belong in the firm's important business service mapping, not just the CTP's.
Compliance steps
For financial firms
- Map dependencies: link each important business service to the designated entities and systemic services it uses, including identity, key management and logging services.
- Request CTPS 7 information: obtain testing results, the redacted self-assessment and maximum tolerable levels of disruption, and compare them with your own impact tolerances.
- Integrate CTP incident reports: route CTPS 8 initial, intermediate and final reports into your incident process and your own regulatory reporting.
- Join playbook exercises: volunteer for the representative sample in CTPS 5.3 exercises where you are a material user.
- Harden your identity layer: inventory and least-privilege your cloud service principals, roles and keys; test break-glass access if the provider's identity plane is degraded.
- Keep exit and stressed exit plans: include identity, keys and secrets, and test a partial migration.
For designated or candidate providers
- Appoint the regulatory contact and governance: notify names and out-of-hours contacts (CTPS 4.2).
- Deliver the interim self-assessment: within 3 months of designation.
- Complete mapping and the playbook: within 12 months, including identity, key management and operator access dependencies.
- Set maximum tolerable levels of disruption: per systemic service, and test them in severe but plausible scenarios.
- Extend duties to nth parties: inform key suppliers and secure regulator access to information.
- Build the reporting machine: templates and approvals for CTPS 8 reports to regulators and firms.
Decision guidance
- Large banks and insurers: treat CTP information as an input to, not a replacement for, your own testing; push for identity-plane scenarios in exercises.
- Smaller firms: rely on CTPS 7 information and the provider's published reports, but keep your own inventory of cloud identities and a basic exit plan.
- Multi-cloud or not: multi-cloud reduces concentration but multiplies identity estates; choose it only where you can govern identities consistently across providers.
Detection, measurement and framework mapping
- Important business services mapped to CTP services: percentage complete.
- CTP maximum tolerable disruption versus your impact tolerance: number of services where the provider's tolerance exceeds yours.
- Time to ingest CTP incident reports: from receipt to triage in your incident process.
- Cloud machine identities with an owner and least privilege: percentage on designated platforms.
- Exit test coverage: share of critical workloads, including identities and keys, with a tested migration path.
| CTP requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Supply chain risk (CTPS 4.4) | GV.SC-07 | SR-3 Supply Chain Controls and Processes, SA-9 External System Services |
| Change management (CTPS 4.6) | PR.PS-01 | CM-3 Configuration Change Control |
| Mapping (CTPS 4.7) | ID.AM-02 | CM-8 System Component Inventory |
| Incident management and reporting (CTPS 4.8, 8) | RS.MA-01 | IR-4 Incident Handling, IR-6 Incident Reporting |
| Scenario testing (CTPS 5) | RC.RP-01 | CP-4 Contingency Plan Testing |
| Termination (CTPS 4.9) | GV.SC-10 | SA-9 External System Services |
| Firm identities on CTP platforms | PR.AA-05 | AC-2 Account Management, AC-6 Least Privilege |
Common failure patterns
- Assuming designation transfers risk: firms reduce their own cloud testing because the regulators now oversee the provider.
- Mapping without the identity plane: dependency maps that list compute and storage but not the identity, KMS and logging services every workload needs.
- Exit plans that stop at data: data export rehearsed, but federation, roles, keys and secrets never rebuilt elsewhere.
- Incident reports nobody reads: CTP reports arrive at a generic mailbox rather than the incident team.
- Tolerance mismatch: a provider's maximum tolerable disruption longer than the firm's impact tolerance, unnoticed until an outage.
Practitioner checklist
- List of designated CTPs and systemic services you use, checked against SI 2026/777 and any later designations.
- Important business services mapped to CTP services, including identity, KMS and logging.
- CTPS 7 information requested and compared with your impact tolerances.
- CTPS 8 incident reports routed into your incident process.
- Cloud service principals, roles and keys inventoried with owners and least privilege.
- Break-glass access tested for loss of the provider's identity plane.
- Exit and stressed exit plans that include identities, keys and secrets.
- For providers: interim self-assessment, mapping, playbook and exercise dates tracked from designation.
Standards and references
- legislation.gov.uk: FSMA 2000 section 312L Critical third parties
- legislation.gov.uk: The Critical Third Parties (Designation) Regulations 2026
- FCA: PS24/16 Operational resilience, critical third parties to the UK financial sector
- FCA Handbook: CTPS 4 Operational Risk and Resilience Requirements
- FCA Handbook: CTPS 8 Incident reporting
- legislation.gov.uk: FSMA 2000 section 312R Disciplinary measures
- legislation.gov.uk: FSMA 2000 section 312P Information gathering and investigations
Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · Cloud Concentration Risk and Exit Strategy Guide · DORA Guide · Cloud Provider Support and Operator Access Controls Guide. This guide summarises the UK critical third parties regime as at 27 October 2026 and is not legal advice.