Back
UK designates Microsoft, Google, Amazon and Oracle as critical third parties

UK designates Microsoft, Google, Amazon and Oracle as critical third parties

The July 10 move brings the four cloud providers under direct oversight from UK financial regulators from July 13, widening scrutiny of technology concentration and operational resilience in finance.

Fact Check
Two authoritative primary sources — the GOV.UK announcement and the Bank of England announcement, both dated 10 July 2026 — confirm HM Treasury designated Microsoft, Google, Amazon (AWS) and Oracle as Critical Third Parties, with joint oversight by the Bank of England, PRA and FCA effective 13 July 2026. Reuters independently corroborates. The claim's key elements (four named cloud providers, designation on July 10, oversight from July 13, UK financial regulators) all match precisely.
Summary

The UK has formally designated Amazon Web Services, Microsoft, Google and Oracle as critical third parties under the Financial Services and Markets Act 2023, making them subject to direct oversight by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority from July 13. The move targets a longstanding regulatory gap by giving authorities powers to test the resilience of major cloud providers, require self-assessments and receive incident reports directly from the firms themselves. More than 65% of UK organizations rely on the four providers for cloud infrastructure, underscoring regulators’ concern that disruption at a small group of technology vendors could threaten financial stability. The change also matters for crypto firms, including exchanges, custodians and blockchain analytics companies that depend on the same cloud infrastructure, while potentially raising compliance costs and reinforcing the market position of the largest providers.

Terms & Concepts
  • critical third parties: External service providers whose disruption could pose risks to the financial system and that can be placed under direct regulatory oversight.
  • operational resilience: The ability of firms and key service providers to keep important services running during outages, cyber incidents or other disruptions.
  • stress-test: A regulatory exercise used to assess whether infrastructure or firms can withstand severe shocks without causing broader system disruption.