The situation
HM Treasury’s designation of Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited takes effect on 13 July 2026. The move brings the systemic services they supply to UK financial firms and financial market infrastructures under joint oversight by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority.
The oversight does not cover the providers’ wider operations and is not a finding of misconduct. Regulators can collect information, assess operational resilience and impose or enforce provider-specific requirements where needed. Designated providers must maintain resilience arrangements across governance, dependencies, supply chains, technology and cyber risk, service mapping, incident response and termination; they must also establish incident-management playbooks within 12 months. Financial firms remain responsible for their own outsourcing due diligence, contingency planning and third-party-risk controls.
Why it matters
The designations move the UK’s Critical Third Party framework from a standing regime into active supervision of concentrated cloud dependencies in finance. They give UK authorities a direct route to test and address risks at providers whose disruption could affect multiple regulated firms or financial market infrastructures at once.
For the providers, the immediate effect is a new resilience and reporting burden limited to systemic UK financial-sector services. For banks, insurers and market infrastructures, the regime adds an external layer of scrutiny but does not shift responsibility for continuity planning or supplier risk management away from them.
What changed
HM Treasury announced the first four Critical Third Party designations on 10 July 2026; they take effect on 13 July 2026, activating direct supervisory powers under rules that otherwise began on 1 January 2025.
The assessment
Current judgement
The UK is strengthening financial-stability oversight of concentrated cloud-service dependencies, but the scale of any subsequent intervention remains undetermined.
Key assumption
The named providers continue to supply services judged systemic to the UK financial sector.
What could challenge this assessment
Designation is limited to systemic financial-sector services and does not regulate the providers’ entire businesses or transfer third-party-risk obligations from financial firms.
Impacts
Economic Pressure
Direct supervision increases resilience, reporting and potential remediation requirements for the systemic UK financial-sector services of the four designated providers.
Markets
The regime is designed to reduce financial-stability risk from concentrated cloud dependencies affecting banks, insurers and financial market infrastructures, while firms retain responsibility for continuity planning.
Trade & Supply Chains
The designations focus supervisory attention on provider dependencies, supply-chain risk and service termination for cloud services that are systemic to UK finance.
What to watch
- Do the Bank of England, PRA or FCA identify resilience gaps that require provider-specific rules or enforcement after supervision begins?
- Have the designated providers put incident-management playbooks in place by July 2027, including recovery and regulator-communication procedures?
Evidence and uncertainty
Moderate confidence. Moderate confidence. 3 retained references from 3 reporting origins (HM Treasury, Financial Conduct Authority, Reuters). Claim-level independent corroboration has not been established. Confidence concerns the evidence for the reported development, not the probability of an outlook.
Useful context
Critical Third Party
A provider designated by HM Treasury because disruption to services it supplies could threaten the stability of, or confidence in, the UK financial system.
The designation activates direct oversight of the providers’ systemic services to the UK financial sector.
Prudential Regulation Authority
The Bank of England body responsible for prudential regulation of banks, insurers and certain other financial firms.
It jointly oversees designated Critical Third Parties with the Bank of England and the Financial Conduct Authority.
Geographic context
- 01London, UK (city)
- 02Dublin, Ireland (city)
- 03Luxembourg, Luxembourg (city)