Critical Third Parties (CTPs)

CTPs are technology and service providers whose services are important to UK financial stability. CTPs are jointly overseen by the Bank of England, the PRA and the Financial Conduct Authority (FCA) after they have been designated by HM Treasury (HMT), in order to enhance the resilience of the UK financial sector.

The financial sector increasingly relies upon a small number of third-party service providers to deliver their services, some of which are critical to UK financial stability and confidence. Failure of, or disruption to, these third-party services could act as a single-point-of-failure impacting multiple firms and FMIs simultaneously and, in some cases, the stability of, or confidence in, the UK financial sector.  

Domestic Statutory Framework

The Financial Services and Markets Act 2000 contains statutory measures in relation to CTPs. These measures include a framework for HMT to designate CTPs and powers for the Bank, the PRA and the FCA (the regulators) to make rules for, gather information from, and take enforcement action against designated CTPs in connection with the systemic services they provide to FMIs and regulated firms.

The text of FSMA, including the measures on CTPs, can be found on the UK Government website. A link to it is listed on the right-hand side.  Financial Services and Markets Act 2000

Designated CTPs 

HMT decides whether to designate a third party as a CTP, based generally on recommendations from the FCA, Bank of England and PRA, although HMT may also make designations without any regulator recommendations. HMT can de-designate CTPs or designate new CTPs as markets evolve. 

Designation orders are published on Parliament’s website, and link is listed on the right-hand side.  The Critical Third Parties (Designation) Regulations 2026

Rules 

The regulators have made rules that set the outcomes that they expect from CTPs. CTPs must identify and manage risks to the systemic services they provide, and maintain open, timely communication with regulators and the firms that rely on them, particularly during major incidents. 

In November 2024, the regulators each published rules and related documents concerning the new CTP regime. Links to these rules are listed on the right-hand side.   
 
 Policy statement 16/24 - Operational resilience: Critical third parties to the UK financial sector 
Critical Third Parties Instrument 2024 (FMI Rulebook)  
Critical Third Parties Instrument 2024 (PRA Rulebook)
Critical Third Parties Instrument FCA 2024/41 
Critical Third Parties Emergency Provisions Instrument 2024 

 

Guidance 

The regulators have published guidance on the interpretation of more detailed regulatory requirements for CTPs.

The regulators have published a Supervisory Statement that sets out how a CTP should comply with the duties and obligations placed on it by or under the regulators' rules.  Supervisory statement 6/24 - Critical third parties to the UK financial sector 
The regulators have also published a supervisory statement that sets out its expectations on the reports by and the appointment of skilled persons to collect and update information and reports.   Supervisory statement 7/24 - Reports by skilled persons: Critical third parties 

Oversight of CTPs

The regulators will take a pragmatic, flexible and coordinated approach to oversight of CTPs. They will seek to minimise burdens on CTPs while focusing on risks to UK financial stability and confidence from service disruption.

The regulators have published a Statement of Policy on their approach to the oversight of CTPs.  Approach to the oversight of critical third parties 
The regulators have signed a Memorandum of Understanding laying out how they will coordinate their activities in relation to CTPs.  Memorandum of Understanding between the Bank of England, FCA and PRA 

Statements of Policy

The regulators may publish additional statements of policy that set out how they will exercise their statutory powers relating to CTPs.

The regulators have published a Statement of Policy on its approach to enforcement.  Financial penalties imposed by the Bank under the Financial Services and Markets Act 2000 or under Part 5 of the Banking Act 2009 - Policy Statement 

International Engagement

Designated CTPs may be located outside of the UK, and CTP oversight has been designed to be compatible with similar approaches in other jurisdictions where appropriate. The regulators are committed to cross-border cooperation and have signed a memorandum of understanding with the European Supervisory Authorities to facilitate cooperation on CTP oversight. 

A link to the MoU can be found on the right-hand side  MoU between UK and EU regulators on CTP oversight 

Back to top

This page was last updated 10 July 2026