Summary

  • The UK–Australia forum discussed reducing unnecessary duplication in oversight of global critical third parties, then promised continued cooperation and another forum in 2027.
  • The UK–EU CTP memorandum already sets an information-sharing and coordination framework; the Australia statement names no equivalent public instrument or timetable.

On 27 October, six regulators and two treasuries held the second UK–Australia Joint Financial Regulatory Forum. Its statement, published two days later, put a very practical question on the agenda: can regulators compare notes on the same global service provider without making that provider answer the same resilience questions twice?

The forum said comparable regimes could support effective oversight while reducing unnecessary duplication. It promised continued bilateral work, cooperation through the G20 and Financial Stability Board, and a further forum in 2027. That is a useful agenda; an operating arrangement would go further.

The UK has moved to direct oversight of designated critical third parties. HM Treasury makes the designation; the Bank of England, Prudential Regulation Authority and Financial Conduct Authority can set rules, gather information and enforce requirements for designated providers’ systemic services. Oversight of the first four began on 13 July 2026.

Australia’s framework assigns important duties through a different route. Under the current APRA standard CPS 230, banks, insurers and other APRA-regulated entities must manage provider arrangements, keep a register of material service providers and report that register annually. The Reserve Bank of Australia separately oversees relevant systemically important payment systems and financial market infrastructures. Those scopes matter: the two countries are not simply running the same rulebook under different flags.

The dependency is large enough to make coordination more than conference-room etiquette. The RBA’s March Financial Stability Review says some of Australia’s largest regulated entities use around 150 providers supporting critical operations. Many serve multiple entities or the industry as a whole; many are overseas and outside Australia’s regulatory perimeter. The RBA does not count duplicate audits or quantify provider burden. It does show why a provider map that stops at the border will be incomplete.

There is already a useful comparison. In January, UK regulators and the European Supervisory Authorities signed a memorandum on critical third parties and the EU’s DORA regime. The Bank of England says it establishes coordination and information sharing, including for incidents such as outages or cyberattacks, and is intended to reduce duplication. That is a named instrument with an operational purpose, not just a promise to keep talking.

The missing fact is a public UK–Australia work plan naming the shared provider and service data, incident routes, lead responsibilities and timetable; publication of those details would change the comparison. For now, the forum has set a direction and a next meeting, not a cross-border control surface. A date on the calendar can convene the people who need to agree; it cannot reconcile two provider registers by itself.

Sources