Hywel Jenkins

More than meets the eye: a new UK regime for critical third parties: what does it mean for regulated firms?

Financial services regulators across the globe are considering how to regulate in some way cloud providers and other information and tech service companies (critical third parties (CTPs)) which many banks and other financial institutions rely on heavily for critical services. While the European Union’s new Digital Operational Resilience Act (DORA) imposes new requirements on both CTPs and the regulated firms which use their services, the UK has started the ball rolling on a new CTP regime aimed only at the CTPs themselves. The UK regulators’ proposals for their part in the new regime are out for consultation. We take a look at some key areas of the proposals which remain unclear from the financial sector’s perspective.