HM Treasury has designated four global cloud service and technology providers as Critical Third Parties under the UK financial sector’s operational resilience regime. From 13 July 2026, the systemic services they provide to banks, insurers and financial market infrastructures will come under joint oversight by the Bank of England, Prudential Regulation Authority and Financial Conduct Authority, reflecting concerns that disruption at a major provider could affect multiple firms at once. The designated firms are Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL and Oracle Corporation UK Limited. The new regime applies only to the critical services they provide to the financial sector, not to their wider operations. It gives regulators powers to gather information, assess resilience and work with providers to address risks to service continuity, including by making and enforcing provider-specific rules where needed. HM Treasury said the designations follow evidence gathering and engagement with the firms, and that financial firms remain responsible for managing risks arising from their third-party suppliers. HM Treasury said the regime is intended to operate on a rolling, risk-based basis, meaning further providers may be designated where disruption could threaten UK financial stability or confidence in the financial system.
HM Treasury2026-07-10
HM Treasury designates four cloud providers as Critical Third Parties from 13 July 2026
HM Treasury has designated Microsoft, Google Cloud, Amazon Web Services and Oracle entities as Critical Third Parties from 13 July 2026. Their systemic services to the UK financial sector will come under joint oversight by the Bank of England, Prudential Regulation Authority and Financial Conduct Authority. The regime is risk-based and may be extended to other providers over time.