Different firms.
The same dependency.

A supplier inventory answers who the firm buys from. A dependency map asks which important services rely on that supplier, on which specific capabilities and on which further dependencies. The latter can reveal that several apparently separate workarounds still use the same identity, network or technology service.

The relevant concern is the consequence of failure or disruption, including correlated impact across firms. A high procurement spend is useful context, but it does not by itself define the systemic importance of a service.

HM Treasury decides whether to designate a provider as a CTP, generally drawing on recommendations from the financial regulators. The Bank, PRA and FCA then oversee the services in the regime according to their statutory responsibilities. Do not describe every important supplier as directly supervised under this framework.

The oversight approach is outcomes-focused and proportionate to systemic risk. Its purpose is not to provide an approval badge for every product sold by a designated group. Ask what the oversight covers before relying on it in an internal assurance statement.

Smaller suppliers outside designation still matter to a firm if their failure can interrupt an important service. The absence of CTP designation is not evidence that an arrangement is low risk or requires no oversight by the customer.

The customer should be able to use relevant supplier information in its own scenario analysis. A test conducted by a provider may have a different scope from the service the firm actually depends on. Establish the assumptions and remaining gaps rather than simply recording that “testing exists”.

During an incident, communication needs to support action: what is affected, which workaround is viable, what recovery assumption is changing and what the firm should tell its own customers. A status update that cannot reach the firm’s decision-maker in time is a weak operational control.

A financial institution still needs to understand its important services, tolerate plausible disruption and manage the third parties supporting them. Designation does not replace a workable contract, an exit plan or an internal decision about concentration.

• Map the specific supplier service to the business services and customer outcomes that depend on it.
• Reconcile the supplier’s evidence with the firm’s own usage, configuration and responsibilities.
• Test the workaround and recovery path, including shared identity or access dependencies.
• Keep escalation and customer communication ready for an extended supplier incident.
• Record which residual risks need a management decision rather than another questionnaire.

Exit deserves particular realism. A legal right to change supplier may not create an alternative platform within the interruption the business can tolerate. Decide which functions need a workaround, which can wait and which require an engineered alternative before the event.

The Bank and EU supervisory authorities signed a cooperation memorandum in January 2026 covering oversight of critical providers, including information-sharing during incidents. That reflects the reality that the same technology providers can serve financial institutions across borders.

Cooperation is not equivalence of every UK and EU requirement. Keep the UK CTP regime distinct from the EU’s DORA oversight framework and from the firm’s own reporting obligations. Shared evidence can help, but scope and responsible authority still need to be clear.

For management, the practical next step is a short service-level review of one major dependency: what the provider supplies, what oversight reaches, what evidence your firm receives and how the business would keep operating if that service failed.