Operational Resilience and Third-Party Risk for UK Banks

Executive Summary

A firm’s operational resilience is increasingly predicated on the weakest dependency in its extended supply chain ecosystem. The UK Operational Resilience rules ask each firm to understand and manage its own supply chain, including the dependencies below its direct suppliers, and be cognizant of and minimise where possible the concentrations within it.

Concentration risks across the sector, where many firms depend on the same suppliers, either directly (3rd parties) or indirectly (nth parties), is something no single firm can identify on their own, so the regulatory authorities have started to collect data to identify and examine these themselves.

This paper sets out what the rules require, what the authorities will and will not be able to ascertain from the data they collect, and what firms can do themselves across three levels: their own operations, across their supply chains and together across the financial sector. It is written for security, resilience and third-party risk leaders at UK banks and other FCA- and PRA-regulated firms, and for market infrastructure operators.

Incidents at shared suppliers reach many firms at once. ION, MOVEit, CrowdStrike and the October 2025 AWS outage affected firms through a single product or service provider. Two were attacks and two were due to faults, but the implications were similar.
The rules are built around each firm’s own supply chain. They ask a firm to map the dependencies behind its important services to the level needed to identify risks, and to identify and manage concentration within its own supply chain as much as possible. The authorities doubt, however, that firms meeting these individual requirements is enough to ensure the operational resilience of the system as such, because concentration risks can also reside between firms, and which no single firm can identify on its own.
From 18 March 2027 the authorities will collect the data to look across firms. The FCA expects a first incident report within 24 hours, and firms must file an annual register that ranks the suppliers behind each important service. Four cloud providers have already come under direct oversight. The authorities will not share individual firm data back, and each firm stays responsible for its own suppliers.
The first 24 hours of a supplier incident depend on the data the firm has access to already. It needs to know which of its services depend on the affected product or supplier, whom to call at the supplier, and whether a workaround can keep the service within its tolerance.
A well-prepared firm limits its own losses. It maps its suppliers beyond the first tier, plans and tests exits, checks supplier assurance for itself, agrees contacts and contract terms in advance, and gives its board clear management information. None of this sufficiently enhances resilience at the systemic level that could impact everyone.
Those weaknesses can be reduced only by acting beyond the organisational boundary. Contract terms, pooled audits, joint exercises, supply chain information sharing and collective dependency maps all help, within limits set by competition law, data protection and confidentiality.

The paper concludes by suggesting four actions firms can take in the months before March 2027: building a register from what can be verified, rehearsing responses within the first 24 hours of an incident, tabletop exercising a severe supplier failure, and deciding how to achieve visibility beyond direct suppliers.
‍

The CMORG cloud outage exercise and the problem of shared suppliers

On 8 October 2026, 38 of the UK’s largest banks and market infrastructure operators spent a day working through the loss of a major cloud provider. The Cross-Market Operational Resilience Group (CMORG) ran the exercise, with HM Treasury and the FCA taking part, and the Bank of England has said it expects firms to act on what it showed.

The FCA says incidents that start at a third party have been the top root cause of adverse impacts on the firms it supervises, with over 40% of the cyber incidents reported to it in 2025 involving a third party. Everyone knows when one cloud provider fails, many firms are affected at once. The same, however, also applies one layer down: a provider’s own suppliers serve several organisations, so a fault at a fourth party can also reach numerous firms that have no contract with it.

Thirty-eight institutions took part. The PRA alone supervises 284 banks and 42 building societies, and SS2/21 applies to all of them, in ways appropritae to their size. It asks each firm to manage concentration within its own supply chain, including where several of its suppliers depend on the same sub-contractor. It does not ask a firm to assess concentration across the sector as such, where many firms depend on the same supplier at some level, since no single firm can identify these risks alone.

The authorities have drawn the same conclusion. Their joint statement on critical third parties says that even if every firm meets its own requirements, that may not be enough to stop an incident that can threaten the whole system. From 18 March 2027, new reporting rules require firms to report serious incidents within 24 hours (four hours for payment service providers) and to submit an annual register of their material third-party arrangements, including a ranking of the suppliers behind each service. The authorities will then strive to use that data to build a picture of the whole sector. Firms should not expect to get that picture back, because the FCA says it will not share individual firm data. HM Treasury has also said firms remain principally responsible for managing their own suppliers.

So a bank can meet every requirement pertaining to its own supply chain and still be exposed through a supplier that many other peers depend on, at any level of the chain. It may never have heard of that supplier and has no easy way to find out. The rest of this paper explains where shared dependencies come from, what the rules ask firms to do about them, what a firm can do to harden its own resilience, and how enhanced collaboration within the sector could lead to better sectoral resilience.

The paper uses ION’s 2023 ransomware attack, described in the next section, as its main example. It covers UK banks, building societies, PRA-designated investment firms, FCA-regulated firms including payment and e-money institutions, and Bank-supervised market infrastructure. Insurers and Lloyd’s are covered in our earlier explainer.
‍

How a failure at one supplier reaches many firms

A flaw in a widely used product can affect many organisations that run it, and many more that rely on an organisation that does. The NCSC handled 429 incidents in the year to August 2025, and 204 were nationally significant, up from 89 the year before. Three vulnerabilities, in Ivanti, Fortinet and Microsoft SharePoint products, were linked to 29 of those incidents.

In 2023 the Cl0p group exploited a flaw in MOVEit Transfer, a file transfer product that Progress Software disclosed on 31 May. More than 2,650 organisations were affected. Some ran the product themselves, and others were affected because one of their suppliers did. One of those suppliers, Zellis, handled payroll for hundreds of UK companies.

On 31 January 2023, ransomware hit ION Cleared Derivatives, part of ION Markets, whose software supports derivatives trading and clearing. Bloomberg reported that LockBit carried out the attack and that 42 ION clients were affected. Banks and brokers in Europe and the United States had to process trades by hand. Some clearing members could not submit data that regulators required, and the CFTC delayed its weekly positions report as a result.

