HM Treasury makes first designations under UK CTP regime

Designation process

For the purposes of the UK CTP regime, a CTP is a third party provider providing critical services to regulated firms and financial market infrastructures (FMIs), whose service disruption or failure has the potential to impact the stability of, or confidence in, the UK financial system. HM Treasury is required to make decisions (generally based on recommendations from the regulators) on which third party providers to designate as CTPs, in line with the criteria set out in section 312L of the Financial Services and Markets Act 2000 (FSMA). 

HM Treasury has previously published guidance on the designation process, outlining its general approach. A letter it sent to the House of Commons Treasury Select Committee (TSC) confirming the designations of the Service Providers gives an insight into how the process was followed in this specific instance. It notes that the Service Providers are the largest cloud service providers to the UK financial sector and states:

“These designations follow a period of positive and constructive written and face to face engagement with the [Service Providers] as part of the evidence gathering process to ensure designation decisions are proportionate and targeted. Third party service providers are made up of multiple entities and designation is made on an entity basis. Our assessments have considered the statutory criteria for designation and have also included identifying the most relevant entity for designation. Consultation has also taken place with the financial regulators … in line with statutory requirements.”

What does designation mean for the regulators, CTPs and firms?

The role of the regulators under the UK CTP regime is limited to joint oversight in respect of the critical services that CTPs provide to firms. This includes regulatory engagement, information gathering and resilience assessments, with the overall goal of strengthening system-wide resilience. The regulators will periodically review whether CTPs continue to meet the designation criteria and evaluate the effectiveness of the oversight approach, making recommendations to HM Treasury as appropriate.

For their part, CTPs must comply with the regulators’ rules and expectations under the regime. These requirements focus on their operational risk management and resilience capabilities. In broad terms, CTPs must identify and effectively manage risks to their critical services, as well as maintaining open and timely communication with the regulators and the firms that rely on them, particularly in the event of a major incident.

For firms, the UK CTP regime complements the regulators’ outsourcing and operational resilience regimes, under which firms are responsible for managing their third-party arrangements. This includes due diligence, risk management and contingency planning. It does not replace or lessen firms’ accountability, nor that of their boards and senior management. As HM Treasury makes clear in its letter to the TSC:

“Designation does not imply any judgement on the quality, security or reliability of the services provided by the third party service provider and does not diminish the responsibilities of regulated firms, who remain accountable for their outsourcing arrangements including the identification and management of risks arising from their reliance on third party service providers.”

An ongoing programme with an evolving scope

This is an ongoing programme and the scope of entities under the regime will continually evolve as further designations are considered. HM Treasury’s press release notes that the government is taking a targeted and proportionate approach, and that other entities may be designated over time, where necessary, to protect UK resilience. 

For some time, the TSC has been urging the government to make designations under the UK CTP regime. Recently, one of the three recommendations in its January 2026 report on AI regulation in financial services was that HM Treasury must designate the major AI and cloud providers as CTPs. In its April 2026 response, HM Treasury stated that it expected to make initial CTP designation decisions “by the end of this year”.

The TSC Chair, Meg Hillier, has responded to the designations of the Service Providers, welcoming HM Treasury’s decision to take this step, and adding that the TSC’s focus would now turn to how the regulators implement the regime. Ms Hillier added: “As the use of AI in financial services expands, I believe there may come a time when the government needs to consider designating specific AI firms under the [regime].”

This area is considered in two key recent publications, both of which were published shortly before the designations of the Service Providers were made:

• The FCA-commissioned independent Mills Review (Review) on AI and the future of retail financial services (see our blog post for a summary of the Review). One of the seven priority recommendations put forward by the Review calls for strengthening system-wide coordination and oversight (priority recommendation 2). In this regard, the Review considered (among other things) the regulatory implications of the level of concentration across the AI supply chain and its connection to regulatory regimes - notably operational resilience and CTPs. Its assessment is that, by 2030, much critical financial services infrastructure will run on AI, while increased AI adoption and concentrations in model providers, cloud infrastructure and other upstream technology services may become more important drivers of system-wide resilience risk. In turn, this raises questions about how regulators monitor and understand shared dependencies across the financial services ecosystem. The key recommended actions for the FCA Board to consider under priority recommendation 2 include further strengthening coordination and cooperation across the UK operational resilience and CTP regimes.
• The BoE Financial Policy Committee (FPC) July 2026 Financial Stability Report (FSR), which highlighted that recent rapid advances in frontier AI capabilities have increased financial stability risks relating to cyber and operational resilience. The FPC noted, among other things, that these developments underline the importance of operationalising the UK CTP regime.

However, in its letter to the TSC, HM Treasury comments that while it expects to make further designations in the future, its intention is that the UK CTP regime's risk-based and proportionate approach will result in the designation of "only a small number of third party service providers whose failure or disruption could pose wider risks to the UK financial sector."

DORA designations and supervisory cooperation

Some entities designated as CTPs under the UK CTP regime may be subject to oversight under similar regulatory regimes in other jurisdictions, including in the EU under DORA. In November 2025, the European Supervisory Authorities (ESAs) released the list of the first designated CTPPs under Article 31(9) of DORA (see our blog post for a summary). There are 19 initial CTPPs in the EU, compared with four initial CTPs in the UK. 

The UK regulators and the ESAs have entered into a memorandum of understanding to support coordination and information sharing on the oversight of CTPs/CTPPs.

Next steps: the UK CTP regime’s vital role

A joint FCA-PRA blog post, Strengthening resilience across an increasingly interconnected financial system, published soon after the designations of the Service Providers were made, emphasises the importance of firms and regulators looking at the bigger picture when it comes to delivering operational resilience. In a landscape of increasing reliance on common third-party service providers, firms need to look beyond their own business and take a system-wide view. 

This wider perspective is provided by the UK CTP regime as it is designed to complement firm-level regulatory requirements with greater visibility of risks and strengthened communication between CTPs and firms, enhancing resilience across the financial system. As the blog post puts it: “The CTP regime reflects our connected reality.”

Now the regime is live, the immediate actions identified by the FCA and the PRA in the blog post are:

• For firms: continue to consider identification, testing and managing dependencies on critical services. 
• For the Service Providers in their capacity as CTPs: engage openly with regulators and firms, including through testing and information sharing.

Meanwhile, for the regulators, as the TSC Chair’s reaction to the initial designations indicates, attention will now shift to implementation, with Parliamentary scrutiny focused on the regulators’ engagement with, and oversight of, the Service Providers under the UK CTP regime. 

The new FCA/BoE/PRA regulatory regime for operational incident and third party reporting will come into force on 18 March 2027. This development will not only enable the regulators to have better oversight of risks arising from operational incidents and the use of third parties, but also support their future identification of entities for CTP designation recommendations to HM Treasury. For an overview of the new reporting regime, see our blog post.

There is also an upcoming publication to look out for in this space: before the end of this year, the BoE and the PRA intend to launch a consultation on policy relating to ICT and cyber risk management and resilience.