For Heads-of · Practitioner
Critical Third Parties Regime
Also known as: CTP regime
The UK regime under which HM Treasury can designate a third party whose services are critical to the financial sector, bringing it under direct oversight by the Bank of England, the PRA and the FCA. Its rules have applied since 1 January 2025, and the first designations, in July 2026, were four cloud providers.
- critical third parties
- CTP
- operational resilience
- cloud concentration
- financial services
How it works
The Financial Services and Markets Act 2023 lets HM Treasury designate, on the regulators' recommendation, a third party whose failure or disruption could threaten financial stability or confidence. Designated firms must meet the regulators' fundamental rules and operational risk and resilience requirements, set out in their joint policy statement of November 2024. The first designations took effect on 13 July 2026: Amazon Web Services, Google Cloud, Microsoft and Oracle.
What it means for AI
No AI model provider has been designated. Much AI in financial services runs on the designated cloud platforms, but designation transfers no responsibility: firms remain accountable for managing their own third-party arrangements, including the AI services they buy. The regime matters most as a signal of where regulators see concentration risk; see third-party risk.
Where it sits in the register
Concentration on a few providers is the vendor concentration and exit strategy gap, and dependence several layers down is the sub-outsourcing visibility gap. The control is vendor exit strategy and concentration management.
Sources
Related Terms
AI Supply Chain Security
Assuring the integrity and provenance of everything an AI system is built from and depends on: pre-trained models and weights, adapters, datasets, libraries, serving infrastructure, plug-ins and tools. AI adds components that ordinary software supply-chain controls were not built to check.
Impact Tolerance
The maximum tolerable level of disruption to an important business service, set under the UK operational resilience regime. Applied to AI, it asks how long a firm can run without an AI component, or with one that is wrong, before customers or markets suffer intolerable harm.
PRA SS1/23
The Prudential Regulation Authority's supervisory statement setting out five principles for model risk management at UK banks. It took effect on 17 May 2024, applies to AI and machine learning models as to any other model, and was amended in April 2026.
Third-Party Risk
The exposure an organisation carries through dependencies on external parties who build, train, host or operate the AI systems it uses. In AI the exposure is characteristically deeper than the contract: beneath most vendors sits a model provider, and beneath that an infrastructure provider.