Beyond the Regulatory Perimeter: The Direct Oversight of Critical Third Parties

For decades, financial services regulation has largely focused on regulated firms themselves. Outsourcing, of course, has never meant outsourcing accountability. But regulators have traditionally relied on firms to manage the risks arising from the third parties on which they depend.

That approach is changing. Under the EU's Digital Operational Resilience Act (DORA) and the UK's Critical Third Parties (CTP) regime, certain technology providers are now subject to direct regulatory oversight. The regulatory perimeter is expanding beyond financial services firms to encompass organisations whose services have become critical to the functioning of the financial system.

Why the change?

Modern financial services are increasingly dependent on a relatively small number of large technology providers. Cloud infrastructure, software platforms, cybersecurity tools and other shared services support multiple firms, markets and important business services. This creates significant benefits in efficiency and capability, but also potentially systemic concentration risk.

The July 2024 CrowdStrike disruption illustrated how a technology failure outside an individual bank can have far-reaching consequences across sectors and jurisdictions. It was not simply a question of one firm's outsourcing arrangements: a common dependency could disrupt many organisations simultaneously. Major cloud and technology outages have reinforced the concern.

For regulators, the question is no longer only whether individual firms have effective third-party risk management (TPRM). It is also whether the financial system can withstand the failure or severe disruption of a provider on which many firms rely. Substitutability, hidden dependencies, fourth parties and the resilience of important business services (IBS) are central to that assessment.

DORA: what does direct oversight actually require?

DORA applies from 17 January 2025. Alongside its obligations on financial entities, Chapter V establishes an EU-wide oversight framework for designated critical ICT third-party service providers (CTPPs). The European Supervisory Authorities designate providers against statutory criticality criteria, including systemic impact, the number and importance of dependent financial entities and the substitutability of the services concerned. A designated provider is overseen by a Lead Overseer.

Oversight is substantive rather than merely a registration exercise. The Lead Overseer assesses whether the CTPP has appropriate arrangements for ICT risk management and security, continuity of services, physical security, governance, testing, incident handling and the management of subcontracting and other dependencies. The Lead Overseer may request information and documents, conduct investigations and inspections, and issue recommendations concerning identified risks and deficiencies. DORA also provides mechanisms for follow-up, enforcement of cooperation obligations and supervisory coordination.

In practical terms, this means a provider that previously responded principally to contractual due diligence from individual clients can now face direct, coordinated scrutiny of the controls and resilience arrangements underpinning services used across the EU financial sector.

However, the distinction between oversight of a provider and supervision of a financial entity matters. The Lead Overseer does not take over the firm's assessment of its particular service, business impact, concentration exposure or exit arrangements. DORA continues to require financial entities to manage ICT third-party risk as part of their ICT risk management framework, including due diligence, contractual safeguards, registers of information and exit strategies.

Regulatory reference: Regulation (EU) 2022/2554 (DORA), particularly Chapter V ↗.

The UK CTP regime: detailed operational resilience requirements

The UK framework was established under the Financial Services and Markets Act 2023. HM Treasury designates providers whose disruption could threaten the stability of, or confidence in, the UK financial system. The Bank of England, PRA and FCA then oversee those providers through a coordinated regime. The first UK designation list includes AWS, Google Cloud, Microsoft and Oracle.

Importantly, the UK regulators have already published detailed operational resilience rules for CTPs, rather than merely signalling an intention to regulate them. Their joint final policy was issued in November 2024 as Bank of England/PRA PS16/24 and FCA PS24/16, supported by the joint SS6/24. The rules took effect on 1 January 2025, but the obligations apply to an individual CTP from the effective date of its HM Treasury designation order, with transitional arrangements for specified requirements.

At the centre of the framework are eight CTP Operational Risk and Resilience Requirements relating to systemic third-party services:

1. Governance: Clear accountability, roles, escalation and oversight of the services provided.
2. Risk management: Identifying, assessing and managing risks to the delivery of systemic services.
3. Dependency and supply chain risk management: Understanding and controlling dependencies, including key Nth-party providers.
4. Technology and cyber resilience: Managing technology vulnerabilities and cyber risks that could disrupt systemic services.
5. Change management: Controlling changes, including technology updates, that could undermine resilience.
6. Mapping: Identifying the people, processes, technology, facilities, information and other resources necessary to deliver systemic services.
7. Incident management: Detecting, responding to, recovering from and communicating about operational incidents.
8. Termination of services: Managing the risks associated with cessation or termination of systemic services.

There are also requirements for self-assessments, scenario testing, incident management playbook exercises, information sharing, record keeping and incident reporting. CTPs are expected to test their ability to continue providing systemic services under severe but plausible scenarios and to exercise their financial-sector incident management arrangements with a representative sample of affected firms.

