UK designates Microsoft, Google, Amazon, Oracle as critical to finance

Britain on Friday designated Microsoft ↗ 6.68%, Google Alphabet Inc. ↗ 3.25%, Amazon Amazon.com, Inc. ↗ 6.12%, and Oracle ↘ 1.95% as "critical third parties" to the country's financial system, placing four of the world's largest cloud computing providers under direct regulatory oversight for the first time.

The designation, announced by HM Treasury, takes effect on Monday, July 13, and grants the Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority new powers to oversee how these companies support banks, insurers, and financial market infrastructures.reuters+2

Concentration Risk Drives Action

The move addresses growing concern among regulators that the UK's financial sector has become heavily dependent on a small number of technology providers. According to The Next Web, the Treasury found that two-thirds of financial firms rely on the services of these cloud providers. The specific entities designated include Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL and Amazon Web Services UK Limited, and Oracle Cloud entities.mondovisione+1

Under the Financial Services and Markets Act 2023, HM Treasury gained the authority to designate third-party providers whose disruption or failure could affect large numbers of consumers and firms and threaten the stability of the UK financial system. The regulators can now set minimum resilience standards, gather information, conduct resilience testing, and take enforcement action — including the power to prohibit a critical third party from providing services to financial firms as a last resort.gov+2

What Oversight Means in Practice

The Bank of England said the regulations are designed to strengthen the financial system by reducing the risks of cyberattacks and technology outages. The regime does not impose additional requirements on financial firms themselves, which remain responsible for managing their own third-party risks. Instead, it targets the cloud providers directly, requiring them to meet operational resilience standards for any services deemed systemic to the financial sector.bankofengland+1

The designations mark the culmination of a regulatory process that began with a 2022 policy statement, was codified in the 2023 legislation, and saw final oversight rules published jointly by the three regulators in November 2024. The rules took legal effect from January 2025, but could only apply to specific companies once HM Treasury issued formal designation orders.regulationtomorrow+2

The UK becomes one of the first major jurisdictions to bring cloud providers under direct financial regulation, a step that could influence similar efforts internationally.