UK puts Microsoft, Google Cloud, AWS, and Oracle under bank-grade resilience rules
The Bank of England, PRA, and FCA designated the four cloud providers 'critical third parties' to UK finance as of July 13 2026, requiring them to meet operational-resilience standards, sit for regulator-run exercises, and face disciplinary action. It is the first time hyperscalers fall under direct financial-sector supervision, and a template other regulators worried about cloud concentration can copy.
Source: harro.com ↗
An outage or cyberattack at a major supplier could simultaneously disrupt many financial firms and their customers, rather than being limited to a single company, as with a traditional IT failure.
UK regulators (Bank of England, PRA, FCA)
Why this matters
- → Cloud outage at one provider now risks simultaneous disruption across UK financial system.
- → First direct regulator supervision of hyperscalers; template for other jurisdictions facing concentration risk
- → Banks remain liable; new rules force cloud firms to meet resilience standards or face penalties.
Cloud concentration gets teeth