Supplier outages due to faults can cause the same kind of damage as attacks. In July 2024 a faulty CrowdStrike update crashed 8.5 million systems. The FCA noted that third-party problems were the leading cause of operational incidents reported to it in 2022 and 2023. On 20 October 2025, AWS traced an outage in its Northern Virginia region to a latent race condition in the automation that manages DNS records for its DynamoDB database service. Customers of Lloyds, Halifax and Bank of Scotland reported problems, and the Treasury Committee asked why AWS had not been designated a critical third party. AWS was then designated on 13 July 2026.

A firm’s own registers list the suppliers it works with or contracted directly. They most often do not show which other external parties those suppliers depend on themselves. Two kinds of concentration can reside within this wider and highly interconnected supply chain ecosystem. Within one firm’s supply chain, several of its suppliers may depend on the same fourth party. Across an entire sector, many firms’ suppliers may depend on the same provider or product at some level. Regulators describe the second kind as concentration that can arise indirectly through widely shared nth party providers in the overlapping supply chains of several providers.

More and more companies now rank supply chain risks as their biggest cyber problem. In the World Economic Forum’s 2026 outlook, 65% of large companies named third-party and supply chain vulnerabilities as their biggest challenge to cyber resilience, up from 54% a year earlier. In July 2026 the Financial Policy Committee said that recent advances in frontier AI present a significant increase in the risks to financial stability from cyber and operational vulnerabilities, because the models can identify and exploit software vulnerabilities at greater scale and over multiple stages.
‍

What the operational resilience rules require of a bank

The UK operational resilience rules date from March 2021 and have applied in full since 31 March 2025. The PRA and FCA began the work with a joint discussion paper in 2018. The rules ask a firm to decide how long it can tolerate a service being disrupted, and to show that it can stay within that limit when something goes wrong. They apply whatever the cause: a cyber attack, a system fault or a supplier outage.

A firm does five things. It identifies its important business services, which are the services whose disruption would seriously harm customers or markets, or threaten the firm itself. For a bank, payments and clearing are typical examples. It sets an impact tolerance for each one, the longest disruption it will accept, measured as a length of time. It maps the people, processes, technology, facilities and information each service needs. It tests whether it can stay within tolerance in severe but plausible scenarios. Then it records all this in a written self-assessment that its board approves. The PRA expects firms to meet the test whether or not they use third parties.

How the PRA and FCA differ

The two regulators measure importance differently. The PRA tests a service against the firm’s safety and soundness, and against UK financial stability for the largest firms. The FCA tests it against serious harm to customers and risk to the integrity of markets. A bank regulated by both sets a separate tolerance for each regulator’s objectives where a service matters to both, and the PRA accepts working to the stricter one if the firm meets its conditions. The FCA’s one-year review lists as poor practice not setting separate tolerances for market integrity and consumer harm.

Firms keep their self-assessments and give them to the regulators on request. The PRA’s rules require the current version and every version from the previous three years, and the management body must approve the important business services, the tolerances and the self-assessment. SYSC 15A.6.2R requires FCA-regulated firms to keep each version for six years.

Which rules apply to which firms

The PRA’s Operational Resilience Part applies to every CRR firm, which covers banks, building societies and PRA-designated investment firms, and SS1/21 sets out how the PRA expects firms to apply it. SYSC 15A, made through PS21/3, covers the same firms, along with enhanced scope SM&CR firms and, for their payment and e-money business, payment institutions, e-money institutions and registered account information service providers. UK branches of overseas banks fall under neither. Market infrastructure firms follow the Bank of England’s 2021 policy, which sets an extreme but plausible standard for testing. The reference tables at the end show which rules apply to which firms.

What the rules say about suppliers

The rules do reach below a firm’s direct suppliers, but only as far as a firm needs to go to find vulnerabilities and test its tolerances. The FCA requires a firm to identify and document the people, processes, technology, facilities and information needed to deliver each important business service, in enough detail to find and fix vulnerabilities (SYSC 15A.4.1R). Where the firm relies on a third party, the FCA expects it to understand enough about the resources behind that third party’s service to meet that requirement (SYSC 15A.4.2G). The PRA’s rule is the same, and SS1/21 adds that firms should map resources whether a third party provides them wholly or in part, to the level of detail needed to identify vulnerabilities and test tolerances, and should understand how third-party dependencies support each service. SYSC 15A.5.5G expects the firm to work with the third party on testing while staying responsible for the outcome, and SS1/21 suggests testing a failure at a third party or its supply chain.

SS2/21 is more specific for material outsourcing. It expects firms to have visibility of their supply chain, to give particular attention to how long sub-outsourcing chains affect their ability to stay within tolerance, to assess whether sub-outsourcing is itself material, and to require suppliers to give notice of planned changes (paragraphs 9.3 to 9.9). None of this asks a firm to map every sub-contractor behind every supplier. The standard in each case is what is necessary, sufficient or material. From March 2027 the register adds a requirement to rank the most critical elements of each supply chain, including fourth and fifth parties, and to notify a change of key sub-contractor.

The detailed third-party rules differ by firm. For PRA-regulated banks, SS2/21 is the main source. It asks a bank to assess how material each third-party arrangement is, including arrangements that are not outsourcing, and to apply stronger controls where it is material. It sets minimum contract terms for material outsourcing, expects the bank to know its supply chain, asks it to manage concentration within its own supply chain, including where several of its suppliers depend on the same sub-contractor, and expects stressed-exit plans. FCA-regulated firms use SYSC 8. It binds common platform firms as rules. Other firms should take account of its core provisions as if they were guidance, though a firm other than a common platform firm must make available on request the information the FCA needs to supervise outsourced activities. Authorised payment institutions must tell the FCA before outsourcing any operational function under regulation 25 of the Payment Services Regulations 2017, and authorised e-money institutions have the same duty under regulation 26 of the Electronic Money Regulations 2011.

