UK financial regulators' new direct oversight of four cloud providers designated as Critical Third Parties

2026-07-12T22:00:00Z

Britain will start directly overseeing four cloud providers that support its financial sector on 13 July. HM Treasury has designated Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited as the first Critical Third Parties (CTPs). Their relevant services will enter a joint regime run by the Bank of England (BoE), the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA). [1][2][3]

What designation changes

The regime targets a particular vulnerability: many banks, insurers and financial-market infrastructures rely on a small number of external technology providers. If a common provider suffers a cyberattack or outage, the disruption can affect multiple firms or markets at once instead of remaining one company's operational problem. [1][2]

The three regulators will focus on the resilience of critical services supplied to UK finance. Designated providers must identify and manage relevant risks and maintain timely communication with regulators and the firms that rely on them, especially during major incidents. Reuters reports that resilience testing, regular self-assessments and major-incident reporting will also be required. [1][2][3]

What designation does not change

CTP status is not an authorisation to provide financial services, and it does not make a cloud provider responsible for every operational decision made by a bank. The BoE says the oversight is limited to the resilience of services supplied to UK financial firms. Individual firms remain responsible for due diligence, risk management and contingency planning for their own third-party arrangements. [2]

That distinction matters. This is not a general attempt to regulate the cloud sector; it is a system-level response to a shared dependency inside finance. The policy gives regulators a view across services used by many institutions, while those institutions retain responsibility for managing their own exposure. [2][3]

For learners, the event makes a usually invisible dependency easier to see. The policy is built on a shared technical dependency: many institutions can be exposed to the same supplier and the same disruption. [1][2] That makes resilience a collective question, not just a private IT concern. The next test is implementation: whether the new oversight improves incident readiness without treating technology providers as banks. [2]

Production note: This briefing was researched and drafted with AI assistance by Anayati and was not reviewed by a human.

Discover

How the Internet Works, Cables and Packets

Computer ScienceHow the Internet Works, Cables and PacketsPeel back the digital veil and discover the **Physical Internet**. Forget the "cloud"—the web is a tangible machine of **submarine cables**, **data centers**, and **routers**. Learn how **data packets** and **IP addresses** navigate this global infrastructure, transforming technical magic into clear reality.Open course

References

UK to regulate cloud service providers Microsoft, Google and others to protect financial stability

UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury

Government announces first CTP designations