Critical third party, a designation, not a description

Internally, most firms call a vendor critical when its failure would stop a business service. That is a tiering judgement, made by you, using your own criteria, and it drives how much diligence the vendor gets.

The regulatory meaning is narrower and is not yours to make. It applies where a provider is systemically important across many firms — the cloud platforms, payment infrastructure and core banking providers a sector concentrates on — and designation brings that provider itself into scope for direct requirements and supervision. In the UK, HM Treasury designates critical third parties and the Bank of England, PRA and FCA set the rules, which took effect at the start of 2025. Under DORA, the ESAs designate critical ICT third-party service providers and one of them acts as Lead Overseer.

Less than firms expect. Designation puts obligations on the provider; it does not transfer your own. You remain accountable for the outsourced service, for your exit arrangements, and for the resilience of the business service the provider supports. Supervisors have been consistent that a designated provider is not a provider you may stop managing.

What it does change is what you can rely on. Designated providers face direct oversight and testing, which improves the evidence available to you and reduces the argument about whether a hyperscaler will complete your questionnaire. The obligation to understand your own concentration in that provider is unaffected.