The UK’s direct oversight regime for systemically important technology providers began on 13 July with four cloud businesses designated by HM Treasury: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.[1][3]
The Bank of England, Prudential Regulation Authority and Financial Conduct Authority now jointly oversee the resilience of the critical services these providers supply to UK financial firms and market infrastructures. The regime targets concentration and contagion risk that no single customer firm can manage alone.[1][2]
Designation covers the resilience of systemic services supplied to UK financial firms and market infrastructures. It is distinct from FCA or PRA financial-services authorisation and does not extend to every commercial activity of a provider. HM Treasury decides designation and de-designation; the three regulators oversee the services within that perimeter.[1][2]
Accountability connects the provider to each regulated service
Responsibility under the regime
| Party | Primary responsibility |
|---|---|
| HM Treasury | Designate or de-designate critical third parties.Source 1Source 2 |
| Bank, PRA and FCA | Jointly oversee systemic-service resilience, gather information and assess controls.Source 1Source 2 |
| Designated provider | Manage risks, support assurance and testing, communicate major incidents.Source 1 |
| Financial firm or FMI | Perform due diligence, map dependencies, set impact tolerances and maintain contingency arrangements.Source 1Source 2 |
The system-wide problem is a shared dependency: disruption at one provider can reach many otherwise separate firms at the same time. Direct oversight gives regulators information and assurance at that common source, while provider incident communications help firms coordinate their response.[1]
A broker still needs to trace its own customer services through the provider’s applications, regions, identities, data stores and recovery processes. That mapping connects an outage to open orders, access to accounts and customer communications, and identifies which workarounds or failover arrangements can keep the service within its impact tolerance.[2][1]
Contract diversification, tested exit plans and technical failover address different parts of that dependency. Their value depends on the broker’s actual architecture and operating procedures, so the oversight programme complements the firm’s due diligence, contingency planning and responsibility for customer outcomes.[1][2]
Cross-border coordination and testing are already part of the programme
UK regulators signed a memorandum with the European Supervisory Authorities to coordinate information and incident oversight where the same provider falls under the UK regime and the EU Digital Operational Resilience Act. The arrangement aims to reduce duplication without merging the two legal regimes.[4]
In October, the Bank-chaired cross-market group ran SIMEX26 around a global cloud-services disruption with 38 of the largest banks and market infrastructures. That exercise tests coordinated response to a shared failure scenario. Its value for individual firms lies in connecting sector coordination to their own incident decisions, recovery arrangements and customer communications.[5][1]
Sources & further reading
- UK financial regulators to begin overseeing critical third parties Bank of England · 10 Jul 2026 · Accessed 16 Oct 2026
- Critical Third Parties: strengthening UK financial services Financial Conduct Authority · 10 Jul 2026 · Accessed 16 Oct 2026
- UK regulators begin overseeing Treasury-designated critical third parties Financial Conduct Authority · 10 Jul 2026 · Accessed 16 Oct 2026
- UK and EU regulators sign MoU on critical-third-party oversight Financial Conduct Authority · 14 Jan 2026 · Accessed 16 Oct 2026
- SIMEX26 cloud-outage simulation exercise Bank of England · 9 Oct 2026 · Accessed 16 Oct 2026