The UK government has designated major cloud computing providers Microsoft, Google, Amazon, and Oracle as critical third-party service providers to the country’s financial sector, subjecting them to direct regulatory oversight to strengthen the resilience of financial services.
The new designation is intended to reduce the risk of large-scale disruptions caused by cyberattacks, system failures, or technology outages that could impact banks, insurers, and other financial institutions that rely heavily on cloud infrastructure.
According to the government, the growing dependence of the financial industry on cloud services means that an outage at a major provider could simultaneously disrupt multiple organizations and affect essential services relied upon by businesses and consumers.
The designation, which takes effect on July 13, applies to Microsoft Ireland Operations Ltd, Google Cloud EMEA Ltd, Amazon Web Services EMEA SARL, and Oracle Corporation UK Ltd.
Under the new framework, the companies will be jointly supervised by the Bank of England, the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA). They will be required to participate in resilience testing, carry out regular self-assessments, and promptly report significant operational incidents to regulators.
The UK’s regulatory approach mirrors broader efforts to strengthen the stability of critical technology infrastructure supporting the financial system, although it differs from the European Union’s framework, which identified 19 technology and service providers under similar rules last November.
Google Cloud welcomed the move, saying the framework has the potential to improve the long-term resilience of the UK’s financial ecosystem if implemented effectively and supported by continued collaboration between regulators and industry participants.
