x

Key Takeaways

  • HM Treasury designated Amazon Web Services, Microsoft, Google and Oracle as critical third parties on 10 July 2026, with joint regulatory oversight beginning Monday 13 July.
  • The cloud critical third party regime was created by the Financial Services and Markets Act 2023 and is enforced jointly by the Bank of England, the PRA and the FCA.
  • Designation targets concentration risk: the fear that thousands of regulated firms depending on a handful of cloud platforms could suffer simultaneous disruption from a single outage or cyber-attack.
  • Designated providers must meet operational resilience, cyber-security, incident-reporting and information-sharing standards for the systemic services they supply, though banks remain fully accountable for managing their own outsourcing.
  • The rules underpinning designation were finalised in November 2024 and took effect on 1 January 2025; the July 2026 designations bring the framework into live operation.

Summary

On 10 July 2026 HM Treasury named Amazon Web Services, Microsoft, Google and Oracle as cloud critical third parties to UK finance, with the Bank of England, PRA and FCA beginning joint oversight on 13 July. The regime, created under the Financial Services and Markets Act 2023, tackles cloud concentration risk by holding systemic technology suppliers to resilience, cyber-security and incident-reporting standards while banks retain accountability for outsourcing.

Why is the Bank of England now watching Big Tech's cloud?

For the first time, the companies that host much of the UK financial system's computing power sit squarely within their regulators' sightline. On 10 July 2026 HM Treasury designated four technology groups — Amazon Web Services, Microsoft, Google and Oracle — as critical third parties to the financial sector, and joint oversight by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority began on Monday 13 July. The move brings the UK's cloud critical third party regime, legislated in 2023, from statute into live supervision.

In plain terms, these firms provide the remote servers, storage and software that banks, insurers, asset managers and payment companies rent instead of running their own data centres. So much of the industry now leans on so few suppliers that a serious failure at one could ripple across dozens of regulated businesses at once. The designation is an attempt to place that dependency under formal scrutiny rather than leaving it to individual contracts.

What does 'critical third party' actually mean?

A critical third party, or CTP, is an external supplier whose services are judged so important to the stability or confidence of the UK financial system that its failure could threaten many firms simultaneously. The label was created by the Financial Services and Markets Act 2023, which amended earlier legislation to give HM Treasury the power to make designations on the recommendation of the regulators. Only the Treasury can designate; the Bank of England, PRA and FCA then supervise.

Crucially, designation does not turn a cloud company into a regulated bank. The regulators describe their remit as oversight rather than full supervision. The rules bite on the specific "systemic" services a provider supplies to the sector — for example core cloud hosting relied on by numerous institutions — not on every corner of the firm's global business. The framework also stops short of dictating commercial terms, so financial firms still negotiate their own contracts.

The concentration risk regulators are trying to contain

The central worry is concentration. A large share of UK financial services now runs on a small number of cloud platforms, and the same providers serve thousands of firms at once. Sarah Breeden, the Bank of England's Deputy Governor for Financial Stability, has warned that as such suppliers become more deeply embedded in financial institutions they can introduce new forms of systemic risk. Nikhil Rathi, chief executive of the FCA, has made a related point: when one provider sits behind so many firms, a single failure can reverberate across the system.

The concern is not hypothetical. Cloud outages, misconfigurations and software faults have already knocked banking apps, card payments and trading tools offline for hours at a time in recent years. Because rival banks frequently use the same underlying platform, a fault at one supplier can hit competitors together, removing the diversity that normally limits contagion. That is precisely the vulnerability the cloud critical third party regime is designed to expose and reduce.

Cyber risk sharpens the picture. The same scale that makes these platforms efficient also makes them attractive targets, and a successful intrusion or ransomware attack on shared infrastructure could compromise data and services across many firms at once. Regulators have long argued that no single institution can fully audit a supplier several times its size, which leaves gaps that only a system-wide view can close. Placing the largest cloud providers under formal oversight is meant to give the authorities that wider vantage point.

What will Amazon, Microsoft, Google and Oracle have to do?

Designated providers must meet a set of fundamental rules and more detailed operational-resilience expectations for the systemic services they supply. In broad terms these require the firms to act with integrity and due skill, manage risks prudently, organise their affairs responsibly and cooperate openly with the regulators. The obligations were finalised in November 2024 through policy statements from the Bank and the FCA and took effect on 1 January 2025, ahead of the first designations.

  • Setting and testing resilience standards so that critical services can withstand, recover from and adapt to disruption.
  • Strengthening cyber-security and defences against attacks on the infrastructure that financial firms depend upon.
  • Managing supply-chain and fourth-party risks that sit behind the headline service.
  • Reporting significant operational incidents promptly to the regulators.
  • Sharing information and submitting to inspection under the authorities' new powers, including scenario testing of severe but plausible disruption.

The regulators have gained information-gathering and inspection powers to check compliance, and can require participation in resilience testing. Yet the tools are calibrated: the aim is to assure the robustness of shared infrastructure, not to micro-manage how a multinational technology group runs its wider operations. Providers were given the designated status collectively on 10 July, with oversight commencing three days later.

What it means for UK banks, insurers and financial firms

For regulated firms, the most important message is that designation does not transfer responsibility. Banks, building societies, insurers and investment managers remain fully accountable for their own outsourcing arrangements, due diligence and continuity planning. Using a designated provider does not discharge a firm's own operational-resilience duties; if a service fails, the regulated firm still answers to its supervisors and its customers. In practice, boards should treat CTP designation as reinforcement, not relief.

There are practical benefits. Because the regulators can now test and gather information directly from systemic suppliers, individual firms may gain assurance and data they previously struggled to extract from far larger counterparties. Smaller banks and fintechs, which have limited bargaining power against global cloud groups, stand to gain most from a common baseline. Consumers, ultimately, should see steadier access to payments, banking apps and insurance systems, and fewer of the sudden outages that leave customers unable to move money or make card payments.

How does the UK approach compare, and what comes next?

Britain's designation of four suppliers sits alongside the European Union's parallel effort under its Digital Operational Resilience Act, which has identified a larger group of critical information and communications technology providers. The UK has deliberately started with a narrow list focused on the most systemic cloud platforms, and the Treasury retains the power to add further names if dependence deepens or new suppliers become embedded in the sector.

Sceptics note the limits of the approach. Oversight is not the same as the intensive supervision applied to banks, the designated firms are headquartered outside the UK, and much of their conduct is governed by group-wide policies set far from London. Critics may also argue that concentrating attention on four names does little to encourage financial firms to spread their workloads across more providers, which would tackle concentration at its root. Regulators counter that visibility and testing are necessary first steps.

The immediate test is implementation. Regulators must show they can obtain meaningful information from firms far larger and more global than any single UK bank, and coordinate across borders when incidents strike. The cloud critical third party regime does not eliminate the risk that a major outage could still cascade through the financial system, but by putting Amazon, Microsoft, Google and Oracle under direct scrutiny, the UK has at least made that dependency visible, testable and, for the first time, formally accountable.