HM Treasury has refused to commit to designating major artificial intelligence and cloud providers as Critical Third Parties (CTPs) to the UK financial system before the end of 2026, despite a direct recommendation from the Treasury Select Committee in January and mounting pressure from the Bank of England’s Prudential Regulation Authority. The department’s official response, published on 16 April, said only that it was “gathering evidence” and expected to make “initial designation decisions” during the calendar year, without naming AWS, Microsoft Azure, Google Cloud or any frontier-model supplier as a candidate.
The reply has drawn an unusually public rebuke from committee chair Dame Meg Hillier, who told colleagues in a statement accompanying the publication that the department’s stance “falls short” of the urgency the City and the Bank’s Financial Policy Committee have signalled (Treasury Select Committee, 16 April 2026).
How the CTP regime actually works
The Critical Third Parties regime is the United Kingdom’s main answer to financial-sector concentration in cloud and, increasingly, AI. It was created under the Financial Services and Markets Act 2023 and given operational shape in November 2024 when the Bank of England, the PRA and the FCA jointly published Supervisory Statement SS6/24, setting out final rules for designated firms. Once HM Treasury formally designates a provider, the three regulators gain the power to write rules for that supplier, demand information directly from it and take enforcement action — a sharp departure from the UK’s normal, firm-by-firm supervision model (Bank of England SS6/24, November 2024).
The regime’s stated aim is narrow: to protect “the stability of, or confidence in, the UK financial system” against the failure of a single dominant provider. Industry estimates suggest more than two-thirds of regulated UK firms’ workloads now run on AWS or Microsoft Azure, with Google Cloud a distant third, and the same hyperscalers are now also the leading distributors of frontier AI models through their managed services.
Where the Treasury drew the line
Officials accept that AI and cloud raise CTP-grade systemic questions, but argue the evidence base for AI specifically is “still maturing”. The April response said designations require a high bar of factual analysis, including dependency mapping across regulated firms and credible substitution analysis — work that, on Treasury’s account, has not been completed for foundation-model suppliers. The Committee, by contrast, sees that as a reason to start the process now rather than later.
The standoff is sharpened by parallel work elsewhere. The PRA listed AI adoption in its 2026 supervisory priorities; the FCA has just opened a second AI Live Testing cohort that includes Lloyds Banking Group, Barclays, UBS and Experian; and the Competition and Markets Authority is running a separate Strategic Market Status investigation into AWS and Microsoft cloud under the new digital-markets regime. The CMA route, however, is competition law rather than operational resilience, and cannot substitute for CTP designation.
What to watch before year-end
The Bank of England’s Financial Policy Committee meets in June and December, and both meetings are expected to revisit cloud and AI concentration risk. A Treasury policy statement on the first wave of CTP designations — whether or not it names hyperscalers — is now the City’s clearest near-term signal. If hyperscalers are excluded again, expect the Treasury Committee to return to the question publicly in the autumn, and for the gap between Whitehall caution and Threadneedle Street’s risk language to widen further.
For regulated firms running mission-critical workloads on AWS, Azure or Google Cloud, the practical position is unchanged for now: they remain on the hook for outsourcing risk under existing PRA and FCA rules, while their suppliers stay outside the direct enforcement perimeter. That asymmetry is exactly what the CTP regime was designed to close, and the Committee’s frustration is essentially about how long Whitehall is willing to leave it open.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.