N/A — Critical Third Parties (AWS, Google Cloud, Microsoft, Oracle)
London, United Kingdom
On July 13, 2026, HM Treasury activated the UK's new Critical Third Parties regime, designating Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, and Oracle Corporation UK Limited as Critical Third Parties to the financial sector. The Bank of England, PRA, and FCA now exercise direct oversight over these providers, with powers to gather information, assess resilience, and enforce CTP-specific rules. Designated CTPs must identify, monitor, and mitigate operational risks, maintain transparent real-time communication with regulators during disruptions, implement robust incident reporting, and ensure orderly contract termination and data recovery strategies. UK regulators have stressed that this regime does not replace existing third-party risk and outsourcing rules for regulated firms; banks and fintechs remain fully responsible for their own cloud architectures, due diligence, testing, and disaster recovery.
Verified from source: On July 13, 2026, HM Treasury announced new safeguards for major technology providers under the UK's Critical Third Parties regime, strengthening the UK financial system with direct oversight by the Bank of England, PRA, and FCA.
- Establishes precedent for direct regulatory oversight of technology providers serving the financial sector, which could influence similar frameworks globally
- Banks and fintechs using these cloud providers in the UK face heightened expectations around operational resilience documentation and disaster recovery planning
- BaaS platforms relying on designated cloud providers may need to reassess concentration risk and ensure compliance with both CTP regime expectations and existing outsourcing rules
- Could accelerate regulatory interest in similar frameworks in the U.S. and EU for critical technology dependencies in banking
- NewsBob's Guide
- OfficialWired-Gov
- NewsRegCanary