Law & Regulation

Four US Clouds Now Report to a UK Regulator

From 13 July 2026 the Bank of England, PRA and FCA directly oversee the resilience of AWS, Microsoft Azure, Google Cloud and Oracle. The liability for an outage still sits with the firm, not the regulator.

Law & RegulationBy Servola Tech Desk2026-07-164 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Four US Clouds Now Report to a UK Regulator

Key takeaways

As of 13 July 2026 the Bank of England, the PRA and the FCA directly oversee the operational resilience of AWS, Microsoft Azure, Google Cloud and Oracle, yet the legal responsibility for a cloud outage still sits with the firm that chose the cloud, not with the regulator or the vendor.
HM Treasury made the designation under the Financial Services and Markets Act 2023, the first time UK regulators have gained direct oversight of technology suppliers rather than only the banks that use them.
The regulators can now demand resilience testing against severe-but-plausible scenarios, require self-assessments and receive reports of major incidents, but designation is oversight of the service, not authorisation of the provider.
A firm running in both the UK and the EU now answers to two parallel regimes, because the EU DORA rules put the same concentration and exit questions to critical cloud suppliers on the continent.

What Britain designated on 13 July

The change is quiet on the surface and large underneath. On 4 July 2026 HM Treasury formally designated four cloud providers as Critical Third Parties to the UK financial system, announced it on 10 July, and the oversight took effect on Monday 13 July. The named entities are Amazon Web Services EMEA SARL, Microsoft Ireland Operations Limited, Google Cloud EMEA Limited and Oracle Corporation UK Limited.

The power is new, the concern is not. Regulators have worried for years that a handful of providers now sit beneath most of the financial system, but until the Financial Services and Markets Act 2023 they could supervise only the banks, insurers and payment firms, never the suppliers those firms depend on. The Act created the Critical Third Party regime precisely to reach the supplier directly.

From Monday the three regulators can act jointly. The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority can now gather information from the four providers, assess their operational resilience, require them to test against severe-but-plausible scenarios, demand regular self-assessments, and receive reports of any major incident that could ripple across UK finance.

Supervising your vendor is not taking your risk

The most important sentence in the announcement is the one that transfers nothing. Designation is not authorisation. The regulators are overseeing the resilience of the services these providers sell, not certifying the providers and not assuming the risk. If your workload goes dark because a region fails, the accountability still lands on your firm, which chose the provider, the architecture and the recovery plan.

Sarah Breeden, the Bank's Deputy Governor for Financial Stability, framed the reason plainly. As critical third parties become more deeply embedded in financial institutions, she noted, they can introduce new forms of systemic risk. The regime is an attempt to see that risk at its source, not to move it off any single firm's books.

That distinction is where owners misread the news. A designation headline reads like relief, as though someone larger now owns the problem. It is the opposite. The bar for your own third-party risk management, your exit planning and your concentration mapping just rose, because there is now a supervised standard your own regulator can measure you against.

Concentration just became an official category

The deeper signal is what the state has now written down. By naming four US-headquartered providers as systemically critical, the UK has formally recorded that its financial plumbing runs on a very small number of foreign suppliers. That is no longer a slide in a risk committee; it is a designation with legal force behind it.

The same logic is already live across the Channel. The EU Digital Operational Resilience Act, known as DORA, created a near-identical oversight regime for critical ICT third parties, run by the European Supervisory Authorities. A firm operating on both sides now faces two regulators asking the same two questions: how concentrated are you, and can you leave.

Sovereign and multi-cloud arguments stop being theoretical here. The case for keeping a tested path off a single hyperscaler used to rest on principle and procurement leverage. It now also rests on a resilience standard a regulator can inspect, which turns the internal conversation from preference into compliance.

What to settle before the regulator asks

Treat the designation as a deadline you set yourself. Map which of your critical workloads sit on which of the four providers, write down the concentration honestly, and rehearse the exit rather than assuming it. A recovery plan that has never been tested against a severe-but-plausible failure is a document, not a capability, and that is precisely the gap a supervisor is trained to find.

The firms that look calm in an audit are the ones that already know their answer. They can name their single points of failure, show a tested route off each one, and prove the board discussed the concentration before a regulator raised it. The designation did not create that work; it made the absence of it visible.

Frequently asked questions

Does the designation mean the regulator now guarantees these clouds will not fail?

No. The Bank of England, PRA and FCA oversee the resilience of the services, but they do not guarantee uptime and they do not take on the risk. If a failure disrupts your business, the accountability remains with your firm.

Which exact entities were designated?

Amazon Web Services EMEA SARL, Microsoft Ireland Operations Limited, Google Cloud EMEA Limited and Oracle Corporation UK Limited, under the Financial Services and Markets Act 2023, with oversight effective 13 July 2026.

Does this affect firms outside the UK?

Indirectly, yes. The EU runs a parallel regime under DORA for critical ICT third parties, so a business operating in both the UK and the EU should expect the same concentration and exit questions from regulators on both sides.

The state has now put its name to a fact owners already knew: the financial system runs on a few foreign clouds, and acknowledging that is no longer optional. The firms that treat it as a standard to meet, rather than a headline to file, will be the ones still standing calmly when a region goes dark.

CloudBank of EnglandFCAPRACritical Third PartiesFSMA 2023AWSMicrosoft AzureGoogle CloudOracleDORAOperational Resilience

An AI Just Ran a Whole Ransomware Attack Alone

Sysdig documented JADEPUFFER, what it calls the first ransomware campaign an AI agent ran end to end with no human in the loop. It broke in, adapted past a failed login in 31 seconds, encrypted a production database and threw the key away.

3 min read

Digital Sovereignty

Europe Gets S3 Storage That Skips US Clouds

On June 30 2026 Scality and OVHcloud launched a joint S3-compatible object-storage platform that keeps regulated data on European hardware, giving DORA and NIS2 teams a like-for-like alternative to AWS.