Sagepay ACS Providers being blocked by CSP

Question

We have an integration with sagepay where we load sagepay url within an iframe in our web-application. We do have *.sagepay.com defined in the frame-src