A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube
Status: EXPERIMENTAL · Community-contributed · Output is not regulatory advice. The CTP dependency assessment MUST be reviewed, materially supplemented, and signed off by qualified UK FS regulatory counsel, the firm's Compliance Officer, and the SMF holder with primary accountability for operational resilience (typically SMF24 at larger firms; SMF1 at smaller firms without a dedicated COO). The CTP regime (BoE/PRA/FCA PS24/16, effective January 2025) is recent and the designated CTP list is still maturing — verify the current HMT designation page before relying on any provider being designated or not designated. Regulatory citations reflect the position at the document creation date; verify against current BoE, PRA, and FCA publications before reliance.
Purpose
The /arckit:uk-fs-ctp-dependency command generates a Critical Third Party (CTP) dependency
register and resilience testing plan for an authorised UK Payment Service Provider (PSP), Electronic
Money Institution (EMI), or Payment Institution (PI). The command is grounded in the CTP regime
established by PS24/16 (BoE/PRA/FCA, effective January 2025) under the statutory authority of the
Financial Services and Markets Act 2023 (FSMA 2023).
The artefact maps the firm's dependencies on cloud hyperscalers, payment networks, and BaaS (Banking-as-a-Service) providers — distinguishing formally designated CTPs from material non-CTPs — and produces a four-dimension materiality scoring, concentration risk analysis, and a resilience testing plan including exit and substitution drills. It also captures Nth-party (sub-contractor) dependencies, which are frequently the actual failure mode in real-world CTP incidents.
When to Use
- Initial CTP dependency mapping — any firm that relies on cloud hyperscalers (AWS, Azure, Google Cloud), major payment networks (Visa, Mastercard, SWIFT), or core BaaS providers should produce a CTP dependency register as a baseline, regardless of whether those providers are formally designated.
- Post-January 2025 compliance refresh — the CTP regime became effective in January 2025. Firms that have not yet produced a structured CTP dependency assessment against PS24/16 should do so as a priority.
- Before a new vendor is onboarded — where a new provider would be material to one or more Important Business Services (IBS), the materiality assessment framework in this command should be applied before contract signature.
- Annual resilience planning cycle — the resilience testing plan requires exit and substitution drills to be dated and evidenced. Use this command to refresh the register and confirm that drill outcomes are recorded.
- Pre-FCA supervisory engagement — before a supervisory visit, a skilled-person review, or an operational resilience questionnaire submission, the firm needs a current, structured CTP dependency register aligned to PS24/16.
Inputs
Pass the project ID and product context as $ARGUMENTS:
/arckit:uk-fs-ctp-dependency 004 core payments platform
The argument should include:
- The project number or an existing project directory name.
- A brief description of the system or platform in scope (used to scope the dependency register to the relevant IBS).
- Optionally: the names of the firm's primary cloud provider(s), payment network connections, and BaaS providers (used to pre-populate the dependency register blocks).
The command also reads the project's FSSAFE artefact (if generated by /arckit:uk-fs-safeguarding)
to cross-reference the safeguarding bank as a candidate CTP-adjacent dependency.
Output
Doc-type code: FSCTP
Output path: projects/<NNN>-<slug>/payments-compliance/ARC-<NNN>-FSCTP-v1.0.md
The generated artefact contains the following sections:
- Document Control (classification, owner, accountable SMF holder, review cycle)
- Scope and Important Business Services (IBS definitions and impact tolerances from the firm's operational resilience framework)
- Designated CTP Identification (HMT designation list check; provider-by-provider status)
- Materiality Assessment (four-dimension scoring framework for each provider)
- CTP Dependency Register (per-provider blocks: services consumed, substitution time, last drill date, Nth-party dependencies)
- Resilience Testing Plan (exit drills, substitution drills, drill cadence, gap remediation timeline where no drill has been conducted)
- Concentration Risk Analysis (geographic, vendor, functional concentration; maximum correlated failure scenario per dimension)
- SMF Accountability (named SMF holder with primary accountability; MLRO involvement scope)
- References (all required citations)
Key Regulatory Anchors
Statutory basis: FSMA 2023 granted the BoE, PRA, and FCA powers to oversee designated Critical Third Parties. The CTP regime (PS24/16) became effective in January 2025. The FCA CTP Sourcebook instrument (FCA 2024/41) contains the detailed oversight rules.
Designated CTP list: HMT designates CTPs following regulator recommendation. The designated list is published at the HMT critical third parties page. The list is still maturing — providers not currently designated may be designated in future; a provider that is not on the list at the time this assessment is produced may appear on it before the next annual review.
