Overview
- HM Treasury formally named Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK as critical third parties under the new regime, effective 13 July.
- The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority have joint oversight and can gather information, run resilience tests and require tailored rules for the designated providers.
- Designated firms must carry out regular resilience tests, submit self‑assessments and report major incidents quickly to regulators and to the financial firms that depend on them.
- Regulated banks, insurers and market operators remain responsible for managing their outsourcing relationships, including due diligence and contingency plans, while regulators will periodically reassess the designations.
- The move targets concentration risk from a small number of cloud suppliers and could prompt further designations or tighter rules if regulators find gaps that threaten the continuity of services used by millions of customers.