On Monday, July 13, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority began directly overseeing four companies that are not banks, not insurers, and not payment firms. They are cloud providers: Amazon Web Services, Google Cloud, Microsoft and Oracle. HM Treasury designated them as Critical Third Parties to the UK financial system, the first use of powers Parliament wrote into the Financial Services and Markets Act 2023.
The language in the press releases is dry. The shift underneath it is not. For more than a decade, financial regulators have written operational-resilience rules and pointed them at the regulated: hold this much capital, map your important business services, prove you can recover from an outage. Those rules stopped at the firm’s boundary. They never reached the infrastructure the firm sat on. As of Monday, they do.
The concentration nobody could regulate away
The problem is arithmetic. A 2024 Bank of England and FCA survey found that the top three third-party providers accounted for roughly 73% of the cloud services reported by UK financial firms. The Treasury separately noted that more than 65% of UK organisations rely on the same small group of providers for core infrastructure. Concentration at that level changes the shape of the risk. A single provider’s bad afternoon no longer degrades one bank. It can degrade dozens at once, because they all run on the same racks.
Regulators have understood this for years. The tool they had was indirect: lean on each regulated firm to manage its own third-party risk. That works when a bank depends on a supplier the bank can actually discipline. It does not work when the supplier is larger than the entire sector that depends on it, and when switching providers is a multi-year migration nobody wants to attempt first. The indirect model asked banks to govern a counterparty with more leverage than they had. The CTP regime drops the pretense and points supervision straight at the source.
What supervisors actually worry about is substitutability. A concentrated market is tolerable if you can move off a failed provider quickly. Cloud does not work that way. Migrating a core banking platform between hyperscalers takes years and rewrites, and few firms have a tested exit. That combination, high dependence and low substitutability, is precisely what turns an ordinary outage into a sector-wide event, and it is the property the new oversight is built to test rather than assume away.
What the regulators can now do
Designation is not authorisation. The regulators have been explicit about the limit. They are not licensing AWS to operate, and they are not overseeing Amazon’s retail arm or Microsoft’s gaming division. The FCA’s statement draws the line plainly: “Designation under this regime is not the same as authorisation by the regulators. Oversight is limited to the resilience of the services they provide to UK financial firms.”
Inside that boundary, the toolkit is real. Per the Treasury and the Bank of England, the three regulators can gather information and assess the resilience of designated services, require providers to address risks to service continuity, and make and enforce CTP-specific rules. The final rules, set in November 2024 and live since January 1, 2025, add resilience testing, scenario exercises, and a duty to report major incidents directly to the regulator rather than through the banks downstream. Rachel Blake, the Economic Secretary to the Treasury, tied it to the stakes: “maintaining trust in our financial system is essential to its success.”
One power is notably absent: fines. The UK regime is principles-based and, for now, cannot levy penalties on a designated provider. Its leverage is supervisory attention, mandatory testing, and the standing threat of tighter rules, not a fine schedule.
The European precedent, and where the UK diverges
Britain is not first. The EU’s Digital Operational Resilience Act has applied since January 17, 2025, and in November 2025 the European Supervisory Authorities designated their first 19 critical ICT third-party providers, the same cloud majors among them. The UK and EU regimes share an aim and diverge on method, and the differences are instructive.
DORA is rule-based and prescriptive. It carries fining powers, sets quantitative designation thresholds (a provider servicing more than 10% of EU financial firms can qualify), mandates minimum contract terms between banks and their ICT suppliers, and reaches extraterritorially by requiring non-EU providers to stand up an EU subsidiary as a point of contact. The UK regime does none of these. It is principles-based, sets no quantitative trigger, imposes no contract templates, is location-agnostic, and requires CTPs to report incidents directly to regulators rather than through the firms they serve.
The practical result: a hyperscaler now answers to two separate supervisory tracks with overlapping goals and different instruments. That is duplicative, and it is the price of two jurisdictions independently deciding that cloud concentration is a financial-stability question rather than a procurement one.
The inversion
Strip away the acronyms and one thing happened on July 13. The direction of financial supervision reversed. For a decade, the regulated perimeter held banks, and technology vendors sat outside it as suppliers. Now four of the largest technology companies on earth sit, for a defined slice of what they do, inside it. Big Tech did not lobby its way into financial regulation. It was pulled in, because the sector’s dependence on it grew too load-bearing to leave unsupervised.
This is a distinct axis from the bank-capital debates that dominate prudential policy. It is not about how much equity a lender holds. It is about whether the plumbing beneath every lender can be trusted to stay up, and who is accountable when it does not. Britain has decided the answer cannot be the banks alone. The servers are now in scope, and the Treasury has said the list of four is only the start.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.