Green Dolphin Critical Supplier Survey

Would this supplier survive the scrutiny that is coming?

A structured self-assessment of one critical supplier arrangement, for UK building societies and banks. Thirty-seven questions give two separate numbers: where the arrangement sits today, and how ready you are for the third-party reporting rules that take effect on 18 March 2027.

See a sample report Free to use. No sign-up required.

Q4 2026 editionAbout 15 minutes · answers stay in this browser unless you choose to send them · sources checked 8 October 2026

What has changed · evidence to 30 September 2026

Three developments this survey is set against. Each links to the regulator’s own page.

The reporting rules have a start date

From 18 March 2027, banks, building societies and other in-scope firms report a register of their material third-party arrangements each year, and notify the regulators before entering into, or significantly changing, one. Operational incidents are reported too, with the first report expected within 24 hours.

  days until the rules take effect

Sources: PRA PS7/26 and FCA PS26/2, 18 March 2026

Four critical third parties are now overseen

Since 13 July 2026 the Bank of England, PRA and FCA have overseen Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited. The regime “complements, but does not replace” firms’ own outsourcing and resilience obligations.

Source: Bank of England, 10 July 2026

Third parties sit behind a large share of incidents

In 2025, 27% of incidents reported to the FCA were attributed to a third-party issue, and 37% of those were cyber-related. A September exercise with defence and government found a gap in how firms think about shared dependencies.

Sources: FCA and PRA, 28 July 2026; FCA, 7 September 2026

How the survey reads an arrangement

Two numbers, kept apart

Supplier posture today. Governance, contracts, concentration, resilience and exit, cyber and monitoring, weighted the way supervisors weight them.

Readiness for 18 March 2027. The register, the critical third-party designations, incident reporting and the renewals that fall before then.

Together they place the arrangement in one of four positions: Assured, Static, Aware or Exposed.

Read the sample report as: Board or CEO · Risk · Third-party risk · Technology

What the survey helps you answer

  1. Can we evidence that this arrangement is classified correctly, to the standard the new register will expose?
  2. Do we know where the four designated critical third parties sit in this supplier’s delivery chain?
  3. Would our exit plan work if this supplier stopped co-operating, not just if it left politely?
  4. Which of this supplier’s renewals fall before 18 March 2027, and what has to change at each one?
  5. If this supplier had an incident at 02:00 on a Sunday, would we make our first report within 24 hours?
What this survey is not
Not advice. A structured self-assessment built to open better board and supplier conversations.
Not a regulatory return. The register is uploaded to FCA RegData under PS7/26 and PS26/2. This helps you prepare; it is not that submission.
Not an independent assessment. It scores what you tell it. It does not test evidence, read contracts or interview your supplier.
Not a data grab. No login and no analytics script. Answers stay in this browser unless you use one of the forms to send something to us.

Common questions

Is this a PS7/26 or PS26/2 submission?
No. Under those policy statements, in-scope firms upload a register of material third-party arrangements to FCA RegData each year once the rules take effect on 18 March 2027, and notify through FCA Connect before entering into or significantly changing a material arrangement. This survey gives you a structured view of one arrangement so you can prepare.
How long does it take?
Around 15 minutes per supplier. You can stop at any point: your answers are saved in this browser and the survey resumes where you left off.
Where do my answers go?
Your answers are saved in this browser’s local storage, on this device. Nothing is sent to Green Dolphin unless you choose to use a form: the contact form at the end of your report sends your details with your survey context and scores, and the question form below sends your email address and question. Both go to info@greendolphintccr.com, read by Paul and Pete. The page loads its typefaces from Google Fonts, so Google receives a request from your browser when the page opens. There is no analytics script.
How is it scored?
Each question is answered against published anchors: 2 for in place, 1 for partial, 0 for not in place, with “don’t know” scored 0 and tracked separately because unknowns carry their own risk. Domains are weighted the way supervisors weight them (materiality, contracts, and resilience and exit carry more), and each domain’s target is set by the arrangement’s materiality. The report shows the anchor behind every mark.
Can I assess more than one supplier?
Yes. After your first report you can run the survey for another arrangement; your firm-size choice is remembered and a portfolio view appears once you have two or more.
What is it anchored to?
PRA PS7/26 and SS1/26; FCA PS26/2; PRA SS2/21 (including the March 2026 update that takes effect in March 2027); PRA SS1/21 and FCA SYSC 15A; FCA FG16/5; the critical third parties regime under FSMA 2023 and the July 2026 designations; the FSB toolkit (2023); the Basel Committee’s third-party risk principles; NIST SP 800-161r1; ISO/IEC 27036; NCSC guidance; the CMORG Cloud Control Framework (TLP:CLEAR); UK GDPR and the ICO. Every question shows its anchor as you answer.
More questions we hear from boards and risk teamsWritten answers, each with its source

Nothing matches that yet. Send it to us below.

Send us your question

It goes to info@greendolphintccr.com and Paul or Pete replies, usually within one working day. No mailing list.