Who is accountable

At a PRA-regulated bank, SS1/21 says the Chief Operations function (SMF24) should hold overall responsibility for operational resilience where the bank has one. SS2/21 says the PRA generally expects SMF24 to hold the outsourcing responsibility as well. At FCA-regulated firms the governing body approves the written records under SYSC 15A.7.1R, and SYSC 15A gives no individual senior manager a specific responsibility.
‍

Why checking your own suppliers is not enough

The operational resilience rules make each firm responsible for its own resilience. In September 2025, Liz Oakes, an external member of the Bank of England’s Financial Policy Committee (FPC), explained why that is not enough on its own. Her speech says the rules help individual firms stay resilient, but that a firm’s own safety and soundness may not always be enough to keep the system stable. Weaknesses that many firms share can make the effect of a shock on the system larger than the sum of its effects on each firm. The joint statement by the Bank, PRA and FCA on critical third parties says the same thing: even if every firm complies with its own requirements, that may not be enough to prevent an incident that threatens the stability of the financial system or confidence in it.

The FPC lists five structural features that can make the effect on the system larger than the effect on each firm: interconnectedness, complexity and opacity, concentration, correlation and common vulnerabilities, and dependence on data. Recent incidents show some of them. ION’s attack affected 42 clients on the same day. The FPC calls this correlation: firms that otherwise differ all fail together because they share a supplier. MOVEit reached many firms through suppliers such as Zellis. The FPC’s term for that is opacity: the vulnerable product sat in the supply chain, and no contract between a firm and its direct supplier showed it.

Three different things are easy to confuse here. The first is depth: how far below its direct suppliers a firm can see. The rules ask a firm to map what it needs to find vulnerabilities, and from March 2027 to rank the most critical elements of each supply chain, including fourth and fifth parties, but they do not ask it to map every sub-contractor. The second is concentration within one firm’s own supply chain, for example when several of its direct suppliers depend on the same fourth party. SS2/21 asks the firm to take reasonable steps to manage that. The third is concentration across the sector, when many firms depend on the same provider or product at any level, from third parties down to the nth. SS2/21 frames concentration at firm or group level, so the rules do not ask any firm to assess this kind, and no firm could: it appears only when many firms’ supply chains are put together. That is the systemic kind, and it is what the authorities’ new reporting rules are designed to find.
‍

Depth, firm-level concentration and sector-wide concentration

Level	Example	What the rules ask of a firm	Who can see it
Depth below direct suppliers	A supplier the bank pays relies on a cloud provider the bank has no contract with	Map to the level needed to find vulnerabilities; visibility of the supply chain for material outsourcing; from March 2027, rank the most critical providers beyond the first	The firm, to the extent its suppliers tell it
Concentration within one firm’s supply chain	Three of the bank’s direct suppliers depend on the same fourth party	Take reasonable steps to manage it (SS2/21 paragraph 5.24)	The firm, if it has mapped its suppliers’ suppliers
Concentration across the sector	Many banks’ suppliers, at any level, depend on the same provider or product	No requirement to assess it	No single firm; the authorities, once they combine firms’ registers

Source: Risk Ledger analysis of PRA SS2/21, FCA SYSC 15A and FCA FG26/4

‍

A firm’s resilience therefore has a ceiling set by the least resilient dependency it shares with others. That does not make every small supplier a threat. SS6/24 says concentration does not by itself automatically pose systemic risk (paragraph 3.9). The dependencies that matter are the ones shared by many firms, hard to replace and not on anyone’s map. The register that firms must submit from March 2027 asks each firm to rate how easily it could substitute each provider, which recognises that replaceability matters. A firm’s own checks start from its own contracts, so they cannot find a dependency of this kind. The FPC’s July 2026 report describes a case in which financial institutions strengthen their defences materially but systemic risk still arises through correlated disruption at shared providers, common software components and critical sectors such as telecoms, and in which resilience is uneven beyond the largest firms and most established providers.

The usual way of assuring suppliers has the same limit. SS6/24 notes that the shared responsibility model used in cloud arrangements divides duties between two parties and does not consider the cumulative impact of a provider’s failure across several firms (paragraph 4.19). A questionnaire, an audit right or a notification clause gives a firm evidence about its own relationship with one supplier, and each firm holds only its own evidence. SS2/21 asks banks to assess concentration at firm or group level, including where unconnected providers depend on the same sub-contractor (paragraph 5.24 now, 5.25 in the 2026 version). A bank can apply that test across its own supply chain, as far as it has mapped it. It cannot see a sub-contractor that serves other banks’ suppliers but none of its own, which is the sector-wide case.

Oakes made a related point about measurement. No single firm has a complete view of how other firms are connected or how a disruption would spread, and operational risk has no common measures for assessing and controlling it.

Firm-level accountability does have force. The FCA and PRA fined TSB £48.65m in December 2022, citing among other failings how it managed the risks of an outsourced IT arrangement, and the PRA fined the former chief information officer for breaching Senior Manager Conduct Rule 2. Enforcement of that kind reaches a firm that manages its own supplier badly. It does not reach a firm that manages its supplier well and is still affected because the supplier fails for all its customers at once.
‍

How the authorities are collecting data on firms’ suppliers

In March 2026 the FCA, PRA and Bank of England published aligned rules on reporting incidents and material third-party arrangements, which apply from 18 March 2027. The FCA says it needs consistently structured data to understand how firms use third parties and to identify systemic risk. It will use the register to find the largest systemic risks from third parties, including by recommending to HM Treasury which providers should be designated as critical.

The critical third parties regime gives the authorities direct oversight of providers that many firms depend on. On 13 July 2026, AWS, Google Cloud, Microsoft and Oracle became the first four. The Bank, PRA and FCA jointly oversee the services these providers supply to the financial sector, and HM Treasury describes its approach as targeted and proportionate. The duties fall on the providers. Each had to deliver an interim self-assessment within three months of designation. Within 12 months each must map the resources behind every systemic service, including key nth-party providers, and keep an incident management playbook that it tests with a sample of customer firms. Firms remain responsible for their own suppliers.

The PRA’s revised SS2/21 takes effect on the same date. It defines a “third party arrangement” to include sub-contractors and intragroup arrangements, and introduces the “material third party arrangement”. Notification now covers arrangements that are not outsourcing, and firms submit an annual register through FCA RegData that ranks the suppliers behind each service. The new examples of material arrangements include cybersecurity services and cloud storage of sensitive data. Some expectations that look new date from 2021. The version in force since then already asked firms to manage concentration within their own supply chains, including through fourth parties, endorsed pooled audits and expected firms to know their supply chain.

