UK regulators begin oversight of critical cloud providers

The Bank of England, PRA and FCA will begin overseeing the first designated critical third parties on Monday 13 July 2026 under a new UK regime.

• The Treasury has made its first designations of four global technology providers: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd, and Oracle Corporation UK Limited.
• The regime focuses on the resilience of critical services used by UK financial firms; regulators will jointly oversee CTPs, while Treasury retains responsibility for future designations and de-designations.
• The announcement also notes that the regime complements existing outsourcing and operational resilience rules, and that final rules introduced in November 2024 came into effect on 1 January 2025.