UK designates AWS, Azure, Google Cloud and Oracle as Critical Third Parties to its financial system
HM Treasury formally designated Amazon Web Services, Microsoft Azure, Google Cloud and Oracle as Critical Third Parties to the UK financial system on July 13, 2026, placing the four cloud providers under direct resilience oversight by UK financial regulators; the move extends regulatory reach into the cloud infrastructure that banks and other financial institutions rely on for core operations
أضف إلى قائمة
لا قوائم بعد.
Summary
The UK's HM Treasury formally designated Amazon Web Services, Microsoft Azure, Google Cloud and Oracle as Critical Third Parties (CTPs) to the UK financial system on July 13, 2026. The designation places the four cloud providers under direct resilience oversight by UK financial regulators, extending regulatory reach into the cloud infrastructure that banks and financial institutions rely on for core operations. Previously, cloud providers were regulated only indirectly, through obligations on the banks and insurers that contracted them.
Why it matters
Banks and insurers across the UK depend on these four providers for infrastructure that, if disrupted, could affect the whole financial system. The CTP designation gives UK regulators direct access and enforcement powers over the cloud companies themselves, rather than routing all oversight through their customers. It is a significant structural change in how the UK frames systemic technology risk.
What to watch
- How the Bank of England, the FCA and the PRA set and enforce operational resilience standards for the four designated CTPs.
- Whether additional cloud or technology providers are added to the CTP register.
- Whether the EU, US or other jurisdictions adopt comparable direct-oversight frameworks for cloud providers to financial systems.