The PRA has also spoken to banks directly. Its January 2026 letter to deposit takers says firms are becoming more reliant on a small number of third parties and on those third parties’ own suppliers. It tells firms not to rely solely on assurances from third parties about their resilience, and to test and validate for themselves where possible.

Authorities and firms also coordinate through CMORG’s Sector Response Framework. Oakes said that timely notification through it can be the difference between an isolated disruption and instability across the system.

Firms with EU operations are also subject to DORA. Under it the European authorities designated 19 critical ICT providers in November 2025, a wider list than the UK’s four that includes software, data and IT services firms. UK and EU authorities signed a memorandum on cooperation over critical providers in January 2026.

Two more measures are announced or proposed. The Bank and PRA’s consultation on cyber and ICT risk management is still described as upcoming in the Bank’s July 2026 Financial Stability Report. The Cyber Security and Resilience Bill is before the House of Lords. It would extend network and information systems rules to managed service providers and data centres, though not directly to financial firms.
‍

What the new reporting rules require from March 2027

The reporting rules apply from 18 March 2027, and firms have 12 months from publication to prepare. Incident reporting covers every firm with a Part 4A permission, payment service providers, UK recognised investment exchanges and other listed types. Notification of third-party arrangements and the annual register cover banks, building societies, designated investment firms, enhanced scope SM&CR firms, UK recognised investment exchanges, authorised payment and e-money institutions and the other types the FCA lists. The PRA applies parallel rules to its firms.

Reporting an incident

A firm must report an incident when it reasonably believes the incident poses a risk of serious harm to customers, a risk to the firm’s safety and soundness, or a risk to market stability, integrity or confidence. An incident can be a series of linked events, which includes a supplier failure and the effects that follow from it. The FCA expects the first report within 24 hours of the firm deciding that a threshold is met. Payment service providers have four hours from first detecting the incident. About 90% of FCA-regulated firms file a short standard report. Banks and other listed firms file a fuller report in three stages and send a final report within 30 working days of resolution, which can be extended to 60. If the firm identifies a third party as the origin, the report names the provider and gives its legal entity identifier.

Notifying and registering suppliers

A firm must tell the FCA about a new material third-party arrangement, or a significant change to one, early and before it commits to it. Significant changes include a change of supplier or key sub-contractor, a move in where data is stored, and a material change in the supplier’s ownership or finances. The FCA does not approve notifications, and firms can go ahead without waiting for a reply.

Each year firms also submit a register of their material arrangements, within 90 calendar days of the window opening. The FCA has not yet announced when the first window opens. Its guidance gives an example in which a register filed in 2027 shows the position at 31 December 2026. For each arrangement the firm records the provider’s legal entity identifier, the services it supports, impact tolerances, the countries where data is stored and the service is delivered, the annual contract value, and the dates and outcomes of its latest risk assessment, audit, financial due diligence and cyber due diligence. If it has not done one of these, it must say so. It also rates how easily it could replace the provider.

The firm ranks each supplier: 0 for a group company, 1 for a direct external provider, 2 for a provider that supports delivery through another provider, and 3 for one further down. It ranks only the most critical elements of the supply chain and does not need to rank every element.

What this means after an ION-type incident

Suppose a UK firm clears derivatives with ION’s software and an attack like the one in 2023 takes it offline after March 2027. The firm would decide whether the incident meets a threshold and, if it does, report within 24 hours, naming ION and giving its identifier. Its register would list ION as a first-tier provider for the clearing service, with the date of its last cyber due diligence on ION, and a change by ION of a key sub-contractor would count as a significant change to notify.

What the rules assume a firm already knows

Each of these duties needs information that a contract with a direct supplier does not usually provide. The firm must name the provider within the first day. It must know when a supplier changes a key sub-contractor. It must list suppliers at rank 2 and 3, and state when it last did cyber due diligence.

SS2/21 gives firms part of the answer: agreements for material outsourcing should require the supplier to tell the firm about planned sub-outsourcing (paragraph 9.9). That covers what direct suppliers choose to report and no more. Respondents told the FCA that information beyond direct suppliers is hard to get, and the FCA kept the ranking requirement. The duty to know the supply chain therefore sits with the firm.

Who signs off

The governing body approves the self-assessment under SYSC 15A.7.1R. The register asks whether a senior manager signed off each arrangement and, if not, which committee reviewed it. At PRA-regulated firms the outsourcing responsibility generally sits with SMF24. Third-country branches have no duty to notify but remain within the FCA register.
‍

The first 24 hours of a supplier incident

Deciding whether to report

Consider an ION-type attack after March 2027. A supplier tells its clients it has been hit by ransomware and its systems are down. The firm’s first task is to decide whether this is an incident for the firm itself. The FCA’s rules cover only an incident that has actually affected the firm and meets a reporting threshold, and the supplier’s announcement settles neither point. A threat that has not yet affected the firm is a near miss, and near misses go through the firm’s normal supervisory channel and not the incident report.

To decide, the firm needs to know whether it uses the affected product, which of its services depend on it, and whether those services are at risk of going beyond their impact tolerance. Most of that information has to come from the supplier.

The FCA expects the first report within 24 hours of the firm deciding that a threshold is met. It tells firms not to wait for the deadline, and says an urgent case may justify phoning the supervisor first. A firm reports what it knows at the time, so a report with gaps is allowed. The rules require the information so far as the firm is aware.

What the first report contains

The report covers the incident’s status, what triggered it, whether it is a disruption or a data loss, a description, when it was detected, and the actions taken and planned. It also asks for a severity rating linked to the firm’s own escalation. Low means the normal operational response is enough, medium means crisis management has been activated, and high means the most senior crisis command has been activated.

The FCA’s own example shows how it treats an incident that starts at a supplier. A cloud provider’s data centre fails, a bank’s platform goes offline, and the bank cannot switch to another vendor. The FCA counts the provider’s fault and the bank’s inability to switch as one incident. A firm therefore needs to know beforehand whether it can switch, because that is part of what it will report.

