Third-Party Risk Management Failures Expose UK Finance Sector

A survey of large UK financial services firms found 58% suffered at least one third-party supply chain attack in 2024 (23% faced three or more), with significantly lower attack rates among organizations practicing continuous third-party risk assessment versus onboarding-only checks. Respondents expressed concern over UK–EU regulatory divergence and favored DORA-like nationwide rules, while the UK’s Cyber Security and Resilience Bill signals movement toward NIS2-aligned resilience; overall sentiment on UK regulation was cautiously positive.