UK designates AWS, Azure, Google Cloud and Oracle as Critical Third Parties to its financial system

Summary

The UK's HM Treasury formally designated Amazon Web Services, Microsoft Azure, Google Cloud and Oracle as Critical Third Parties (CTPs) to the UK financial system on July 13, 2026. The designation places the four cloud providers under direct resilience oversight by UK financial regulators, extending regulatory reach into the cloud infrastructure that banks and financial institutions rely on for core operations. Previously, cloud providers were regulated only indirectly, through obligations on the banks and insurers that contracted them.

Why it matters

Banks and insurers across the UK depend on these four providers for infrastructure that, if disrupted, could affect the whole financial system. The CTP designation gives UK regulators direct access and enforcement powers over the cloud companies themselves, rather than routing all oversight through their customers. It is a significant structural change in how the UK frames systemic technology risk.

What to watch

• How the Bank of England, the FCA and the PRA set and enforce operational resilience standards for the four designated CTPs.
• Whether additional cloud or technology providers are added to the CTP register.
• Whether the EU, US or other jurisdictions adopt comparable direct-oversight frameworks for cloud providers to financial systems.