What helps in the first hours

The FCA’s review of the CrowdStrike outage found that firms with existing relationships and routes for sharing information with their providers responded faster. Risk Ledger’s published incident playbook, which is vendor material, lists what a firm should have in place before an incident. That means a list of suppliers, how critical each one is, the data each holds, a named owner inside the firm, a working contact at the supplier that is not a general inbox, contract terms on incident notification, and a way to continue the service without the supplier. The playbook says none of this can be put together once an incident is under way.

Many firms lack those contacts. In Risk Ledger’s own survey, 55.4% of UK organisations did not have direct relationships with the security teams at all their critical suppliers. Of these, 53% had relationships with some and 2.4% with none.

What the register cannot answer

The register a firm files each year does not answer the next question. It records the position at a reporting date, ranks only the most critical parts of the supply chain, and goes to the regulators. The question in the first hours is which of the firm’s other suppliers use the affected product.

MOVEit shows why a supplier’s own answer can fall short. Attackers exploited the flaw days before a patch existed, so a supplier that had installed the patch still could not say whether it had already been breached. Some of the information the firm needs belongs to the supplier, and some belongs to other firms that use the same supplier.

The reporting duty continues while the firm responds. After ION’s attack, some clearing members could not submit data the CFTC required. An FCA-regulated firm in the same position after March 2027 would have its own reports to file while handling the incident. If it is waiting for information from the supplier, the final report can take up to 60 working days. The first report has no such allowance.
‍

What the authorities’ data will and will not show

Which providers are overseen directly

HM Treasury has designated four cloud providers and describes its approach as targeted and proportionate. The oversight covers only the services those four supply to the financial sector. Of the suppliers in the incidents described earlier, only AWS is one of them. The critical third parties regime does not apply to ION, to the CrowdStrike software, to MOVEit or to Zellis. The European authorities’ list is wider. It has 19 critical ICT providers, including software, data and IT services firms. The FPC’s July 2026 report also asks what resilience is expected of other material third-party technology providers that may not meet the threshold for designation.

SS6/24 says concentration does not by itself automatically pose systemic risk (paragraph 3.9). The authorities therefore also consider how easily a service can be replaced and how important the firms that use it are.

How much the register shows

The register ranks only the most critical parts of a firm’s supply chain. Firms file it once a year, as at a reporting date, and each entry depends on what the firm itself knows. A product like MOVEit, used by a supplier’s supplier, would appear only if firms had found out about it and reported it.

Concentration across the sector appears only when the authorities put many firms’ registers together. No single firm’s register shows it.

The legal entity identifier is meant to let the authorities match the same provider across firms’ registers. Not every provider has one, and the FCA allows firms to enter “N/A”. Where firms record the same provider under different identifiers, matching their registers is harder.

What comes back to firms

The FCA says it does not share individual firm data. It says it will share relevant information with industry through established channels where appropriate, for example in stressed market conditions, and thematic insights later.

Designated providers must give their customer firms sufficient and timely information to manage the risks of their systemic services. Only four providers carry that duty.

The Cyber Security and Resilience Bill is before the House of Lords. It would require regulated managed service providers, data centre operators and digital service providers to notify affected customers after filing their full report. Financial firms stay under their own regulators and are not directly covered by it.

Who stays accountable

The FCA says the critical third parties regime complements firms’ own responsibilities. SS2/21 says boards and senior managers cannot outsource their responsibilities. A firm cannot treat a supplier’s designation as covering its own dependence on that supplier.

In practice, a firm is unlikely to learn from the authorities which other firms share its suppliers, and the authorities will know only what firms report to them.
‍

What a well-prepared firm does differently

A firm cannot repair a supplier’s weaknesses, but it can limit what they do to its own services. The two cases below are an illustration, not an account of any real firm. Take two firms that clear derivatives with ION’s software on the day ION is hit by ransomware. The first has done no preparation. It hears of the attack from ION or the press, emails its other suppliers to ask whether they are affected, and starts looking for someone with the authority to approve a workaround. The second already knows its clearing service depends on ION. It has a manual process it has tested against its impact tolerance, a named contact at ION, and a contract that says how ION must notify it. The regulators’ own guidance describes the steps behind that difference.

The second firm has mapped its suppliers beyond the first tier. The FCA’s one-year review found that mapping in some firms was overly focused on IT, and that there was more work to do on identifying, assessing and remediating third-party vulnerabilities. SS2/21 says firms should have visibility of their supply chain and that providers should be encouraged to keep up-to-date lists of their own sub-contractors (paragraph 9.3). In practice that means asking key suppliers who their critical suppliers are and recording them against each important service.

It has planned for the supplier being unavailable. For each material outsourcing, SS2/21 expects a business continuity plan and a documented exit strategy that includes a stressed exit, a last resort for disruption that other measures cannot handle (paragraphs 10.1 and 10.11). Where no alternative provider exists, the firm should plan other ways to stay within tolerance (5.18). For cloud services, the options the PRA lists include several regions, more than one vendor, a hybrid set-up and the ability to bring data back on premises (10.5). Data recovery should allow for deliberately destructive cyber attacks (10.8).

It tests these plans with the supplier. SS1/21 suggests testing a failure at a third party or its supply chain, and SS2/21 says firms and their suppliers should commit to supporting such tests (10.19). Firms in the CBEST testing programme should always analyse supply chain scenarios (10.20). The FCA’s review named testing scenarios that would breach impact tolerances, and documenting longer-term plans to fix the weaknesses found, as good practice. SS2/21 expects firms to update their plans with what the tests show (10.21).

It checks assurance for itself. The PRA’s January 2026 letter to deposit takers tells banks not to rely solely on suppliers’ assurances and to test and validate for themselves where possible. SS2/21 adds that a firm should assess a supplier’s certificates and reports and not assume they are enough (8.9). Negotiating audit rights is also not enough, because firms must use them (8.5).

