By 11 October 2026 no fifth Critical Third Party had been designated: legislation.gov.uk lists no amendment to the Critical Third Parties (Designation) Regulations 2026 (SI 2026/777), and Reuters reported on 10 July 2026 that only four firms are designated, AWS, Google Cloud, Microsoft and Oracle.
The fifth-designation market resolves on the designation instrument itself: an amendment to the Critical Third Parties (Designation) Regulations 2026 laid on legislation.gov.uk and announced on gov.uk. It resolves YES only if a fifth entity stands designated on or before 11 October 2026; a consultation, a regulator recommendation, a reported candidate list or a de-designation resolves NO. If an instrument is laid without an announcement, the Bank of England and FCA Critical Third Parties pages, which list the designated firms, settle it.
We looked for first lists of this kind: a national or EU authority used a new legal power to name specific financial firms as critical to the system and to supervise them directly. We checked whether at least one more firm was added to the list within 90 days of the start. We found seven first lists since 2012, and only one grew in that time.