Take the two percentages the supervisors put in the same paragraph and multiply them. If 27% of incidents firms reported to the FCA in 2025 were attributed to a third party [5], and 37% of those were cyber-related [6], then roughly one in ten reported incidents was a cyber failure that occurred somewhere other than the reporting firm [7]. That is the number the regime is built on: not a catastrophe, but a steady tithe of outages that a firm's own controls could not have prevented because the failure was not on its premises.
The supervisory logic follows from concentration rather than severity. The post says banks, insurers, payment firms and FMIs increasingly depend on a relatively small number of common providers, among them cloud providers, technology firms and data providers [4], and that oversight is aimed at system-level risk where many firms rely on the same service, plus coordination and information-sharing during major incidents [3]. Designation is what converts a line in a supplier register into a counterparty the Bank of England, PRA and FCA oversee directly and jointly [2], under powers the government granted for this purpose [1].
What the designated providers owe is specified: identify and manage the risks in the critical services they supply, test and improve their resilience arrangements, and engage openly with regulators and firms during incidents [10]. What clients get is described more softly, as better visibility of risk and better communication when something large breaks [16], delivered partly through joint testing exercises and the sharing of self-assessments where appropriate [11].
Read the caveats as carefully as the powers. The regulators state plainly that the regime does not replace firms' responsibility for their own operational resilience and third party arrangements, and does not extend to every provider a firm uses [12]; the existing firm-level rules stand and are complemented, not superseded [14]; and the regime cannot and will not end all disruptions [13]. A firm whose critical vendor is now supervised has gained an information channel and lost no accountability.
One practical gap sits in the source itself: it does not name the designated providers or say how many were designated [15]. Until that list is in hand, nobody can reconcile it against a supplier register, which is the only exercise that tells an operator whether this regime touches them at all. It is also worth noticing where the contagion evidence comes from. The examples offered are the 2024 CrowdStrike outage, which hit organisations worldwide [8], and cyber incidents at Marks & Spencer and Jaguar Land Rover [9] - retailers and a carmaker, cited to a financial services audience. The regulators are arguing from other people's outages because the shared-dependency failure they are supervising against has mostly happened elsewhere so far.
