Financial institutions in the UK should consider the implications of the newly announced regime for ‘critical third parties’ (CTPs) on their relationships with IT service providers and on the financial services industry more widely.