UK regulators to oversee first critical third parties

The Bank of England, PRA and FCA will begin overseeing the first designated Critical Third Parties on Monday 13 July 2026, following HM Treasury’s designation of four major cloud and technology providers.

• First designations: HM Treasury has designated Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd, and Oracle Corporation UK Limited as Critical Third Parties.
• Regime details: the three regulators will jointly oversee the resilience of the critical services these providers supply to the UK financial sector; the regime starts on 13 July 2026 and complements existing outsourcing and operational resilience rules.
• The article also cites prior milestones: the regulators’ final rules and policy came into effect on 1 January 2025, and HM Treasury remains responsible for future designations and de-designations.