The Bank of England, Prudential Regulation Authority, and Financial Conduct Authority will oversee Amazon Web Services, Google Cloud, Microsoft, and Oracle as Critical Third Parties starting July 13, 2026. This move addresses the financial system's growing dependency on a small number of cloud service providers.
Regulators warn that a disruption at one of these firms could impact multiple financial institutions simultaneously. Such events pose a significant threat to overall UK financial stability.
The new regime subjects these tech giants to mandatory resilience testing and regular self-assessments. These companies must also report major incidents directly to the regulators.
This oversight ensures operational durability for services provided to banks, insurers, and financial market participants. The framework complements existing rules that hold individual financial firms responsible for managing their own third-party risks.