The rapid evolution of technology over the past decade has left many industries heavily dependent on a small number of cloud platforms and SaaS providers. Few illustrate that statement better than the UK financial sector.
It’s exactly the reason why the Government, in close collaboration with financial regulators, has introduced the Critical Third Parties (CTPs) regime.
I’m sure many in the sector will have welcomed July’s decision to designate Microsoft, Google Cloud, AWS and Oracle as the first CTPs, and it certainly marked the point at which the UK’s new oversight regime moved from theory and policy into practice. It’s reassuring and comforting. But only to a point.
The CTP regime establishes an important regulatory baseline. The bigger challenge for financial institutions is understanding and reducing operational risk.
Just because designated CTPs are now subject to greater regulatory oversight doesn’t automatically give financial institutions greater visibility into the wider software ecosystem that supports them. Regulatory oversight and operational visibility don’t always go hand in hand.
A different kind of dependency
To understand why the CTP regime matters, it’s worth looking at the dramatic shift in the financial services landscape over the past two decades.
Twenty years ago, banks built, owned and managed much of their own software infrastructure. Fast forward to today and things are so different. Cloud platforms, specialist software, outsourced infrastructure and third-party services have become part of day-to-day operations.
For everything from processing payments to managing customer data to running internal systems, financial institutions now rely on an extensive network of software suppliers, cloud platforms and SaaS providers.
That shift has brought huge benefits. It’s made the sector more efficient, more innovative and more competitive. It has also concentrated operational risk. As software has become more centralised and cloud adoption has accelerated, more firms have become dependent on the same providers for an ever-expanding range of critical services. The growth of AI services could reinforce that trend further.
That’s exactly what the CTP regime is designed to address. It recognises that some providers have become so deeply embedded in the UK’s financial system that disruption to their services could have consequences across the wider market. It also creates an opportunity for firms to have more meaningful conversations about the resilience of those providers and the risks that sit beneath them.
The responsibility still sits with businesses
It’s easy to see how leaders might take comfort from the establishment of the new regime. If the regulator is supervising the services provided by designated CTPs, surely that’s one less thing to worry about? Well, not quite.
Oversight of CTPs is only one part of the picture. Financial institutions need greater visibility into the software suppliers, infrastructure and services supporting those providers, as well as the risks that could affect their continued delivery. More and more, those conversations are taking place in the boardroom.
Many financial institutions already have a detailed understanding of their own critical applications and software dependencies. Visibility becomes less clear further down the chain, where designated CTPs rely on their own software suppliers, infrastructure and services. Those fourth-party dependencies have historically been opaque to financial institutions, creating the potential for a further layer of concentration risk beneath the CTPs themselves.
Historically, financial institutions have had limited visibility of those dependencies and little opportunity to ask detailed questions about them. The CTP regime gives them a stronger foundation for doing so, helping them better understand how risk is managed across the wider software ecosystem.
Preparing for stressed exits
Building that understanding begins with looking beyond an organisation’s direct dependencies and into the wider software supply chain supporting its critical services.
From there, firms need a clear view of how disruption would spread through the organisation, which services would be affected first, and where recovery efforts should be prioritised.
Resilience planning also needs to account for scenarios beyond a technical outage. A critical software supplier may experience financial instability, enter administration or lose the ability to provide an essential service. Those are exactly the kinds of situations that stressed exit plans are designed to address.
The objective isn’t simply to satisfy a regulatory requirement. It’s to understand how critical services would continue to operate if a supplier could no longer deliver them, and to validate those arrangements before they’re ever needed. For many organisations, that includes software escrow and other continuity mechanisms that have already been tested under realistic conditions.
Technology failures are only one source of disruption. Organisations that understand their software dependencies, test their recovery arrangements and plan for a range of failure scenarios will always be better placed to respond.
The designation of CTPs is an important milestone for the sector and raises the standard for resilience across some of the UK’s most important technology providers. Financial institutions should see the designation of CTPs as an opportunity to look beyond the providers themselves and better understand the wider software ecosystem that supports them. That’s how the sector could build greater operational resilience over the years ahead.