Bank of England, PRA, and FCA begin Critical Third Party

Cresthaven Analytics Intelligence Brief

Headline

Bank of England, PRA, and FCA begin Critical Third Party oversight on 13 July 2026 following HM Treasury designation

Executive Summary

Formal oversight of the first designated Critical Third Parties begins 13 July 2026. The Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority made this announcement on 10 July 2026, following HM Treasury's designation, which activates the statutory oversight regime under the Financial Services and Markets Act 2023.

Bottom Line

The Critical Third Party oversight regime is active as of 13 July 2026, with the Bank of England, PRA, and FCA holding concurrent supervisory authority over each designated entity. Regulated firms that rely on a designated Critical Third Party carry their own resilience obligations in parallel; designation of the provider does not discharge the client firm's accountability. The first cohort of designations establishes the practical application of HM Treasury's designation criteria, setting the reference point against which future designations are assessed.

Key Regulatory Signals

Oversight Regime Goes Live in Three Days: The Critical Third Party framework activates on 13 July 2026. Designated entities and the financial firms that rely on them face live supervisory obligations from that date, not a future implementation window.
Designated Entities Face Tripartite Scrutiny: The Bank of England, PRA, and FCA exercise concurrent oversight authority over each designated Critical Third Party. Firms whose operational continuity depends on a designated provider must assess whether their contractual and resilience arrangements satisfy the incoming supervisory expectations of all three authorities.
Financial Firms Carry Downstream Exposure: Regulated firms using a designated Critical Third Party remain responsible for their own operational resilience obligations. The designation does not transfer accountability; it adds a parallel supervisory layer over the third party itself, which may generate new information rights, audit expectations, and exit-planning requirements for client firms.
HM Treasury Designation Is the Trigger: The statutory power to designate Critical Third Parties sits with HM Treasury under the Financial Services and Markets Act 2023. The current cohort represents the first exercise of that power, establishing the baseline for how designation criteria are applied in practice.
No Grandfathering Period Indicated: The announcement states oversight begins on 13 July 2026 with no transitional buffer referenced. Designated entities and their regulated-firm clients have no stated grace period before supervisory expectations apply.

Regulatory Delta

- The Critical Third Party framework has no direct precedent; it is the first statutory structure for third-party oversight in UK financial services.

- The 13 July 2026 activation date moves the framework from legislative authority into live supervisory operation. This is a structural shift: policy becomes enforcement.

- The regime sits alongside the FCA and PRA operational resilience rules that took full effect in March 2025, tightening the overall architecture for managing third-party risk across the UK regulated sector.

Materiality Classification

HIGH — A statutory oversight regime activates on 13 July 2026, imposing live supervisory obligations on designated Critical Third Parties and creating immediate downstream compliance exposure for all regulated firms that rely on those entities.

Time Horizon

effective — 2026-07-13

Intelligence Outlook

Monitor the Bank of England, PRA, and FCA for publication of supervisory expectations, information-gathering requirements, and any additional HM Treasury designation notices as the regime moves into active operation.