From next week, the Bank of England (BoE) and the Financial Conduct Authority (FCA) will gain direct oversight of four major technology firms providing cloud and IT services to the UK financial sector: Amazon Web Services, Google Cloud, Oracle, and Microsoft. The move aims to bolster resilience against cyber-attacks and system failures that could disrupt banking services for millions of consumers and businesses.
Scope of new regulatory powers
The UK government designated these firms as “critical third parties” on Friday, granting the BoE and FCA authority to enforce stringent requirements. The companies must conduct regular stress tests simulating emergency scenarios, such as cyber-attacks, power outages, or natural disasters, and report any major incidents promptly to the regulators.
These tech giants have become integral to banking operations, handling data storage, fraud detection, and digital banking platforms. However, increasing reliance on cloud services has introduced systemic risks, as demonstrated by a glitch at Amazon’s Northern Virginia data centre in October 2023, which disrupted services for over 2,000 companies, including Lloyds Banking Group.
Impact of IT failures on UK banking
According to the Treasury committee, Britain’s main banks and building societies experienced the equivalent of more than a month of IT failures between 2023 and 2025. The government faced criticism for taking over 18 months to finalise the list of regulated firms, despite granting regulators theoretical powers in January 2025. Labour ministers, keen to attract US tech investment, had reportedly debated the sensitive issue.
All four companies publicly welcomed the announcement, issuing statements supporting the government’s resilience objectives. Treasury committee chair Meg Hillier urged the government to consider extending oversight to AI firms: “To finally see movement on this after we have pressed for months, including in our recent AI report, is a huge step forward. As the use of AI in financial services expands, I believe there may come a time when the government needs to consider designating specific AI firms under the critical third parties regime.”
Broader implications for financial stability
The new regulations aim to safeguard the UK economy by ensuring that tech providers maintain robust cyber-defences and operational continuity. The BoE and FCA will monitor compliance closely, with the power to impose penalties for failures. This marks a significant expansion of financial regulatory oversight into the technology sector.
