When the operational resilience regulations were introduced in July 2022 by the UK Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA), they ushered in a major shift in how financial institutions (FIs) approached resilience.
Suddenly, important business services (IBS) became industry lexicon, as firms sought to define those processes, understand their dependencies, carry out testing against reasonable worst-case scenarios, and address any resilience issues which emerged.
It also surfaced a growing realisation of just how dependent the financial sector is on a number of critical third-parties (CTPs) – whether cloud providers, financial platforms and FinTech providers, or more traditional outsourced service providers.
The Bank of England (BoE) also began to worry about the systemic risk which might follow if one of those CTPs failed, while individual FIs started demanding more resilience planning assurance from their service providers and began thinking about stressed exits if one of them failed.
Regulation of these CTPs was inevitable.
The BoE’s critical third-parties regime officially came into force in January this year and the EU has also established a similar CTP regime under the Digital Operational Resilience Act (DORA), with designations of CTPs expected in Q4 2025.
The UK Cyber Security and Resilience Bill is also being planned, with a focus on regulating managed service providers and third-parties who are key to operators of essential services under the Network and Information Systems Regulations.
Clearly, third-party resilience is the hot topic of 2025… but how resilient are we really?
It can often seem unthinkable that major service and infrastructure providers may fail and, while the major cloud service providers offer very high levels of availability and options to procure services with significant redundancy, failures do happen. Looking through recent Azure incidents (and Microsoft is to be commended for its transparency in reporting incidents) illustrates that even a major provider is still impacted by configuration change issues and incidents in which multiple failures cascade to cause unexpected system behaviour: serving to underline the complexity of service provision.
The CrowdStrike incident of July 2024 was also a salutary reminder of the interaction between critical software components and cloud-based services, when an upgrade to a key security component failed, impacting some 8.5 million computers worldwide.
The UK’s National Cyber Security Centre also frequently reminds us of the cyber threat to third-parties, as attackers shift tactics to target supply chains as an attack vector.
All of which serve to remind us of the importance of considering scenarios where third-parties fail, perhaps catastrophically, and how we can manage the consequences of such incidents for financial institutions, their customers and the broader sector.
Trust but verify?
The CTP regime will require CTPs to undertake their own scenario testing to determine whether severe but plausible scenarios could cause intolerable levels of disruption to their customers.
There has been much hard-won experience gained by financial firms in carrying out such testing, and much to be gained by sharing that with third-parties, along with standardisation of the libraries of scenarios used in testing, in which relevant results can be shared with clients and customers.
Of course, there will be diversity of practices across third-parties, but perhaps this is an area where regulators and key financial firms need to make their expectations around the quality and the type of resilience-evidence that they seek clear.
We also need consensus on how to undertake collaborative testing between clients and their third-parties, hoping to avoid similar (but subtly different) requests from many financial firms on each CTP, leading to duplication of testing and unnecessary effort.
Over time, we can expect to see standards emerge and a shift towards certification of independent test providers, as we have done with penetration testing and incident exercising in the cyber domain.
The CTP regulation also requires third-parties to undertake incident management playbook exercises. The question is: what does this really mean, and how do they engage “a representative sample of the entities that provide a systemic third-party service” in that process? Again, community consensus is needed here to both set expectations over such testing and agree a fair method of selecting that representative sample of clients.
We also need to remember that there are many third-parties that are likely to fall outside the narrow scope of the CTP regime. The failure of these entities could still impact financial firms and cause intolerable harm – but the scale and impact fall short of being systemic.
We should be clear on community expectations on those third-parties over their resilience.
While this may reflect in contractual rather than regulatory obligations, many may also find themselves in the many managed service providers who are expected to come within the scope of the UK Cyber Security and Resilience Bill.
Resilience – a broader sector view
Each CTP is (by definition) systemically important to the financial sector. If one fails, it can trigger systemic stress across the UK’s financial landscape. The ripple effects extend far beyond the CTP itself, and financial institutions must assess how such a failure impacts their IBS, while the wider sector needs to evaluate and manage broader consequences.
The sector response framework within the financial sector is a start, but we as a community must work harder to understand the operational and financial contagion that might follow a major outage and establish ways to manage those consequences.
This prompts fundamental questions about our approach to resilience in the financial sector. We’ve deliberately built dependencies on critical infrastructure, such as the UK’s payment systems, for reasons of scale, cost-efficiency and governance. But should we now aim to diversify these systems to enable service substitution during major disruptions? And if so, how can we do it without incurring prohibitive costs?
Equally, there is a natural tension between the desire of commercial service providers to commercially lock in financial firms by offering enhanced services and functionality, and the need for financial firms to be able to quickly port service provision to an alternate provider in the event of a stressed exit or operational resilience issue.
These are big strategic choices for both individual financial firms and for the UK financial sector as a whole. It would be all too easy to place this in the ‘too complex’ category.
But there are architectural decisions which can be taken now by individual financial firms around how they consume a third-party service. The right choices can make substitution more straightforward and avoid lock-in, while also designing systems to fail gracefully if a key third-party service becomes unavailable, rather than being fragile to such failures. This resilience-by-design mindset focuses on modularity of systems, fault tolerance, and graceful degradation.
As a community, we will need to consider broader substitution arrangements in the event we lose key third-parties or infrastructure providers, but these discussions will need the engagement of regulators to progress, given the competition and legal issues they raise. Without such engagement and collective action to develop a vision for the resilience of the UK financial sector, we can expect progress to be limited.
The road ahead
Third-party resilience will be a key theme for many financial firms during H2 2025 and into 2026, with newly designated CTPs working to understand exactly what their clients and regulators expect of them.
The next few months will be key to the effectiveness of the CTP regime and will set the course for the years ahead in how we align the expectations of regulators, clients and their third-parties.
Now is the time for creating a vision for the longer-term resilience of the UK financial services sector, which considers our changing infrastructure, third-party landscape and, at its core, is resilient by design.
The author
David Ferbrache is managing director of Beyond Blue
