<\/p>\n
The designations<\/a>, made by the UK Treasury, apply to Amazon, Google, Microsoft, and Oracle, and reflect the fact those companies provide services many UK financial services firms rely on, according to the government.<\/p>\n CTPs must comply with six fundamental rules, much like the high-level principles that UK-regulated financial services firms must adhere to in, for example, the FCA Handbook. Those rules require providers to: conduct their business with integrity; and with due skill, care and diligence; act in a prudent manner; have effective risk strategies and risk management systems; organise and control their affairs responsibly and effectively; and deal with each regulator in an open and cooperative way, and disclose to each regulator appropriately anything relating to the CTP of which it would reasonably expect notice.<\/p>\n The scope of the fundamental rules is mainly limited to services deemed \u2018systemic third party services\u2019 that providers provide to firms. However, the exception to this is the sixth rule covering regulatory cooperation and disclosures \u2013 it is wider in scope and applies to all the services providers offer.<\/p>\n CTPs also face separate a wider set of requirements, including around operational, technology, cyber and supply chain risk and resilience. They have obligations to report certain incidents to regulators and must develop plans to support firms in terminating and exiting from service contracts and recover data and other assets of theirs in the process.<\/p>\n More detail on the expectations on providers under the CTP regime were set out in a policy paper<\/a> published in November 2024 by the Bank of England, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA). The three regulators will jointly oversee the providers\u2019 compliance with their obligations and have wide-ranging information gathering and inspection powers.\u00a0<\/p>\n Confirmation of the first four designations gives practical effect to the CTP regime, which has otherwise sat dormant since it was formally introduced on 1 January 2025<\/a>.<\/p>\n Technology law expert Luke Scanlon<\/a> of Pinsent Masons said: \u201cThe CTP duties set out a list of requirements that will require significant work to be undertaken both in terms of responding to the regulators and directly providing financial institutions with information. The latter will be an area which we will see a lot of attention given to over the coming months.\u201d<\/p>\n Angus McFadyen<\/a> of Pinsent Masons, who supports financial services firms with their technology contracts, said the CTP regime \u201chas been waiting to be brought to life with the completion of the designation process\u201d. It also represents a \u201csignificant step forward\u201d that brings the UK into line with the equivalent\u00a0\u2018critical ICT third-party service providers\u2019 (CTPPs)\u00a0regime<\/a>\u00a0that operates under the EU\u2019s Digital Operational Resilience Act (DORA), he said.<\/p>\n The four CTPs designated in the UK stand in contrast to the 19 CTTPs designated under DORA.<\/p>\n \u201cBeing a CTP is not the same as being a regulated financial services firm,\u201d said McFadyen. \u201cCTPs are under oversight, not supervision.\u201d<\/p>\n \u201cFor firms, it is critical to recognise that using a CTP does not reduce any existing oversight or accountability requirements.\u00a0Many CTPs provide complex technology services, and we know that the expectations are only increasing in respect of technology-related system and control requirements,\u201d he said.<\/p>\n \u201cFor firms, using a CTP does come with some tangible differences.\u00a0Firms will still need to negotiate contracts in the normal way, but some obligations apply to the CTP when it is providing \u2018systemic third party services\u2019, which for many will be a subset of what is purchased from a CTP.\u00a0For these systemic third party services, the CTP is subject to enhanced information sharing and testing rules, designed to achieve greater transparency for firms.\u00a0The reality is that a good number of CTPs are already at the forefront of information sharing, delivering real time dashboards, but for others this will require a step up,\u201d he added.<\/p>\n","protected":false},"excerpt":{"rendered":"
The designations, made by the UK Treasury, apply to Amazon, Google, Microsoft, and Oracle, and reflect the…\n","protected":false},"author":2,"featured_media":685668,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-685667","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/685667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=685667"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/685667\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/685668"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=685667"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=685667"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=685667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}