Critical third parties and critical suppliers: what is the difference?
They are separate regimes. HM Treasury designates critical third parties to protect the financial system, and the first took effect in July 2026. Regulators would designate critical suppliers under the Cyber Security and Resilience Bill (CSRB), which is not yet law.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
These are two separate regimes with similar names. The UK's critical third parties (CTP) regime lets HM Treasury bring major suppliers to the financial sector under oversight by the Bank of England, PRA and FCA. Critical suppliers under the Cyber Security and Resilience Bill (CSRB) are designated by regulators under the NIS Regulations.
A supplier could fall under one, both or neither, because each uses a different test.
How they compare
| Critical third parties regime | Critical suppliers under the Bill | |
|---|---|---|
| Legal basis | Financial Services and Markets Act 2000, as amended in 2023 | NIS Regulations, as amended by the Bill |
| Who decides | HM Treasury, by regulations | The sector regulator or Information Commission |
| Who is protected | The UK financial system | Essential, digital and managed services, and wider society |
| Overseen by | Bank of England, PRA and FCA | The designating regulator |
| Test | Failure or disruption could threaten financial stability or confidence | Disruption has the potential to cause a significant impact on the economy or day-to-day functioning of society |
| Must supply directly? | Services to authorised firms and financial market infrastructure | Must supply goods or services directly to a regulated organisation |
| Status | Live, with first designations from 13 July 2026 | Not yet law, and starts with related regulations |
Where the CTP regime stands
HM Treasury announced the first designations on 10 July 2026, through the Critical Third Parties (Designation) Regulations 2026 (SI 2026/777), effective 13 July 2026:
- Amazon Web Services EMEA SARL
- Google Cloud EMEA Limited
- Microsoft Ireland Operations Ltd
- Oracle Corporation UK Limited
Treasury calls this a rolling regime, so more designations may follow. Oversight is limited to systemic services for the financial sector, not the provider's wider business. Each designated firm is expected to provide a first self-assessment within three months, based on rules set out by the regulators in PS16/24.
What this means for financial firms
Banks and other financial firms should not read either regime as moving their duties to the supplier. Designation does not replace a firm's own obligations. You still need to:
- manage outsourcing and third-party risk
- understand your dependencies on critical providers
- test how you'd respond to disruption
- check that contract, governance and exit plans remain appropriate
New FCA and PRA incident and third-party reporting rules also start on 18 March 2027. See FCA and PRA requirements.
Banking is not a subsector in Schedule 2 of the NIS Regulations, so a bank isn't an operator of essential services for that reason. A financial firm could still be regulated under the Bill through another activity, such as providing a cloud or managed service.
What this means for technology suppliers
If you are a large provider, you may need to consider several overlapping routes.
| Your position | Possible effect |
|---|---|
| Cloud provider in the UK | RDSP under the Bill, and possibly a CTP |
| Managed service provider | RMSP under the Bill, and customers' third-party requirements |
| Large supplier to banks | Possible future CTP. Banks must also report material third-party arrangements under the new rules |
| Supplier to essential services | Possible designation as a critical supplier |
The Bill says a person cannot be designated as a critical supplier for a service that already makes it an RDSP or RMSP. So a provider's categories may vary by service.
Is the CTP regime the UK version of DORA?
It is related but not equivalent. DORA has its own framework for critical ICT providers in the EU, and its scope and tools differ. A provider serving UK and EU financial firms could have to deal with both. See does DORA apply to UK firms?
What to do next
If you're a financial firm:
- Identify where you depend on designated providers.
- Prepare your material third-party register for the 2027 reporting rules.
- Keep your own resilience testing and exit plans up to date.
If you're a supplier:
- Map services by regime, because each may be treated differently.
- Prepare one evidence set for customers and regulators.
- Check incident notice terms for financial customers. They may be under tight deadlines.
- Follow Treasury's designations and regulator publications.
What is unsettled
- Who Treasury designates next.
- How regulators will coordinate if one provider falls under both regimes.
- When critical supplier designations under the Bill can begin, because they depend on related regulations.
Sources
Frequently asked questions
Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited, with effect from 13 July 2026.
Potentially, because the tests differ. The Bill also limits designation for a service that already makes a company an RDSP or RMSP, so check service by service.
No. Firms remain responsible for managing third-party risk, operational resilience and exit planning.
No. It comes from financial services legislation and is overseen by the Bank of England, PRA and FCA.