Committee publication · Correspondence · 14 July 2026
Correspondence from Economic Secretary to the Treasury on Critical Third Parties Regime, dated 10 July 2026
From: Treasury Committee
Summary
Economic Secretary Rachel Blake updates the Treasury Committee on implementation of the Critical Third Parties regime. Four cloud service providers—Amazon Web Services, Google Cloud, Microsoft Ireland Operations, and Oracle Corporation UK—have been designated as critical third parties to the UK financial sector, with regulations coming into force on 13 July 2026. Further designations are expected as a rolling programme.
Key findings
- First designations under the CTP regime published 10 July 2026; regulations take effect 13 July 2026
- Four entities designated: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited
- Designations follow consultation with Bank of England, PRA, and FCA as required by statute
- Government intends a risk-based, proportionate approach targeting only systemically critical service providers
- Further designations expected in future as rolling programme, though limited to small number of providers
Tone
ProceduralTopics
Key actors
Rachel Blake MP, Dame Meg Hillier MP, Lucy Rigby KC MP, Bank of England, Financial Conduct Authority, Prudential Regulation Authority, Amazon Web Services, Google Cloud
Notable line
“These designations mark an important first step in implementing the CTP regime and are a crucial part of the Government's wider and ongoing work to strengthen the resilience of the UK financial sector.”
Key Quotes
“Regulations have today been published making first designations under the CTP regime. Regulations will come into force on 13 July 2026 giving legal effect to the CTP designations.”
“These designations follow a period of positive and constructive written and face to face engagement with the third parties as part of the evidence gathering process to ensure designation decisions are proportionate and targeted.”
“As a rolling-programme, we expect to make further designations in the future, though it is our intention that the CTP regime's risk -based and proportionate approach will result in the designation of only a small number of third party service providers whose failure or disruption …”
“Designation does not imply any judgement on the quality, security or reliability of the services provided by the third party service provider and does not diminish the responsibilities of regulated firms …”
Source · parliament.uk record ↗