Critical third-party oversight is a regulatory regime under which financial authorities directly supervise certain outside companies that supply services to banks, insurers, payment firms and market infrastructures. The providers concerned are those on which so many firms depend that a failure or prolonged outage could threaten the stability of the financial system as a whole. Typical examples are large cloud computing companies, data and software suppliers and core technology vendors.
The regime is a recent addition to financial regulation. Traditionally, supervisors reached outside providers only indirectly, by requiring each regulated firm to manage its own third-party risk. Oversight of critical third parties adds a second layer aimed at the provider itself, because no single customer can assess or control the risk that arises when a whole sector relies on the same few suppliers.
Why direct oversight was introduced
Financial firms have moved a growing share of their technology and operations to specialist providers. This brings efficiency and often better security, but it creates concentration risk at the level of the system. If one provider supports the payment, trading or customer systems of many institutions, a single incident, whether a cyber attack, a faulty software update or a data centre failure, can interrupt services across the market at the same moment.
Individual firms have limited bargaining power with the largest providers and limited sight of their internal controls. Regulators concluded that firm-level vendor risk management and outsourcing rules, while still necessary, could not address this shared exposure, which is a source of systemic risk and a threat to financial stability.
The European Union regime
In the European Union the framework is set by the Digital Operational Resilience Act (DORA), a regulation that has applied since 17 January 2025. The three European Supervisory Authorities for banking, markets and insurance designate information and communication technology providers as critical, based on criteria such as the systemic impact of a failure, the importance of the firms that rely on the provider, and how hard it would be to replace. Designation draws on the registers of contractual arrangements that every financial entity must keep. The first designations were announced in 2025.
Each designated provider is assigned a Lead Overseer from among the three authorities. The Lead Overseer can request information, conduct investigations and on-site inspections, and issue recommendations on matters such as security, subcontracting and exit arrangements. Providers that do not cooperate can face periodic penalty payments, and supervisors can ultimately require financial entities to suspend or end their use of a provider that ignores recommendations. Providers pay fees to cover the cost of oversight.
The United Kingdom regime
In the United Kingdom, the Financial Services and Markets Act 2023 gave the Treasury power to designate critical third parties on the recommendation of the regulators. The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority then apply a common rulebook to designated providers, which came into force at the start of 2025. The first four providers, all large cloud and technology companies, were designated in July 2026. The rules include a set of fundamental principles, requirements on governance, risk management, dependency and supply chain mapping, regular scenario testing, incident management and the reporting of serious incidents to the regulators and to affected customers.
The UK rules are tied to the country's operational resilience framework, under which firms identify each important business service they provide, set an impact tolerance for disruption and carry out operational resilience mapping of the resources behind it.
Approaches elsewhere
In the United States, the Bank Service Company Act has long allowed the federal banking agencies to examine services that third parties perform for banks, and the agencies run a joint programme for significant technology service providers. Internationally, the Financial Stability Board published a toolkit in 2023 to help authorities and firms manage third-party risk in a consistent way, and the Basel Committee has issued principles for banks on the same subject.
What remains the firm's responsibility
Designation of a provider does not shift responsibility away from its customers. A regulated firm that uses a third-party service provider must still carry out due diligence, include audit and access rights in its contracts, record the arrangement in its regulatory outsourcing register, test its own continuity and exit plans and manage operational risk from the relationship. Regulators have also stated that designation is not a quality mark and should not be used by providers in marketing.
Open questions
The regimes are young and several issues are unsettled. Critical providers are global companies overseen by several authorities with different rules, so coordination and mutual reliance matter. Smaller providers worry that customers may favour designated firms, increasing concentration further. It also remains to be seen how far recommendations and penalties can change the behaviour of very large technology companies for which financial services are only one of many markets.