The situation
HM Treasury’s first Critical Third Party designations take effect on 13 July 2026, bringing specified systemic services supplied by Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited to the UK financial sector under direct joint oversight. The FCA, Bank of England and Prudential Regulation Authority can use information gathering, regulatory engagement and resilience assessments to supervise those services.
The designations cover only services judged capable of threatening UK financial stability or confidence if disrupted; they do not regulate the providers’ entire businesses. Banks, insurers and financial market infrastructures remain responsible for their own outsourcing, operational-resilience and third-party-risk controls.
Why it matters
The move shifts oversight beyond individual financial firms to the shared technology dependencies that could transmit a cloud disruption across multiple institutions. It gives UK authorities a direct channel to seek assurance, resilience testing and major-incident reporting from providers whose services are designated as systemic.
For financial institutions, the measure adds a layer of supervisory scrutiny around concentrated cloud dependencies but does not replace existing firm-level obligations. The immediate effect is regulatory rather than operational: the evidence does not indicate an outage, cyber incident, penalty or compulsory service change.
What changed
The UK regime began in January 2025, but 13 July 2026 marks the first provider-specific designations and the start of direct oversight for the designated services.
The assessment
Current judgement
Improving financial-system resilience through targeted supervision of shared cloud-service dependencies, although the effectiveness of the framework will depend on its implementation and testing.
Key assumption
The designated services are sufficiently material to UK financial stability or confidence that direct oversight will improve detection and management of common-provider disruption risks.
What could challenge this assessment
The available evidence does not quantify each provider’s exposure to UK financial institutions or show that direct supervision has yet changed provider operations.
Impacts
Markets
Direct oversight targets shared cloud dependencies that could amplify a technology disruption across UK financial firms and market infrastructures, strengthening the sector’s resilience framework.
Economic Pressure
The designations impose targeted supervisory obligations on systemic financial-sector services, including potential assurance, resilience-testing and incident-reporting requirements, without regulating the providers’ entire businesses.
Trade & Supply Chains
The decision highlights the UK financial sector’s reliance on a small group of external cloud-service providers, but the evidence does not show any required change to service provision or procurement.
Full edition assessment · Markets
Markets face higher volatility from the unresolved threat to Strait of Hormuz shipping, which can raise risk premia across energy, tanker freight and marine insurance even though the supplied evidence does not establish specific price moves or a quantified reduction in flows. The most direct exposures are energy-linked transport and insurance rather than a broad, verified market dislocation.
A separate UK measure improves financial-system resilience by placing designated systemic cloud services supplied to financial firms under direct regulatory oversight from 13 July. It addresses concentration risk prospectively and does not reflect a current outage, cyber incident or compulsory service change.
Moderate confidence · Volatile · Volatile
Maritime insecurity can sustain sector-specific risk premia
Contested Hormuz access increases uncertainty for oil and LNG transport, tanker availability and marine insurance, creating a credible pathway to higher volatility in linked exposures.
Energy producers with Gulf export dependence, tanker operators, marine insurers, refiners and airlines face differentiated exposure; the evidence does not support a conclusion of broad equity-market stress.
Signal to watchConfirmed changes in shipping volumes, freight rates, insurance availability or safe-passage arrangements would show whether risk premia are becoming more durable.
UK oversight targets concentrated cloud dependencies
The UK’s first Critical Third Party designations give financial regulators direct supervisory tools over specified systemic services supplied by four major cloud providers, supplementing firm-level resilience obligations.
UK financial institutions using designated services may face more structured assurance, testing and incident-reporting expectations, while the designated providers face targeted supervisory engagement.
Signal to watchThe first announced resilience assessment, testing exercise or incident-reporting requirement would indicate how forcefully the oversight regime is being applied.
What to watch
- Do the FCA, Bank of England and PRA begin using the new powers to require resilience testing, assurance or incident reporting from the designated services after 13 July?
- Do UK authorities designate additional third-party providers or systemic services, indicating that cloud concentration risks extend beyond the first four entities?
Critical Third Party designations take effect
Scheduled:
The four providers’ designated systemic services become subject to coordinated FCA, Bank of England and PRA oversight.
Regulatory confirmation of the effective designations and initial supervisory requirements or engagement.
Evidence and uncertainty
Moderate confidence. Moderate confidence. 2 retained references from 2 reporting origins (HM Treasury, Financial Conduct Authority). Claim-level independent corroboration has not been established. Confidence concerns the evidence for the reported development, not the probability of an outlook.
Useful context
Critical Third Party
A designation for a third-party provider whose disruption could threaten UK financial stability or confidence in the financial system.
It enables direct regulatory oversight of the provider’s designated systemic services to the financial sector.
PRA
The Prudential Regulation Authority, the UK regulator responsible for prudential supervision of banks, insurers and certain other financial firms.
It jointly oversees designated Critical Third Parties with the FCA and Bank of England.
Geographic context
- 01London, UK (city)