Materiality scoring: The command applies a four-dimension scoring framework (IBS dependency, substitution difficulty, recovery time impact, concentration risk contribution — each scored 1 to 5). Overall materiality score range is 4 to 20:
- 16–20: Critical — treat as designated CTP equivalent regardless of formal designation
- 11–15: High — material non-CTP; enhanced monitoring and annual substitution drill required
- 6–10: Medium — monitor; document Nth-party risks
- 4–5: Low — maintain basic continuity plan
Nth-party (sub-contractor) dependencies: Many real-world CTP failures originate at sub-contractor level, not at the primary CTP. Cloud hyperscalers rely on specialist sub-contractors for power, cooling, hardware supply, and networking. The dependency register requires Nth-party dependencies to be surfaced explicitly for each designated CTP and material non-CTP.
FINOS Common Cloud Controls is referenced in the command as a useful open control library for mapping which cloud controls apply to each CTP relationship. It is not an FCA or PRA regulatory mandate — cite it as a reference substrate, not as a compliance requirement.
MLRO involvement scope: The MLRO's role in CTP assessment is narrow — it is limited to scenarios where a CTP relationship directly affects AML or sanctions screening capability (e.g. a third-party sanctions-screening service that is itself a material CTP). General operational resilience and CTP dependency assessment does not require MLRO sign-off beyond this narrow scope.
Composes With
| Command | Relationship |
|---|---|
/arckit:adr |
CTP exit strategy, multi-vendor decisions, and substitution approach are architectural decisions with long lead times. Record them as ADRs for traceability and board visibility. |
/arckit:risk |
CTP failure scenarios (provider failure, geographic outage, functional concentration) feed Orange Book risk register entries. Cross-reference FSCTP and RISK document IDs. |
/arckit:operationalize |
Disaster recovery and exit drill runbooks are day-2 operational artefacts. The resilience testing plan in FSCTP defines the what; /arckit:operationalize assembles the how. |
/arckit:uk-fs-safeguarding |
The safeguarding bank is often a CTP-adjacent dependency. The FSSAFE artefact should be read before populating the CTP dependency register to cross-reference the safeguarding bank. |
Important Caveats
- The designated CTP list is still maturing. A provider that is not currently designated may become designated while this assessment is in use. Build a re-verification step into the annual review cycle — do not treat the designation status at authoring time as permanent.
- "Material non-CTP" providers are in scope, not just formally designated CTPs. The firm's own IBS impact tolerances require an assessment of all materially relied-upon third parties. The materiality scoring framework captures this broader universe; do not limit the register to the formally designated list.
- Exit and substitution drills must be evidenced — not merely planned. A resilience testing plan that lists "substitution drill planned for Q3 2025" without a recorded outcome is an audit finding. The "last resilience test date" field in the dependency register must contain a date. Where no drill has yet been conducted, document this as a gap with a remediation timeline signed off by the accountable SMF holder.
- Concentration risk is an explicit regulator focus. The BoE/PRA/FCA oversight approach accompanying PS24/16 examines whether aggregate CTP dependencies create correlated failure exposures. Surface concentration risk explicitly even where each individual provider looks acceptable in isolation.
- SMF accountability must name an individual, not a team. Primary accountability for operational resilience sits with SMF24 (Chief Operations Function) at most large firms, and with SMF1 (CEO) at smaller firms. The dependency register must name the accountable SMF holder explicitly — a document listing "Operations Team" is not compliant.
- Operational resilience and CTP dependency assessment overlap significantly. The firm's IBS definitions and impact tolerances (set under the FCA/PRA operational resilience framework effective March 2022) are the anchor for CTP materiality scoring. Ensure these are documented before running this command; the command reads from the RISK artefact for any IBS-adjacent entries but cannot substitute for a formal IBS definition process.
References
| Reference | URL |
|---|---|
| FCA PS24/16 — Operational resilience: Critical third parties to the UK financial sector | https://www.fca.org.uk/publications/policy-statements/ps24-16-operational-resilience-critical-third-parties-uk-financial-sector |
| Financial Services and Markets Act 2023 (FSMA 2023) — CTP statutory basis | https://www.legislation.gov.uk/ukpga/2023/29 |
| HM Treasury — Critical Third Parties: HMT's approach to designation (March 2024) | https://www.gov.uk/government/publications/critical-third-parties-hm-treasurys-approach-to-designation |
| FCA CTP Sourcebook instrument (FCA 2024/41) | https://www.handbook.fca.org.uk/instrument/2024/FCA_2024_41.pdf |
| FINOS Common Cloud Controls — open cloud control library for financial services | https://www.finos.org/common-cloud-controls-project |
| FCA Operational Resilience — firms guidance | https://www.fca.org.uk/firms/operational-resilience |