As of today, July 13, 2026, Microsoft, Google, Amazon, and Oracle are officially under the same kind of regulatory watch the UK normally reserves for banks themselves, not the cloud servers sitting underneath them.
The UK Treasury finalized the designation last week, formally naming all four companies “Critical Third Parties,” a status that puts their cloud operations under direct oversight from the Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority starting today. From this point forward, Microsoft Ireland, Amazon Web Services EMEA, Google Cloud EMEA, and Oracle UK all face stress-testing requirements, mandatory resilience standards, and scrutiny of their disaster recovery plans.
The logic behind the move is fairly simple once you sit with it. Nearly every major bank, insurer, and payment network in the UK now runs on one of a handful of American cloud platforms. That concentration means a serious outage at just one provider could freeze transactions and payroll systems across the country almost instantly, a risk regulators had been treating as theoretical until cloud outages elsewhere made it feel a lot less abstract.
“We are a world-leading financial centre and maintaining trust in our financial system is essential to its success,” said Rachel Blake, Economic Secretary to the Treasury, adding that the goal is keeping the services financial firms depend on resilient enough to protect both consumers and the wider economy.
Microsoft, for its part, signaled it isn’t fighting the new rules. Freddy Dezeure, the company’s deputy chief information security officer for Europe, pointed to Microsoft’s decades-long relationship with UK government agencies as evidence the company is used to this kind of coordination.
What makes today worth watching beyond the UK is the precedent it sets. Countries whose financial systems depend just as heavily on the same cloud providers, but whose regulators currently have no authority to inspect that infrastructure directly, now have a working model to point to. As of today, the UK has drawn a legal line connecting cloud reliability to national financial stability, and other regulators are almost certainly taking notes.
