UK PRA & Bank of England Brief

Headline

Bank of England, PRA, and FCA begin joint oversight of four designated Critical Third Parties on 13 July 2026

Executive Summary

The Bank of England, PRA, and FCA will start jointly overseeing the first Critical Third Parties (CTPs) on 13 July 2026, following designation by HM Treasury. HM Treasury designated four global cloud and technology providers: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd, and Oracle Corporation UK Limited.

Bottom Line

The Bank of England, PRA, and FCA begin joint oversight of four designated global cloud and technology providers on 13 July 2026 under the Critical Third Parties (Designation) Regulations 2026. The regime imposes resilience obligations directly on the designated CTPs while leaving existing outsourcing and operational resilience duties on regulated firms intact. Cresthaven reading: UK-regulated firms that rely on any of the four designated providers operate within a structure where the providers themselves now face direct regulatory oversight of service resilience, alongside the firms' own continuing third-party management obligations.

Key Regulatory Signals

• Oversight Commences 13 July 2026: The Bank of England, PRA, and FCA will begin jointly overseeing the four designated CTPs on 13 July 2026 under the Critical Third Parties (Designation) Regulations 2026. The final rules underpinning the regime came into effect on 1 January 2025 and apply immediately to CTPs upon HM Treasury designation.
• Designated Providers Face Resilience Obligations: CTPs must identify and manage risks to their critical services effectively and maintain open, timely communication with regulators and the firms that rely on them, particularly during major incidents. Oversight is limited to the resilience of the services they provide to UK financial firms; designation is not equivalent to authorization by the regulators.
• Regulated Firms Retain Existing Outsourcing Duties: The CTP regime complements but does not replace existing outsourcing and operational resilience rules for regulated firms. Regulated firms remain responsible for managing their own third-party arrangements, including due diligence, risk management, and contingency planning.
• Regime Scope Remains Open to Expansion: HM Treasury retains sole authority over future designations and de-designations, generally based on recommendations from the three regulators. The regulators will periodically review whether CTPs continue to meet designation criteria and evaluate the effectiveness of the oversight approach. Cresthaven reading: firms relying on providers not yet designated remain subject only to existing outsourcing rules, but the source indicates the scope of entities under the regime will continue to evolve.
• Cross-Jurisdictional Coordination Formalized: The Bank of England, PRA, and FCA have signed a Memorandum of Understanding with EU regulators to support coordination and information sharing on CTP oversight. CTPs may also be subject to the EU's Digital Operational Resilience Act in other jurisdictions.

Regulatory Delta

• The CTP regime marks the first use of powers granted to the Bank, PRA, and FCA under the Financial Services and Markets Act 2000, as amended in 2023. No direct precedent exists for joint regulatory oversight of unregulated third-party technology providers in the UK.
• The 13 July 2026 commencement transitions the regime from rules-in-force status (since 1 January 2025) to active supervisory engagement against four named global cloud providers.
• The EU's Digital Operational Resilience Act covers overlapping providers in EU jurisdictions. A signed Memorandum of Understanding between UK and EU regulators formalizes coordination and information sharing on oversight of these CTPs.

Materiality Classification

HIGH — The CTP regime activates on 13 July 2026, with four designated global cloud providers subject to direct joint oversight by the Bank of England, PRA, and FCA, while regulated firms remain responsible for managing their own third-party arrangements, and the source confirms the designation scope will continue to evolve.

Time Horizon

effective — 2026-07-13

Intelligence Outlook

Monitor HM Treasury for further CTP designation announcements and the Bank of England, PRA, and FCA for periodic reviews of whether designated CTPs continue to meet designation criteria and evaluations of the oversight approach's effectiveness.