A critical service provider is an outside firm that supplies a service so essential to a financial market infrastructure (FMI) that a failure or disruption at the provider would stop the FMI from working. Typical examples are financial messaging networks, data centre and cloud operators, core software vendors and network carriers. The term comes from international standards for payment systems, central securities depositories, central counterparties and trade repositories, and is now echoed in broader regimes covering critical third parties to the whole financial sector.
The concept addresses a gap in traditional oversight. Authorities can supervise an FMI directly, but if the FMI outsources a key function, the risk moves outside its walls. Treating a provider as critical brings it within the scope of oversight expectations, either directly or through the FMI that uses it. It is a narrower idea than general third-party risk, which covers every supplier a firm uses.
Critical service providers in plain terms
A hospital can have the best doctors in the world, but if the electricity company cuts the power and the backup generator fails, operations stop. The power company is not part of the hospital, yet the hospital cannot work without it.
A critical service provider is the power company for a payment system. It may be a messaging network that carries every payment instruction, or a computer centre where the system runs. Regulators want to know that such providers are just as reliable as the system itself, because a failure at either one has the same result.
Oversight expectations
The Principles for Financial Market Infrastructures, published in 2012 by the Committee on Payments and Market Infrastructures (then CPSS) and IOSCO, include an annex setting out oversight expectations for critical service providers. In summary, a provider is expected to:
- Identify and manage risks. Maintain a risk management framework covering the risks its services pose to the FMIs that rely on it.
- Secure information. Implement strong information security controls to protect confidentiality, integrity and availability, addressing cybersecurity risk.
- Be reliable and resilient. Build systems with adequate capacity, backup sites and recovery plans, tested regularly.
- Plan technology carefully. Manage changes and the technology life cycle so that upgrades do not disrupt users.
- Communicate with users. Keep users informed about risks, incidents and changes, so they can manage their own dependence.
Principle 17 of the PFMI, on operational risk, also requires FMIs to identify and manage risks from key participants, other FMIs, and service and utility providers.
Examples
SWIFT is the classic example. Its messaging network carries instructions for many RTGS systems, CLS and securities settlement systems. Because SWIFT is not itself a payment system, central banks set up a cooperative oversight arrangement for it, led by the National Bank of Belgium, where SWIFT is incorporated, together with other major central banks. Other critical providers include the vendors of central settlement software, operators of shared data centres, and increasingly the large cloud providers that host parts of FMI and bank infrastructure.
Wider regimes for critical third parties
Concern about concentration in technology supply, especially cloud computing, has led to wider laws. In the European Union, the Digital Operational Resilience Act (DORA), applicable from January 2025, created an oversight framework for critical ICT third-party service providers to financial entities, led by the European supervisory authorities. In the United Kingdom, the Financial Services and Markets Act 2023 gave HM Treasury power to designate critical third parties, which are then overseen by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. These regimes reach beyond FMIs to banks and insurers, but they build on the same logic.
Managing dependence on critical providers
FMIs and their users manage the risk in several ways. Contracts set service levels, audit rights and exit plans. Firms run vendor risk management programmes, test contingency arrangements, and keep fallback channels, such as alternative messaging routes, for the most critical payments. Some central banks require RTGS participants to be able to switch to contingency processing if the main network fails.
Concentration remains a structural issue. Many systems around the world rely on the same few messaging networks and technology vendors, so a single failure could have systemic risk effects across markets. That is why oversight increasingly looks at providers directly, rather than only through the institutions that buy their services.