Overview
- The Treasury announced on Friday, July 10, 2026, that Microsoft Ireland Operations Ltd, Google Cloud EMEA Ltd, Amazon Web Services EMEA SARL and Oracle Corporation UK Ltd are designated as critical third parties with supervision starting July 13, 2026.
- The Bank of England, the Financial Conduct Authority and the Prudential Regulation Authority will jointly supervise the four firms and can require resilience testing, regular self-assessments and direct reporting of major incidents.
- All four cloud providers have said they will engage with the framework and comply with applicable rules while continuing to service financial and crypto customers.
- Banks, insurers, fintechs and crypto firms should expect changes to contracts, new reporting obligations and higher fees as providers absorb and pass on compliance costs.
- The move builds on the Financial Services and Markets Act 2023 and the CTP regime active since January 2025, follows the EU's DORA designations in November 2025, and could shape other countries' rules and market concentration dynamics.