Summary

• UK regulators will oversee AWS, Google Cloud, Microsoft Ireland Operations, and Oracle Corporation UK as critical third parties.
• The regime reflects the systemic risk created when many financial firms depend on the same cloud and technology providers.
• Regulated firms remain responsible for outsourcing and resilience, but suppliers now face direct oversight for critical services.

The Financial Conduct Authority, the Bank of England, and the Prudential Regulation Authority will begin overseeing the first technology suppliers designated as critical third parties to the UK financial system, bringing major cloud and infrastructure providers into a direct resilience regime.

HM Treasury has designated Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, and Oracle Corporation UK Limited. From 13 July 2026, the UK financial regulators will oversee critical services these suppliers provide to financial firms and financial market infrastructure.

The regime reflects a hard feature of modern finance. Banks, insurers, payment companies, fintechs, trading venues, and market infrastructure providers may compete at the customer layer, yet many rely on a small number of shared technology suppliers underneath. A serious outage, cyber incident, operational failure, or failed change at one provider could affect multiple firms at once.

HM Treasury’s designation notice says oversight will apply only to systemic services provided to the financial sector, not to the firms’ wider operations. Financial firms also remain responsible for managing risk from their suppliers. The new regime is not a transfer of accountability, but it does give regulators a direct line of sight into suppliers whose services now underpin critical financial activity.

The UK approach follows the same market logic as the EU’s Digital Operational Resilience Act, which also brings critical ICT third party providers into financial sector oversight. The structures differ, but both regimes accept that cloud, data, identity, security, and managed technology platforms have become part of the operational foundation of finance.

Cloud providers will face deeper scrutiny of resilience arrangements, incident reporting, testing, governance, and recovery. Financial institutions may gain more regulatory confidence about systemic suppliers, but they cannot treat designation as comfort. A regulator watching a cloud provider does not make a weak exit plan strong or an incomplete dependency map accurate.

Firms still need to understand which business services depend on which cloud regions, identity layers, networking arrangements, databases, security tools, and software providers. They also need realistic recovery exercises that account for failures outside their own perimeter. Cloud resilience cannot be reduced to a supplier assurance document refreshed once a year.

The regime also sits alongside competition concerns in cloud markets. Regulators have examined concentration, switching barriers, egress charges, committed spend, and software licensing practices. Operational resilience and competition are separate policy questions, but they overlap when a small number of suppliers become both difficult to leave and essential to the system.

Cloud adoption in finance has often been discussed through speed, cost, AI capability, and modernisation. The critical third party regime reframes the same infrastructure as part of national economic resilience. That does not make cloud less useful. It does make cloud governance a board level and regulatory concern, especially as financial firms push more workloads, analytics, and AI systems onto shared platforms.

The first designations will not be the end of the regime. Treasury has made clear that further providers may be brought into scope where disruption could threaten financial stability or confidence. The perimeter around finance’s hidden infrastructure has begun to move.