BANK OF ENGLAND TO OVERSEE CLOUD SERVICE PROVIDERS FROM JULY 2026

The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority will begin overseeing Critical Third Parties from 13 July 2026, following designations announced by HM Treasury. HM Treasury has designated four providers as Critical Third Parties: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd, and Oracle Corporation UK Limited. These organisations are technology and service providers whose operations underpin the UK financial system. The regulators stated that disruption or failure of these services could affect multiple firms or markets simultaneously and potentially impact UK financial stability and services relied upon by millions of consumers and businesses.

The three regulators will jointly oversee the designated Critical Third Parties under a new proportionate regime focused on the resilience of critical services provided to the UK financial sector. The regulators will work with the providers to address system-level risks and reduce the potential for disruption to spread across the UK financial system. Critical Third Parties must identify and manage risks to their critical services effectively and maintain open, timely communication with regulators and dependent firms, particularly during major incidents. The regulators stated that these changes will strengthen system-wide resilience and improve coordination and information sharing across the UK financial sector.

The new regime complements but does not replace existing outsourcing and operational resilience rules that apply to regulated firms, which remain responsible for managing their own third-party arrangements. The Bank of England stated that the changes support a more resilient operating environment for firms, which will in turn support financial stability and confidence in UK financial markets. Regulated firms retain responsibility for due diligence, risk management and contingency planning relating to their third-party arrangements.