UK Brings Major Cloud Providers Under Financial Regulator Oversight as Critical Third Parties

The United Kingdom has begun directly overseeing major cloud and technology providers that supply critical services to the financial sector, with four firms formally designated as Critical Third Parties from 13 July 2026. The designations, announced by HM Treasury, allow the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority to jointly supervise the critical services these providers deliver to banks, insurers and other regulated firms. The regime is aimed at ensuring those services remain resilient and can recover quickly from operational disruption, reflecting how deeply financial institutions now depend on a small number of cloud and infrastructure suppliers. Economic Secretary to the Treasury and City Minister Rachel Blake said maintaining trust in the financial system is essential to the UK's standing as a leading financial centre, and that the designations would help protect consumers and businesses while supporting growth. Importantly, financial firms remain responsible for managing risks arising from their own third-party suppliers, including due diligence, risk management and contingency planning; the new regime complements rather than replaces existing outsourcing and operational resilience rules. Each designated provider has committed to complying with the oversight requirements.