The new Critical Third Party regime creates a direct supervisory route into the systemic technology infrastructure behind banks, Open Banking platforms and payment rails.
Key Points
- From 13 July 2026, UK regulators directly oversee the critical financial-sector services provided by AWS, Google Cloud, Microsoft and Oracle.
- The regime allows regulators to gather information, assess resilience, require testing and enforce CTP-specific rules.
- It does not provide unlimited live access to every transaction database and does not replace the responsibility of regulated banks, EMIs, payment institutions or payment facilitators.
- The framework supports FinTelegram’s long-standing investigative approach: follow the entire technical and payment stack—not merely the casino brand, customer interface or merchant descriptor.
The New UK Technology Perimeter
The UK has formally brought four global cloud and technology providers into a new financial-sector oversight perimeter. From 13 July 2026, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority jointly oversee:
- Amazon Web Services EMEA SARL;
- Google Cloud EMEA Limited;
- Microsoft Ireland Operations Limited; and
- Oracle Corporation UK Limited.
The four companies were designated by HM Treasury as the first Critical Third Parties, or CTPs, under the framework established through the Financial Services and Markets Act 2023. The designation applies only to systemic services provided to the UK financial sector—not to the companies’ entire global operations—and does not constitute financial-services authorisation. (GOV.UK)
The rationale is straightforward: banks, insurers, payment systems and fintech companies increasingly depend on a small number of technology providers. A cyberattack, outage, software failure or other disruption at one provider could therefore affect numerous regulated firms and millions of customers simultaneously. (GOV.UK)
What Regulators Can Now Demand
Under the new regime, designated providers must identify and manage risks to their critical services and communicate openly and promptly with regulators and affected financial institutions, especially during major incidents.
The authorities can gather information, assess operational resilience, require assurance and testing, review major incidents and make or enforce CTP-specific rules where necessary. The framework includes resilience testing and scenario exercises involving both the technology providers and the financial institutions relying on them. (GOV.UK)
This does not mean that the FCA has received a permanent live connection to every cloud database or unrestricted access to all raw customer transactions. It does mean that a designated provider can no longer rely exclusively on high-level contractual assurances, prepared dashboards or generic certifications where regulators require deeper technical evidence about the resilience of a systemic service.
Why This Matters for Casino Payment Investigations
FinTelegram’s casino and payment-facilitator investigations have repeatedly demonstrated that the visible transaction layer is often only the front door. Behind a casino brand, checkout page or harmless-looking card descriptor may sit a much broader infrastructure involving:
Casino brand → cashier platform → payment facilitator → gateway or Open Banking provider → regulated EMI or PI → cloud and data infrastructure → acquiring and settlement entities
The recent Zentoria / Spinsopotamia / NALMI Compliance Intelligence Report applied precisely this end-to-end methodology.
Download the Zentoria Compliance Report here.
Rather than treating the visible “Spinsopotamia.com Dublin” billing descriptor as the full payment story, FinTelegram examined DNS records, hosting concentration, application bundles, telemetry configurations, platform dependencies and payment integrations. The report identified a highly concentrated technical environment connecting the Zentoria-facing descriptor with a much larger NALMI-hosted casino ecosystem, while carefully distinguishing technical correlation from proven common ownership or criminal liability. (fintelegram.com)
The Softon reporting similarly raised questions concerning Cyprus-linked casino infrastructure and payment arrangements. The subsequent attempt to reframe disputed public-interest reporting as a hosting-abuse issue also demonstrated how infrastructure providers can become part of the wider compliance and accountability chain. (fintelegram.com)
These investigations support a central compliance principle:
Regulators cannot understand a payment flow by examining only the customer interface or the name displayed on a bank statement. They must reconstruct the entities, APIs, databases, routing rules, infrastructure providers and settlement relationships behind it.
The Black-Box Defence Is Getting Weaker
The new UK regime does not directly regulate merchant masking, transaction laundering or illegal casino payments.
Those issues remain primarily the responsibility of banks, acquirers, EMIs, payment institutions, payment facilitators and other regulated entities responsible for merchant onboarding, transaction monitoring and financial-crime controls.
However, the CTP framework weakens a recurring defence in complex payment investigations: that the underlying transaction data, processing logic or technical dependencies sit inside an external technology environment and cannot be meaningfully examined.
Where a systemic financial service depends on a designated cloud or technology provider, regulators now have a direct oversight relationship with that provider. They no longer have to rely exclusively on the regulated institution’s interpretation of what occurs inside the outsourced infrastructure.
This is particularly relevant where transaction information passes through several technical stages:
Original payment data → event stream → storage layer → analytics or query layer → API → customer-facing display
A merchant name visible in a banking application may therefore not be identical to the original payment record, legal beneficiary, merchant account, upstream gateway entry or settlement destination.
The new framework does not presume manipulation. But it strengthens the authorities’ ability to investigate the architecture where systemic services and operational resilience are involved.
No Safe Harbour for Financial Firms
Banks, payment institutions, EMIs and other regulated firms remain fully responsible for their own outsourcing arrangements.
The FCA explicitly states that the CTP regime complements rather than replaces existing outsourcing and operational-resilience obligations. Financial firms must continue to conduct due diligence, assess concentration risks, maintain contingency plans and understand the third parties on which their services depend. (FCA)
A regulated payment provider therefore cannot defend an inadequate merchant-monitoring or transaction-control framework by pointing to AWS, Google Cloud, Microsoft or Oracle.
Likewise, CTP designation does not mean that every financial-sector service supplied by these companies is automatically resilient, compliant or regulator-approved.
FinTelegram Assessment
The UK CTP regime represents an important change in financial supervision.
For the first time, the British authorities are directly overseeing technology groups whose infrastructure has become systemically important to the financial sector.
For FinTelegram, the main conclusion is not that regulators suddenly have unrestricted access to all raw transaction data.
The more important development is that cloud and technology infrastructure can no longer be treated merely as an invisible outsourced layer behind the regulated financial institution.
The regime validates the investigative logic used in the Zentoria, Spinsopotamia, NALMI, Softon and other casino-payment reviews:
Follow the rails. Map the infrastructure. Separate the visible descriptor from the underlying transaction chain.
HM Treasury has described the CTP framework as a rolling regime and has confirmed that additional providers may be designated where disruption could threaten financial stability or confidence. There is no statutory limit on the number of future CTPs. (GOV.UK)
The first four designations may therefore be only the beginning.
Whistleblower Request
FinTelegram invites payment professionals, developers, compliance officers, former employees and other informed sources to provide information concerning:
- casino payment-facilitator structures;
- merchant-descriptor transformations;
- Open Banking transaction routes;
- payment gateway and API mappings;
- merchant IDs and settlement beneficiaries;
- cloud-hosted transaction databases;
- shared casino infrastructure and platform tenants;
- attempts to conceal or misrepresent underlying payment flows.
Information may be submitted confidentially through Whistle42.