It agrees contacts and terms before anything happens. SS2/21 says contracts for material outsourcing should require the supplier to tell the firm of developments that could affect its service, set out how incidents are handled and escalated, and commit both sides to test continuity plans (6.4).

Its board sees all this. SS2/21 says boards should identify and understand the firm’s reliance on critical service providers. It expects management information to be clear, consistent, robust, timely and well targeted, with enough technical detail for the board to challenge it (4.4). SYSC 15A.2.11G says the FCA expects to be notified of any failure by a firm to meet an impact tolerance.

All of this reduces what the firm itself loses when a supplier fails. None of it changes the weaknesses at the supplier, or at the suppliers it shares with other firms. Those can be reduced only by raising standards across the supply chain and by firms and authorities acting together.
‍

How firms can strengthen resilience across their supply chains and the sector

A firm’s own preparation protects the firm. The weakest dependency, though, sits at a supplier, and sometimes at a supplier’s supplier, and only that supplier can fix it. Strengthening resilience therefore takes action at two further levels: across the supply chain and across the sector.

Raising standards across the supply chain

Contracts come first. SS2/21 expects agreements for material outsourcing to require suppliers to report developments that could affect the service and to support testing of continuity plans (paragraph 6.4). It expects firms to agree to material sub-outsourcing only if the sub-contractor gives the firm, the Bank and the PRA audit and information rights equal to the supplier’s, and to require advance notice of planned changes so the firm can assess and object (9.5 and 9.9). Firms can also share their relevant internal policies with suppliers, including those on operational resilience. The PRA says this helps suppliers understand what firms must meet and does not reduce the firm’s own responsibility (4.11).

Pooled audits share the work between firms that use the same supplier. SS2/21 says they can be more efficient and cheaper for firms and less disruptive for suppliers running shared environments, and that they help spread good audit practice (8.13). Each participating firm still has to decide what the shared findings mean for it (8.14). The FCA lists pooled audits among the audit methods a firm can record in its register.

Joint exercises test whether a supplier can do what its contract says. Designated critical third parties must keep an incident playbook and test it with a sample of customer firms. SS6/24 does not require firms to take part, but the regulators regard taking part as consistent with firms’ obligations and in their own interest. For other suppliers, the commitment to test together has to come from the contract.

These measures raise standards at the suppliers a firm already knows about. The Bank, PRA and FCA say in a joint publication that in some cases firms do not yet have full information about their suppliers’ cyber resilience, and that assurance can weaken further down the supply chain.

Working together as a sector

The authorities already coordinate firms through CMORG. Its Sector Response Framework gives the sector a way to notify and respond together, and Liz Oakes said that timely notification through it can be the difference between an isolated disruption and instability across the system. Firms are not required to use CMORG’s outputs, though the authorities encourage them to. The same joint publication records that some firms have shared information with each other about their most important third parties, to understand concentration risks and what to do about them. The FPC’s July 2026 report asks whether greater coordination and industry-level co-operation, including on information sharing, cyber-protection infrastructures and coordinated response and recovery options for important business services, may be warranted.

Firms that share this information can learn things none of them can see alone, such as which suppliers several of them depend on and where the sector is concentrated. Four limits apply, and each can be handled in how the sharing is set up.

What limits sharing

Competition law applies because firms that share information are usually competitors. The CMA’s guidance on agreements between competitors, published in August 2023, covers information exchange at length, and commentary says it expects firms to distance themselves from exchanges of competitively sensitive information. Which suppliers a firm depends on is generally not information of that kind. Supplier prices, contract terms and volumes would be, so a shared model should leave them out, and competition counsel should confirm the design.

Data protection applies because supplier records include named contacts. The ICO’s statutory code describes data protection law as an enabler of fair and proportionate sharing, requires a lawful basis before sharing begins, and recommends an impact assessment. It covers personal data shared between controllers, and the ICO says the code is under review following the Data (Use and Access) Act 2025.

Confidentiality and security matter because a map of shared dependencies shows where the sector is concentrated. SS6/24 acknowledges that a provider sharing supply chain information must weigh confidentiality and security, including the personal data and proprietary information of key sub-contractors (paragraph 6.18). The FCA answered concerns about the sensitivity of incident data with controls aligned to ISO 27001 and the NIST framework.

A platform that holds supplier information for many firms is itself a supplier. The FCA’s examples of arrangements it would normally expect to be material include services that store sensitive information, such as data centres, cloud hosting and managed service providers. Each firm decides for itself whether a platform meets that test, and a platform used by many firms fits the regulators’ own description of concentration.
‍

One example of firms sharing supplier information: the Risk Ledger network

Risk Ledger, which published this paper, runs one network of this kind. This section describes how it works and where it stops, using Risk Ledger’s own figures, which no regulator has validated.

How it works

Suppliers complete one security profile, attach their evidence, and share it with each customer that connects to them. Risk Ledger says the network has more than 19,000 organisations. It reassesses each supplier in full every six months. If a supplier reports a change to its controls in between, every connected client is notified on the platform. Many clients view the same profile, so many security teams look at the same supplier. Suppliers also list their own critical suppliers, which adds fourth parties to the map. Through these links Risk Ledger says it can map each connected organisation’s supply chain up to eight tiers. A supplier can also notify all its connected clients through the platform when one of its own suppliers is disrupted.

What the combined maps showed

Risk Ledger works at two levels. A client sees its own supply chain mapped through the network, which addresses depth below its direct suppliers and concentration within its own supply chain. In its communities, Risk Ledger also overlays the maps of member institutions to find third- to nth-party concentration that several members share, which is the sector-wide kind within a peer group.

Risk Ledger’s financial services page reports one result. From 98 direct supplier relationships across eight financial institutions, it found 776 fourth-party suppliers and 92 potential concentration risks, 62 of them at fourth parties and beyond. It also found 14 direct suppliers connected to at least half of the institutions. The page does not name the institutions. These figures come from overlaying the maps of eight institutions, so they show the sector-wide kind of concentration within that group of eight, not across the whole sector. None of the institutions could have seen those shared suppliers from its own contracts.

