Operational resilience: Critical third parties to the UK financial sector

November 15, 2023
Ash Costello


View profile

Financial services firms and financial market infrastructures (FMIs) (together “firms”) are relying to an ever greater degree on outsourced service providers.  HM Treasury is introducing an oversight framework for ‘critical third party’ service providers in the financial services industry, so that financial stability and systemic risk can be managed (the “Critical Third Party” or “CTP” Regime).   HM Treasury will determine which third-party service providers are “critical”, while financial regulators will make rules, gather information and take enforcement action. 

Financial services firms include all firms authorised by the PRA and/or the FCA and UK authorised branches of third-country firms. FMIs include central securities depositories, central counterparties, UK recognised investment exchanges, recognised payment systems operators (RPSOs) and specified service providers to RPSOs.

Who will be considered a Critical Third Party?

In a joint discussion paper (PRA Discussion Paper 3/22 | FCA Discussion Paper 22/3), the FCA and PRA stated that “certain ICT third party service providers (such as the major CSPs) could be particularly likely to be considered for designation as CTPs due to firms’ and FMIs’ increasing reliance on their services. However, certain third party providers of non-ICT services, eg claims management services to insurers or cash distribution, could also be considered for designation as CTPs if they were deemed to meet the proposed statutory designation criteria.” 

Potential factors to consider when assessing whether a third party meets the criteria for CTPs

When weighing up the criticality of  a service provider to the market, supervisory authorities will consider factors such as the potential impact that its failure or disruption might have on market stability, the ease of substitution, and the materiality and concentration of services provided to Firms.


The CTP Regime was introduced via Sections 18 and 19 of the Financial Services and Markets Act 2023 (FSMA 2023), effective 29 August 2023.   Financial regulators will consult on their proposed rules and guidance for supervising the operational resilience of CTPs in late 2023, and in 2024 HM Treasury is expected to start designating the first CTPs under the regime. 

To contact Ash, or read more about her practice, click here.