On 10 July 2026, HM Treasury made the first designations under the UK critical third parties regime. With effect from 13 July, Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited are now subject to direct oversight by the Bank of England, the PRA and the FCA in respect of the services they provide to the UK financial sector.
The regime has been on the statute book since the Financial Services and Markets Act 2023, and the regulators' rules have applied since 1 January 2025. The designations are the point at which it becomes real. They are a welcome recognition that the concentration of the financial system on a small number of cloud providers is a systemic risk.
What the designations do and do not do
Designated providers must meet the regulators' fundamental rules and operational risk and resilience requirements, take part in testing, and communicate openly with regulators and the firms that rely on them, particularly during a major incident. The regulators can now gather information from and take action against those providers directly.
What the designations do not do is transfer any responsibility from regulated firms. HM Treasury was explicit that designation implies no judgement about the quality, security or reliability of a provider's services, and that firms' own responsibilities are unchanged. A bank that cannot deliver an important business service because its cloud provider has failed is still a bank that has breached its impact tolerance.
The risk of false comfort
There is a real risk that boards and senior management read "regulated by the Bank of England" as a reason to place more reliance on a provider. That would be the wrong conclusion. Oversight of the provider is aimed at systemic resilience, not at any individual firm's arrangements. The regulators will not be negotiating your contract, testing your exit plan or checking that your configuration of a cloud service is secure.
Firms still need to meet the requirements of SYSC 8 and the PRA's supervisory statement on outsourcing and third-party risk management, the operational resilience rules that came into full effect in March 2025, and, for firms connected to the EU, DORA. New rules on operational incident and third-party reporting are also due to apply from 18 March 2027, which will require firms to maintain more structured information about their material third-party arrangements.
Questions boards should be asking
- Which of our important business services depend on a designated provider, directly or through our other suppliers?
- Have we mapped fourth-party dependencies, for example software vendors whose products run on the same cloud platforms?
- Would our exit and stressed exit plans actually work within our impact tolerances, and when were they last tested?
- Is our concentration on a single provider, or a single region of that provider, a deliberate decision with a documented rationale?
- Are we ready for the incident and third-party reporting rules that apply from March 2027?
What internal audit should do
The designations are a good trigger for a portfolio-level review of third-party risk. That means testing the completeness of the register of material arrangements, the quality of the dependency mapping behind important business services, and the credibility of exit plans for the most concentrated arrangements. Many firms will find that their oversight of cloud providers relies heavily on assurance reports and certifications. Those have value, but they should be complemented by the firm's own monitoring of how the service performs and how it is configured.
Getting specialist support
We provide independent assurance over third-party risk frameworks, critical outsourcer oversight, concentration risk and exit planning, aligned to FCA, PRA and DORA requirements. If the designations have prompted questions about your own arrangements, we are happy to talk it through.