In the first hours of an incident

Risk Ledger decides which threats to publish to the network, and says it normally does so within one day of a threat becoming a major issue. Suppliers on the network are asked for their status, with reminders at two, six and seven days if they have not answered. The answers build each client’s list of affected suppliers and a map of exposure. Clients can discuss responses with suppliers on the platform and export reports.

Two figures show the scale, both Risk Ledger’s own. In the 2024 CrowdStrike outage, Risk Ledger informed over 7,000 organisations, and nearly 2,000 suppliers responded within 48 hours. In the 2021 Log4j incident, some clients saw response rates above 75%.

Where it stops

The map holds what participants contribute. A supplier that is not on the network does not appear in it, and a supplier that is on it but slow to answer shows as a gap. The reminder schedule shows that answers can take days. Interim changes to controls depend on suppliers reporting them, so a firm still tests the points that matter most to it. A community overlay covers only the institutions in that community, so it shows concentration across that group and not across the whole sector.

A common framework gives each customer less control over the questions it asks. Risk Ledger’s CEO has described this as a five or ten per cent hit on granularity, in return for a broader data set. Risk Ledger also says it does not decide whether a firm is in scope of a regulation, file regulatory reports or replace the firm’s incident process, and that its view of dependencies is a starting point to check against the firm’s own records.

Whether a firm treats the platform as a material third-party arrangement is for the firm to decide.
‍

What to do before March 2027

The reporting rules apply from 18 March 2027, just under five months away. The FCA’s guidance gives an example in which a register filed in 2027 shows the position at 31 December 2026. The date of the first filing window has not been announced, so the work is better started now. Four actions follow from this paper.

Build the register from what you can verify. For each service that matters most, list the direct suppliers and the suppliers behind them, at rank 2 and 3. Record when you last did cyber due diligence and audited each one, and note where you could not find the information. Supervisors will see both the dates and the gaps.
Rehearse the first 24 hours. Decide who judges whether a supplier’s incident has affected the firm and meets a reporting threshold, how the provider and its legal entity identifier are confirmed, and how the firm’s severity rating maps to its crisis arrangements. Run the rehearsal on a scenario involving a supplier that other firms also use.
Test a severe supplier failure and keep the evidence. Use a scenario like ION’s attack or the cloud outage in the 8 October exercise, involve the supplier where the contract allows, and check that exit plans and workarounds keep the service within its tolerance. The FCA’s one-year review named testing scenarios that would breach impact tolerances as good practice, and the PRA has asked banks to test and validate suppliers’ assurances themselves.
Decide how to see beyond your direct suppliers. Contract terms that require suppliers to report changes of sub-contractor, pooled audits and joint exercises all help, and the authorities encourage collective approaches. Any shared model needs answers on competition, data protection and confidentiality before it starts.
‍

Conclusion

The operational resilience rules ask each firm to stay within its impact tolerances whatever the cause of a disruption. The incidents in this paper show where that is hardest to do. ION, MOVEit, CrowdStrike and the October 2025 AWS outage each began at a supplier that many firms use, and in each the effect reached firms at the same moment. A firm can prepare thoroughly for the suppliers it knows and still depend on a product or sub-contractor it has never mapped, because it shares that dependency with firms it cannot see.

The authorities have reached the same view of firm-by-firm assurance. From 18 March 2027 they will start collecting the data to look at the sector as a whole. That settles who has to act: each firm needs its own information about its suppliers, its own plans for losing them, and a way to learn quickly what other firms have found.

Several things are not yet settled. The FCA has not announced when the first register window opens. The Bank and PRA have not published their consultation on cyber and ICT risk management, which the Bank’s July 2026 report still calls upcoming. It is also unclear how much the authorities will share with firms beyond thematic insights and information in stressed conditions. Firms should plan on the basis that they will have to build their own view.

The next incident that starts at a shared supplier will show how far this work has gone. A firm should be able to say within hours which of its suppliers use the affected component, whom to call at each, and whether its services are staying within tolerance. Suppliers should be able to answer many customers quickly and consistently. And firms, suppliers and the authorities should have exercised together beforehand, including the suppliers and smaller firms that were not part of the 8 October exercise.

‍

What experts ask next

How should a bank prioritise and reduce concentration risk once it has found it?

A bank should rank concentrations by the importance of the service they affect, how hard the supplier or product is to replace and how quickly the service must recover, then act on the highest first. Options include a tested alternative provider, a manual workaround that keeps the service within its impact tolerance, contract terms that require notice of changes, and working with the suppliers concerned and the other firms that rely on them. Risk Ledger’s 2023 article suggests using the findings to focus incident exercises on the scenarios that are both most likely and most damaging.

What evidence should a bank ask suppliers for, and how should it review it?

SS2/21 tells banks not to assume that a supplier’s certificates or reports are enough evidence, and to use the audit and information rights they negotiate. The PRA’s January 2026 letter to deposit takers adds that banks should test and validate for themselves where possible. In practice a bank asks for evidence tied to the controls that protect the service in question, checks it against that service’s impact tolerance, and records the decision it reached.

How can a firm find out quickly whether a new vulnerability affects its suppliers?

A firm needs a current record of which suppliers use which products, and a route to ask them. Risk Ledger publishes emerging threats to its network and asks suppliers for their status. In the 2024 CrowdStrike outage it informed over 7,000 organisations, and nearly 2,000 suppliers responded within 48 hours, according to Risk Ledger’s own figures.

What does the UK critical third parties regime mean for a bank’s own third-party risk management?

The regime gives the Bank of England, PRA and FCA direct oversight of designated providers and puts the duty to map their own supply chains on those providers. AWS, Google Cloud, Microsoft and Oracle were designated on 13 July 2026. Firms remain responsible for managing their own suppliers, so designation does not replace a bank’s own mapping, testing and exit planning.

Read more: The UK’s critical third parties regime (published January 2025, before the first designations).

How can a bank keep track of fourth-party dependencies between annual reviews?

The formal routes are contract terms and a notification rule. SS2/21 expects agreements for material outsourcing to require notice of planned sub-outsourcing, and from March 2027 the FCA treats a change of key sub-contractor as a significant change to notify. Both depend on what direct suppliers report. A bank can add its own checks, such as asking critical suppliers to refresh their list of critical suppliers on a fixed cycle and after any incident.

