Cloud giants face new UK rules for keeping banks online

Amazon, Google, Microsoft and Oracle now face direct UK oversight of the cloud services they provide to banks.

The Bank of England’s Financial Policy Committee (FPC) welcomed the move in the record of its 25 September meeting, published on Wednesday (30 September).

HM Treasury named Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited as the first four firms under the Critical Third Parties regime.

The Treasury announced the designations on 10 July 2026, and they took effect on 13 July.

The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority will now jointly oversee the four providers.

The providers must now follow operational resilience rules set out in the Bank’s and regulators’ rulebooks.

The regime came into force on 1 January 2025, but its rules only apply to a provider once the Treasury formally designates it.

Law firm Morrison Foerster said a major cloud outage in October 2025 hit many financial firms and showed how heavily UK financial services rely on a handful of providers.

The designations also follow a January 2026 Treasury Committee report, which called for the major AI and cloud providers to fall under the regime by the end of 2026.

Law firm Lewis Silkin said the Treasury plans a rolling programme of designations, with more providers expected to join the regime as risks to the sector evolve.

The FPC said the regime will create a more resilient environment for financial firms and support confidence in UK financial markets.

Now read: Burnham’s triple lock replacement has one big unanswered question