{"id":125664,"date":"2026-07-15T08:00:00","date_gmt":"2026-07-15T15:00:00","guid":{"rendered":"https:\/\/find.codeghost.online\/en-us\/microsoft-cloud\/blog\/?post_type=ms-industry&p=125664"},"modified":"2026-07-21T08:40:21","modified_gmt":"2026-07-21T15:40:21","slug":"microsoft-designated-a-critical-third-party-to-the-uk-financial-sector","status":"publish","type":"ms-industry","link":"https:\/\/find.codeghost.online\/en-us\/microsoft-cloud\/blog\/financial-services\/2026\/07\/15\/microsoft-designated-a-critical-third-party-to-the-uk-financial-sector\/","title":{"rendered":"Microsoft designated a Critical Third Party to the UK financial sector"},"content":{"rendered":"\n

For more than 40 years Microsoft has worked closely with UK government agencies to help support <\/a>business, improve citizen services, and secure and enhance the resilience of the digital ecosystem<\/a>. As Microsoft\u2019s role in the financial services industry has increased as a key provider in supporting financial firms run critical and important business services, so has its responsibility to meet the demands of customers and regulators alike.<\/p>\n\n\n\n

It is thus the natural evolution of Microsoft’s role that HM Treasury has designated Microsoft Ireland Operations Limited (MIOL) as a critical third party to the UK financial sector, a designation <\/a>publicly announced on July 10, 2026.1<\/sup> MIOL recognizes its responsibilities as a critical third party and is fully committed to complying with the applicable <\/strong>oversight requirements and the UK’s cybersecurity and resilience laws<\/a>. As with its designation as a Critical Third Party Service Provider under the EU Digital Operational Resilience Act, MIOL will continue to focus its responsibilities on supporting the financial services industry and enhancing overall operational resilience of the financial ecosystem.<\/p>\n\n\n\n

\n
Explore Microsoft resources to help manage regulatory compliance<\/a><\/div>\n<\/div>\n\n\n\n

Understanding the UK critical third <\/a>parties regime<\/h2>\n\n\n\n

The CTP regime created under the Financial Services and Markets Act 2023, gives HM Treasury the power to designate third-party service providers as \u201ccritical\u201d to the UK financial sector, and gives the Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA), collectively \u201cthe regulators,\u201d the ability to set rules for, gather information from, and oversee those critical third party providers.<\/p>\n\n\n\n

The regime exists because financial firms increasingly rely on a small number of third parties for services that are critical and important to their business operations. The regulators\u2019 aim is to manage the risk that a failure in, or disruption to, one of those services could affect many firms at once and, in turn, threaten the stability of the wider financial system. Notably, the UK regime is technology-neutral (it is not limited to cloud providers), and designation is made by HM Treasury on the recommendation of the regulators.<\/p>\n\n\n\n

What the designation means and what it does not<\/h2>\n\n\n\n

As a designated critical third party, MIOL is subject to direct oversight by the regulators in relation to the services identified as systemic. In practice, this involves engagement with the regulators under a set of fundamental rules, alongside expectations in areas such as self-assessment, scenario testing, incident management, and incident reporting. A core principle of the regime is that a critical third party should deal with the regulators in an open and cooperative way, an approach MIOL fully embraces as a critical third party under the UK CTP regime.<\/p>\n\n\n\n

It is equally important to be clear about what the designation does not change. As with the EU\u2019s DORA regime, financial firms remain primarily accountable as regulated institutions. As set forth in Supervisory Statement SS6\/24:2<\/sup><\/p>\n\n\n\n

The CTP duties complement the requirements and expectations for firms on operational resilience, outsourcing and third party risk management. The CTP oversight regime sits alongside these requirements and expectations but does not eliminate, reduce nor replace the accountability of firms, their boards and senior management (including individuals performing SMFs). <\/em><\/p>\n\n\n\n

Microsoft, as a technology provider, is committed to meeting its own obligations and helping its customers meet theirs, while the regulatory responsibilities of a financial institution remain with the institution. For our customers, it is business as usual: there are no material changes to the Microsoft services they rely on today.<\/strong><\/p>\n\n\n\n

Supporting our customers\u2019 operational resilience<\/h2>\n\n\n\n

Microsoft has long invested in the security, compliance, and resilience of its cloud platform, and that investment is what enables us to support financial institutions as they meet their own regulatory obligations. We take a global, scaled approach to these requirements, ensuring that customers can have confidence that consistent operational and security controls apply wherever they operate. The capabilities most relevant to operational resilience include:<\/p>\n\n\n\n