Britain’s banks run on four American clouds. The Treasury reckons two-thirds of UK firms lean on the same handful. Now the regulators are stepping in.
The UK has named Microsoft, Google, Amazon and Oracle as “critical third parties” to its financial system, as Reuters first reported. The designation takes effect on 13 July. These are the first companies ever named under the regime.
The status pulls the four cloud giants under direct financial oversight for the first time. It applies to four legal entities: Microsoft Ireland Operations, Google Cloud EMEA, Amazon Web Services EMEA and Oracle Corporation UK. It covers only the systemic services they sell into finance.
The trigger is concentration. HM Treasury found that more than 65% of UK organisations rely on the same four providers for their infrastructure. An outage at any one of them, the government warned, could hit many firms at once, with consequences for millions of people.
What ‘critical’ actually means
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
The label is not an accusation. It is a supervisory status, created by the Financial Services and Markets Act 2023 so regulators can watch suppliers that much of the sector leans on together.
Oversight falls to the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. They can put each provider through resilience testing, require regular self-assessments and order the firms to report major incidents. None of the four is a bank.
The gap it closes is an old one. A regulator can lean on a bank it licenses, but not on the outside supplier that bank runs on. When that supplier serves two-thirds of the market, the risk has sat just out of reach.
One outage, many victims
The fear is a single point of failure. If one big provider goes dark, the damage does not stop at one firm. It spreads across every bank, insurer and payment system wired into the same servers. We put a number on that exposure earlier, and it runs into the billions.
The concern is not hypothetical. Cloud outages have already knocked out banking apps, card payments and trading tools for hours at a time. One big AWS failure last year pushed UK lawmakers to ask why the oversight was taking so long.
The companies aren’t fighting it
The providers are not resisting. Google Cloud said the framework, done well, “can enhance the long-term resilience of the UK’s financial ecosystem and increase understanding, transparency, and trust between all parties.” That tone is telling. For firms keen to sell deeper into regulated finance, being certified critical infrastructure is a label worth having, not a burden to fight.
Europe got there first
Brussels moved earlier. In November 2025, EU supervisors named 19 technology firms, among them Amazon Web Services, Google Cloud and Microsoft, as critical providers to European finance under the Digital Operational Resilience Act. Oracle did not make that list. The UK’s designation follows the same instinct, and it adds Oracle to the group.
Why it matters
Britain has been circling Big Tech from several directions. Its competition regulator moved to loosen Apple and Google’s hold on app payments. Scotland has weighed a freeze on new datacentres even as the country courts AI money. Amazon already plants its engineers inside customers’ offices, and Oracle is fielding questions over a headline cloud contract.
The deeper signal is about power. Regulators spent a decade worrying that banks were too big to fail. The worry now is that the companies banks rent their computers from have grown too central to ignore. From 13 July, the UK is treating them that way.
Get the TNW newsletter
Get the most important tech news in your inbox each week.