New UK Third Party Rules Signal Major Shift for Banks

UK regulators have introduced a new oversight regime to address the growing dependency of the financial sector on a small number of critical cloud providers and software suppliers.

The new Critical Third Parties (CTPs) regime designates Microsoft, Google Cloud, Amazon Web Services (AWS) and Oracle as the first critical entities subject to closer supervision. The government and financial regulators established this framework to recognize that some technology providers have become deeply embedded in the UK’s financial system. Disruption to these services could have consequences across the wider market.

The designation of these four companies marks the point where the UK’s oversight policy moves from theory into practice. It establishes a baseline for regulatory expectations. However, the designation of a provider as critical does not automatically solve the problem of operational risk for the institutions relying on them.

Twenty years ago, banks built and owned much of their own software infrastructure. Today, the sector relies on an extensive network of cloud platforms, specialist software and outsourced services. This shift has made the industry more efficient and competitive, but it has also concentrated operational risk. As cloud adoption has accelerated, more firms depend on the same providers for critical services. The growth of AI services could reinforce this trend.

The CTP regime creates an opportunity for firms to have more meaningful conversations about the resilience of those providers. It gives financial institutions a stronger foundation to ask detailed questions about the risks beneath them. Yet oversight of CTPs is only one part of the picture. Financial institutions need greater visibility into the software suppliers, infrastructure and services supporting those providers, as well as the risks that could affect their continued delivery.

Those fourth-party dependencies have historically been opaque to financial institutions, creating the potential for a further layer of concentration risk beneath the CTPs themselves. The CTP regime helps firms look beyond direct dependencies and into the wider software supply chain supporting their critical services. From there, they need a clear view of how disruption would spread through the organisation, which services would be affected first, and where recovery efforts should be prioritised.

Resilience planning also needs to account for scenarios beyond a technical outage. A critical software supplier may experience financial instability, enter administration or lose the ability to provide an essential service. Those are exactly the kinds of situations that stressed exit plans are designed to address. For many organisations, that includes software escrow and other continuity mechanisms that have already been tested under realistic conditions.

Technology failures are only one source of disruption. Organisations that understand their software dependencies, test their recovery arrangements and plan for a range of failure scenarios will always be better placed to respond.

Financial institutions face mounting pressure as household costs rise, forcing them to protect the resilience of their critical services [2].

One significant development in the market involves the launch of a dedicated application for UK trade professionals [1].