The Bank of England Now Oversees Your Cloud Provider
HM Treasury designated Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited as critical third parties, effective 13 July 2026 under the Financial Services and Markets Act 2023 regime. The Bank of England, PRA and FCA can now set requirements directly on the providers, including scenario testing, phased incident reporting to regulators and affected firms, self-assessments and skilled-person reviews. The piece explains the designation criteria, the obligations and their timeline, and the point the primary documents state plainly but commentary will miss, that regulated firms keep every outsourcing and operational resilience obligation they already had. It closes with practical steps for fintechs, insurers, payments firms and the MSPs serving them.