Please enter a valid email address and your question.

The wider picture

This survey reads one supplier. The Green Dolphin Operational Risk Radar reads the sector around it: ten families and fifty topics, every claim cited, refreshed quarterly.

Open the Radar
Step 1 of 2 · the arrangement

Tell us what we are surveying

Three details calibrate everything that follows. They are used only to label and calibrate your report.

Please name the supplier to continue.

Services which, if disrupted, could cause intolerable harm to your customers or put your firm’s safety and soundness at risk. Defined under PRA SS1/21 and FCA SYSC 15A.

Your best current view. If the mapping is unclear, that becomes a finding.

Renewals before 18 March 2027 are the cheapest place to fix contract gaps.

Your firm

Please choose the closest fit to continue.

Supplier criticality, your current view The test in PS7/26 and PS26/2: could disruption to this arrangement materially harm your safety and soundness, or the continuity of an important business service? If yes, it is material, whatever the contract value. Intragroup arrangements count. The March 2026 update to SS2/21 adds examples for identifying material arrangements.

The report will challenge this where your answers suggest it should be different.

Please choose a tier to continue.

0 of 5 confirmed Supplier name, firm and tier are needed to begin.

Answers are saved in this browser only, on this device. “Start over” clears them.

Step 2 of 2 · surveying
0 of 0 answered · 0%
Critical Supplier SurveyQ4 2026 edition

A self-assessment of what you told the survey, not an independent assurance review. Scored 0, 1 or 2 against published supervisory expectations and weighted by materiality. Not advice.

Reading this as

The two numbers

Supplier posture today A weighted score across domains A to G. In place scores 2, partial 1, not in place and don’t know 0. Materiality, contracts, and resilience and exit carry a weight of 1.2.
0/100

Readiness for 18 March 2027 Scored from the horizon domain plus the date-driven questions A3, A5 and E5, on the same 0 to 2 scale. It reads your preparedness for the register, notification and incident reporting rules that take effect on 18 March 2027.
0/100

Position map: supplier posture today against readiness for March 2027 Aware Assured Exposed Static Supplier posture today Readiness for March 2027 Gaps closed Last run This arrangement

Solid marker: today. Dashed: where closing the three priority gaps takes it, on our read.

Thresholds sit at 60 on both axes. Assured: strong on both. Static: strong today, not ready for what is coming. Aware: sighted on what is coming, weak today. Exposed: work needed on both, with a deadline attached to one of them.

AssuredStrong today and sighted on March 2027. Keep the evidence current.
StaticSolid today, not ready for the new rules. Strong is not the same as ready.
AwareSighted on what is coming, but today’s arrangement would not withstand scrutiny yet.
ExposedWork needed on both axes, and one of them has a deadline.

Our read of your answers

The three gaps that matter most

Ranked by domain weight and answer severity: where a supervisor or auditor would start. Open each for what good looks like and the evidence an assessor would ask for.

Take these into your next meetings

Further detail

Open what you need. Everything prints in full.

Domain by domainWhere the marks came from, and the target for an arrangement of this materiality
Where you are Target for this arrangementColour shows distance to target. Open a row for the fastest route.
What you already haveAnswers marked in place: strengths to show your board, audit committee or supervisor

Flagged: don’t knowOn a material arrangement, a “don’t know” is itself a finding
    Beyond this supplierWhat these answers suggest about the machinery that manages all your suppliers

    Each numbered dot is plotted by effort to build and value returned; the list is the key. Read these as prompts: one supplier is one data point.

    Your portfolioEvery supplier you have assessed in this browser, latest run each

    Numbered dots are keyed to the list; choose a name to open that supplier’s report.

    What to do nextFour steps that make the most of this report
    Deeper reviews we can run with youNine senior-led reviews on your actual evidence, scoped and priced per engagement
    From self-assessment to evidence

    Want help reviewing this supplier?

    The survey shows where to look; a review does the looking. Supplier documentation and onsite reviews start at £3,750, senior-led, on your actual contracts, register entries, exit plans and board minutes. We never take referrals from the suppliers we assess.

    • Evidence-based and proportionate to your size
    • Concentration and fourth-party mapping across your material arrangements
    • Stressed exit tested against an unco-operative supplier
    • A board-ready report with senior manager accountability framing

    Please enter a valid email address.

    This sends your details, the supplier context you entered, both scores, your priority gaps and any “don’t know” answers to info@greendolphintccr.com, so we arrive prepared. Paul or Pete replies, usually within one working day. No mailing list.

    Sent. Thank you.

    Paul or Pete will reply, usually within one working day. Print or save this report for your records in the meantime.

    Would a conversation help?

    Email or call Paul or Pete. Everything sent from this survey goes to info@greendolphintccr.com, which they both read.

    Paul O’Leary
    Paul O’Leary
    Founder & Director
    paul@greendolphintccr.com
    07498 929 396
    Pete Richardson
    Pete Richardson
    Director
    Pete@greendolphintccr.com
    07702 073 155