Four global cloud and technology providers become the first firms directly overseen by UK financial regulators under a regime designed to prevent tech outages spreading through the financial system.
The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority will begin overseeing the first Critical Third Parties (CTPs) from Monday 13 July, after HM Treasury named Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited as the first firms to fall under the regime.
The designations mark the point at which a regulatory framework that has existed on paper since January 2025 finally takes effect. Parliament gave the Bank, PRA and FCA the power to oversee critical third parties under the Financial Services and Markets Act 2023, and the regulators published final rules in November 2024. Those rules applied immediately to any CTP once designated, but until this week, HM Treasury had designated none.
The CTP regime exists because so much of the UK financial sector now runs on the same handful of cloud and technology platforms. A disruption at one provider can, in theory, hit multiple banks, insurers and market infrastructures simultaneously. Sarah Breeden, deputy governor for financial stability at the Bank of England, said critical third parties “can introduce new forms of systemic risk” as they become more embedded in financial institutions’ operations, and that the regulators’ oversight would ensure “these dependencies are managed in a way that safeguards financial stability.”
Designated firms must meet six fundamental rules covering integrity, skill and diligence, prudent conduct, risk management, effective organisation and open dealing with regulators, according to legal analysis from Pinsent Masons. Most of those obligations apply only to services the regulators classify as “systemic third party services”, though the rule on regulatory cooperation and disclosure applies across everything a CTP provides. Providers also face separate requirements on operational, cyber and supply chain resilience, incident reporting, and plans to help firms exit contracts and recover their data if a relationship ends.
Crucially, designation is not authorisation. “Being a CTP is not the same as being a regulated financial services firm,” Pinsent Masons partner Angus McFadyen said. “CTPs are under oversight, not supervision.” Firms that use these providers keep full responsibility for their own third-party risk management, due diligence and contingency planning, the Bank stressed, and the regime sits alongside existing outsourcing and operational resilience rules rather than replacing them.
The UK’s four designations look modest next to the EU’s equivalent regime. Under the Digital Operational Resilience Act, Brussels has designated 19 critical ICT third-party providers, more than four times the UK’s initial list. McFadyen called the UK move a “significant step forward” that brings Britain into line with the EU approach, while noting the gap in scale. The Bank and other UK regulators signed a memorandum of understanding with EU counterparts in January to coordinate oversight of firms that fall under both regimes.
The designations also land as a political vindication. Dame Meg Hillier, chair of the Treasury Committee, said seeing “movement on this after we have pressed for months” was “a huge step forward”, pointing to her committee’s January report on AI in financial services, which recommended the Treasury use its CTP powers on cloud and AI providers. Hillier said the committee may push for AI firms specifically to be designated as their role in financial services grows, and that it would now focus on how the regulators put the regime into practice.
FCA chief executive Nikhil Rathi said the same providers “serve thousands of firms”, meaning “a single failure can reverberate across the financial system”, while Katharine Braddick, deputy governor for prudential regulation and PRA chief executive, said the regime would support the safety and soundness of regulated firms that depend on this infrastructure.
HM Treasury retains sole power to add or remove firms from the CTP list, based on recommendations from the three regulators, who will periodically review whether designated firms still meet the criteria. With the scope of the regime expected to widen, attention will now turn to which providers, cloud, AI or otherwise, join Amazon, Google, Microsoft and Oracle next.