How can a security lead get the board to act on supplier concentration?

SS2/21 expects boards to identify and understand the firm’s reliance on critical service providers, and expects management information that is clear, consistent, robust, timely and well targeted, with enough technical detail for the board to challenge it. Risk Ledger’s on-demand webinar with Marsh and St. James’s Place discusses why scenario-specific tabletop exercises land with boards where general calls for resilience do not.

‍

Frequently Asked Questions (FAQs)

What do the UK operational resilience rules require of banks?
UK banks, building societies and PRA-designated investment firms must identify their important business services and set an impact tolerance for each, which is the longest disruption they will accept. They must also map the people, processes, technology, facilities and information each service needs, and test that they can stay within tolerance in severe but plausible scenarios. They record all this in a board-approved self-assessment. The PRA’s Operational Resilience Part and SS1/21 and the FCA’s SYSC 15A set these rules, which have applied in full since 31 March 2025 and cover any cause of disruption, including a supplier failure.

What do the FCA and PRA incident and third-party reporting rules require from March 2027?
From 18 March 2027, firms must report operational incidents that meet a reporting threshold, and the FCA expects the first report within 24 hours of the firm deciding that a threshold is met (four hours for payment service providers). Firms in scope must also notify the FCA of new or significantly changed material third-party arrangements, and submit an annual register that ranks the most critical suppliers behind each service. The PRA applies parallel rules to its firms. The FCA has not yet announced when the first register window opens.

Do UK rules require banks to know their fourth-party and nth-party suppliers?
To a limited standard. The PRA and FCA mapping rules require banks to understand the dependencies behind each important business service in enough detail to find vulnerabilities and test their tolerances, and SS2/21 expects visibility of the supply chain for material outsourcing. From March 2027 the register requires firms to rank the most critical suppliers beyond their direct ones and to notify a change of key sub-contractor. The rules do not require a bank to map every sub-contractor behind every supplier.

What is the difference between firm-level and sector-wide concentration risk in the supply chain?
Firm-level concentration risk sits within one firm’s own supply chain, for example when several of its direct suppliers depend on the same fourth party. SS2/21 asks banks to take reasonable steps to manage it. Sector-wide concentration risk arises when many firms’ suppliers, at any level from third parties to nth parties, depend on the same provider or product. No single firm can see it, and the authorities use the registers they collect to identify it.

How can a bank strengthen operational resilience against supplier failures?
A bank can map its suppliers beyond the first tier, plan and test exits and workarounds for each material supplier, check suppliers’ assurance for itself, and agree named contacts and incident-notification terms in contracts. It can also give its board clear management information. Beyond the firm, pooled audits, joint exercises with suppliers and information sharing between firms can raise standards at suppliers many firms share, within the limits set by competition law, data protection and confidentiality.

‍

Appendix

Table 2: Which rules apply to which firm

Which rules apply to which firms

Firm type	Resilience rules	Third-party rules	Reporting from 18 March 2027
Banks, building societies, PRA-designated investment firms	PRA Operational Resilience Part and SS1/21; SYSC 15A	SS2/21; SYSC 8	PRA and FCA: incident reports, notification of material arrangements, annual register
Investment firms regulated only by the FCA	SYSC 15A, if an enhanced scope SM&CR firm	SYSC 8	Incident reports for all firms; notification and register for the firm types the FCA lists
Authorised payment institutions and e-money institutions	SYSC 15A, for payment and e-money activities only	Payment Services Regulations 2017 regulation 25; Electronic Money Regulations 2011 regulation 26	FCA: incident reports, notification, register
UK recognised investment exchanges	SYSC 15A	Not covered in this paper	FCA: incident reports, notification, register
UK branches of overseas banks	Outside both	SS2/21	FCA: incident reports and register, no notification. PRA: no notification or register
Market infrastructure (CCPs, CSDs, recognised payment system operators and specified service providers)	Bank of England 2021 policy	Bank of England outsourcing statements	Bank of England rules

Source: Risk Ledger analysis of PRA, FCA and Bank of England publications

‍

Table 3: Key Dates

Key dates

Date	What happens	Status
1 January 2025	Critical third parties rules take effect	In force; they apply to a provider from the date it is designated
31 March 2025	Transition ends for the operational resilience rules (PRA, FCA, Bank of England policy)	In force
14 January 2026	UK and EU authorities sign a memorandum on oversight of critical providers	Signed
15 January 2026	PRA letter to deposit takers on 2026 priorities	Published
March 2026	Incident and third-party reporting rules and revised SS2/21 published	Made, not yet in force
27 March 2026	FCA one-year review of operational resilience	Published
7 July 2026	Bank of England Financial Stability Report	Published
13 July 2026	AWS, Google Cloud, Microsoft and Oracle designated as critical third parties	In force
8 October 2026	CMORG cloud outage exercise (SIMEX26)	Held
18 March 2027	Reporting rules and revised SS2/21 apply	Made, not yet in force
About 13 July 2027	Designated providers must have mapped the resources behind each systemic service and have an incident playbook (12 months after designation)	Rules in force
Not scheduled	Bank and PRA consultation on cyber and ICT risk management; Cyber Security and Resilience Bill (before the House of Lords)	Announced; proposed

Source: PRA, FCA, Bank of England and HM Treasury publications. The July 2027 date is Risk Ledger’s calculation, 12 months after designation.

‍

Table 4: The Limits of the Measures

Where each measure stops

Measure	What it covers	What it leaves out
Critical third parties regime	The systemic services of four cloud providers	Other providers, including software, data and payroll suppliers
Register and notifications	Material arrangements as firms report them, the most critical suppliers ranked, one snapshot a year	Dependencies a firm does not know about; suppliers it does not rank
Incident reporting	Serious incidents, reported to the authorities within 24 hours (four for payment service providers)	Real-time information for other affected firms
Cyber Security and Resilience Bill (proposed)	Managed service providers, data centres and digital service providers	Financial firms’ own regulation