A particularly significant feature is the requirement for a CTP to establish an appropriate maximum tolerable level of disruption for each systemic third-party service and share this with firms using that service. The UK regulators expect at least one time-based metric, with other metrics where appropriate. This creates an important connection to firms' own important business services and impact tolerances, but the two concepts are not interchangeable: a firm's impact tolerance is set by reference to the consequences of disruption to its IBS, while the CTP's measure concerns its systemic third-party service.

The regime also provides regulators with information-gathering, investigation and enforcement powers, supported by a skilled-persons framework. SS7/24 addresses reports by skilled persons in relation to CTPs. These are meaningful supervisory tools directed at providers outside the traditional regulated-firm perimeter.

Primary UK references: Bank/PRA PS16/24 ↗ · FCA PS24/16 ↗ · Joint SS6/24 ↗ · UK CTP framework and designations ↗.

And what about AI foundation models?

One striking omission from the initial UK CTP list is the providers of AI foundation models. As financial firms increase their use of general-purpose AI, dependency and concentration risk may extend beyond traditional cloud infrastructure into model providers, model hosting, data and related supply chains.

There is an important distinction here: the EU AI Act imposes its own obligations on providers of general-purpose AI models, including additional requirements for models presenting systemic risk. These requirements sit alongside, rather than replace, DORA's ICT risk and critical-provider oversight framework. They have different scopes, regulatory objectives and triggers. A foundation model provider is not automatically a DORA-designated critical ICT third-party merely because it is subject to the AI Act.

As AI becomes more deeply embedded in important business services, regulators and firms will need to consider how these regimes interact and whether existing designation approaches adequately capture emerging concentrations.

The elephant in the room: accountability remains with the firm

Direct regulation of critical third parties does not transfer accountability away from the financial services firm using them. Its Board and senior management remain responsible for understanding and managing the risks arising from third-party arrangements, maintaining operational resilience and protecting customers.

This is the elephant in the room. Even where a provider is designated as critical, subject to inspections and required to strengthen its own controls, the firm cannot stop doing its job. It must continue to assess whether the service is suitable, understand its dependencies, monitor performance and control effectiveness, test disruption scenarios and prepare credible exit or substitution arrangements.

In JADEtc Academy's training, we frame this around the three Os of TPRM:

• On-Boarding: Initial materiality and risk assessments, due diligence, concentration analysis, contract and control requirements, and allocation to appropriate oversight tiers.
• OnGoing (in service): Refreshing materiality and risk assessments, monitoring resilience and performance, obtaining assurance, managing incidents and changes, and testing contingency arrangements.
• Off-Boarding: Planning and executing exit, transition or substitution while controlling continuity, data, operational and residual risks.

Materiality and risk assessment are not one-off exercises at onboarding. They should be maintained and refreshed across all three stages as the arrangement, the provider, the wider market and the firm's own important business services change.

What might direct oversight improve?

There is, nevertheless, a potentially important upside. Providers subject to direct regulatory oversight should develop a clearer understanding of the resilience, governance and assurance expectations placed on their financial services clients. That could lead to better information sharing, more consistent evidence of controls, improved incident communication and more meaningful assurance.

Firms should use that opportunity, but not mistake designation for a regulatory seal of approval. A provider's compliance with its own obligations cannot establish whether a particular firm's use of its services is sufficiently resilient. The risks depend on the services provided, how they are configured and integrated, the firm's concentration exposures and the consequences of disruption for its customers and important business services.

Implications for Boards and senior management

• Understand which important business services rely on designated CTPs and other concentrated technology dependencies, including indirect and fourth-party exposures.
• Challenge whether existing assurance is sufficient, rather than treating direct supervision of a provider as a substitute for firm-level oversight.
• Ensure materiality and risk assessments are refreshed throughout the three Os of TPRM, including emerging AI dependencies.
• Test severe but plausible disruptions, including common-provider failures affecting multiple services and firms at once.
• Review recovery, workaround, substitutability and exit assumptions: are they genuinely achievable in a sector-wide event?
• Ask whether new regulatory obligations on providers are producing better, more timely and decision-useful assurance information.

A new regulatory relationship, not a transfer of responsibility

Bringing critical providers into the regulatory perimeter is a logical response to the scale and concentration of modern financial services dependencies. It gives regulators a more direct view of providers that individual firms may struggle to assess fully on their own.

But the fundamental principle remains unchanged: outsourcing is not risk transfer. The challenge for firms is to combine the benefits of direct oversight with robust, proportionate TPRM and operational resilience frameworks of their own. The challenge for critical providers is to demonstrate that they understand and can meet the resilience expectations of the financial system they increasingly underpin.