Regulation guide

UK Critical Third Parties Regime

Operationalize the UK Critical Third Parties Regime requirements—from regulatory obligations and evidence collection to vendor assessments, continuous monitoring, governance, and remediation workflows.

Overview

The UK critical third parties regime is aimed at systemic risk from service providers whose failure could threaten the financial sector. It is different from ordinary outsourcing rules because designated critical third parties can be subject to direct regulatory requirements.

The regime recognizes that a small number of technology, cloud, data, and infrastructure providers can become critical to many firms at once. The failure of one provider can create sector-wide disruption.

Rather than prescribing identical controls for every relationship, the regulation emphasizes a risk-based approach, requiring organizations to apply governance, oversight, controls, monitoring, and due diligence according to the criticality and risk of each relationship.

This implementation guide explains what the regulation requires, how those requirements translate into operational controls and evidence, and how Halbarad helps organizations operationalize compliance through assessments, continuous monitoring, governance workflows, and supply chain risk intelligence.

Official Sources

The FCA policy statement says the rules came into force on 1 January 2025.

Intent of the Guide

The regime recognizes that a small number of technology, cloud, data, and infrastructure providers can become critical to many firms at once. The failure of one provider can create sector-wide disruption. The UK regime gives regulators tools to oversee designated providers directly while firms continue to manage their own outsourcing and resilience obligations.

Operationalization Requirements

  • designation of critical third parties by HM Treasury;
  • direct requirements for designated providers;
  • information gathering, testing, incident notification, and resilience expectations;
  • firm dependency and concentration visibility;
  • coordination with outsourcing and operational resilience frameworks.

Evidence Requirements

  • Dependency map showing providers that could create concentration risk.
  • Services, systems, data, and business services supported by major providers.
  • Contract, resilience, incident, and exit evidence.
  • Monitoring records for outages, incidents, advisories, and provider changes.
  • Management reporting on concentration exposure.

Common Gaps

  • Firms know direct cloud providers but not shared subservice dependencies.
  • Concentration analysis is high-level and not connected to business services.
  • Provider incident evidence does not show which important services were affected.
  • CTP regime work is separated from outsourcing and operational resilience records.

How Halbarad Helps

Halbarad can help firms map direct and downstream dependencies, show concentration exposure, monitor provider change signals, and connect provider incidents to services, systems, data, owners, and remediation.

Disclaimer

This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.