From next week, the Bank of England (BoE) and the Financial Conduct Authority (FCA) will assume direct oversight of four major technology firms providing cloud and tech services to UK banks. The move aims to bolster cyber-defences and prevent system failures that could threaten financial stability and harm consumers.
Critical Third Parties Named
The UK government has designated Amazon Web Services, Google Cloud, Oracle, and Microsoft as "critical third parties." These companies must prove they conduct adequate stress testing and report major incidents—such as cyber-attacks, power outages, or natural disasters—to the regulators. The BoE and FCA will ensure these firms are resilient and actively reducing cyber risks.
Risks of Reliance on a Few Firms
These technologies are integral to day-to-day banking, including data storage, fraud detection, and digital services. However, reliance on a small number of foreign firms creates vulnerabilities. In October 2023, a glitch at Amazon's cloud operations in Virginia disrupted services for over 2,000 companies, including Lloyds Banking Group, affecting UK customers.
IT Failures Cost Customers
According to the Treasury committee, customers at Britain's main banks and building societies suffered the equivalent of more than a month's worth of IT failures between 2023 and 2025. The government faced criticism for taking over 18 months to decide which companies to regulate, despite having theoretical powers since January 2025.
Industry and Political Reactions
The four tech firms publicly welcomed the announcement, supporting the government's objectives. However, Treasury committee chair Meg Hillier urged the government to go further: "To finally see movement on this after we have pressed for months... is a huge step forward. As the use of AI in financial services expands, I believe there may come a time when the government needs to consider designating specific AI firms under the Critical Third Parties Regime."
