Date: 15 July 2026
For years, the uncomfortable truth sitting underneath the UK's financial system has been this: a handful of cloud providers quietly underpin almost everything. Your bank, your insurer, your payment processor. Scratch beneath the surface and you'll find the same two or three names running the infrastructure. When one of them stumbles, the tremor is felt everywhere.
The UK government has now decided that concentration of risk is too big to leave unsupervised. On 10 July 2026, HM Treasury announced its first-ever designations under the Critical Third Parties (CTP) regime, bringing four of the world's largest cloud and technology providers under the direct oversight of the UK's financial regulators. The designated firms, effective 13 July 2026, are:
- Amazon Web Services EMEA SARL
- Google Cloud EMEA Limited
- Microsoft Ireland Operations Limited
- Oracle Corporation UK Limited
From that date, the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) will jointly oversee the critical services these providers deliver to the financial sector. It's a landmark moment — and one that carries a clear message for every organisation, not just those inside the regulatory perimeter: your third-party dependencies are now a first-order risk, and regulators expect you to treat them that way.
What the Critical Third Parties Regime Actually Does
The CTP regime was established under the Financial Services and Markets Act 2023 and came into force in January 2025, giving UK regulators the power to directly oversee technology providers the financial sector simply cannot function without. Until now, that power existed in theory. This week, it was used for the first time.
Under the regime, the regulators can:
- Gather information directly from designated providers about the services they supply.
- Assess the resilience of those services and the arrangements sitting behind them.
- Make and enforce CTP-specific rules where necessary, addressing risks to the continuity of critical services.
Crucially, oversight applies only to the systemic services these firms provide to the financial sector, not to their wider commercial operations. HM Treasury has emphasised a risk-based, proportionate approach, with no statutory cap on how many providers may eventually be designated. In other words, this list of four is a starting point, not a ceiling.
It's also worth noting the regime is technology-neutral. Today it's cloud service providers; tomorrow it could just as easily capture AI platforms, market data providers, or other deeply embedded suppliers whose failure would ripple across the system.
Why This Matters Beyond the Financial Sector
The UK is not acting in isolation. In November 2025, EU regulators designated 19 technology providers as critical ICT third parties under the Digital Operational Resilience Act (DORA), a list that included the European arms of Google Cloud, AWS and Microsoft. The direction of travel across major economies is unmistakable: operational resilience and supply chain concentration risk are now regulatory priorities, not just best-practice aspirations.
There's a subtle but important distinction in the UK's approach, though. Whereas DORA places much of the burden on financial firms to map and manage their supplier risk, the UK regime puts significant onus on the critical suppliers themselves to identify and report on the risks within their own supply chains.
But here's the trap: regulatory oversight of your provider does not transfer your accountability. A designated CTP being supervised by the Bank of England does not mean your organisation is off the hook for understanding, documenting and stress-testing your reliance on that provider. If anything, it raises the bar. Regulators and boards will increasingly ask a pointed question, "You knew this dependency was systemic. What did you do about it?"
That question lands on organisations of every size, in every sector. Concentration risk in the cloud isn't a banking problem. It's an everyone problem.
The Real Lesson: Concentration Risk Is a Board-Level Issue
Strip away the regulatory language and this announcement is really about one thing: the fragility that comes from over-reliance on a small number of critical suppliers. Most organisations dramatically underestimate this exposure. They know they "use AWS" or "run on Microsoft," but they haven't mapped which business-critical processes would grind to a halt if that provider had a multi-hour outage, a security incident, or a contractual dispute.
They haven't identified the concentration points where a single failure cascades across multiple functions. And they've rarely rehearsed the decision-making required when the supplier — not the organisation — is the point of failure. This is precisely the gap that mature third-party risk management and virtual CISO leadership are designed to close.
How Cyber Management Alliance Can Help
At Cyber Management Alliance, we've spent years helping organisations move third-party and supply chain risk from a box-ticking exercise to a genuine resilience capability. The UK's Critical Third Parties designations make that work more urgent than ever and it's exactly where our vCISO and third-party risk assessment services deliver value.
Virtual CISO services
A designation like this is a boardroom conversation as much as a technical one, and most organisations don't have senior security leadership sitting in the room to translate it. Our vCISO service gives you that leadership on demand, someone who can:
- Assess how exposed your organisation is to concentration risk across your critical cloud and technology providers.
- Align your operational resilience posture with evolving expectations under regimes like CTP, DORA and NIS2.
- Translate regulatory and supplier risk into clear business impact for your board and executive team.
- Build a pragmatic, prioritised roadmap rather than a shelf-ware policy.
Third-party and supply chain risk assessments
You can't manage what you haven't mapped. Our structured third-party risk assessments help you:
- Identify and map your most critical suppliers and the business processes that depend on them.
- Surface concentration and single-point-of-failure risks before regulators or attackers do.
- Evaluate the resilience, security and continuity arrangements of your key providers.
- Establish ongoing due diligence and monitoring that stands up to scrutiny.
Cyber crisis tabletop exercises
Knowing your dependencies is one thing; being ready to act when one fails is another. Our scenario-based tabletop exercises, including DORA readiness and third-party/supply chain outage scenarios, put your leadership team through the exact decisions they'd face during a major provider disruption, so the first time you make those calls isn't during a live crisis.
Together, these services turn a regulatory headline into a practical resilience plan — one that protects your organisation whether or not you sit inside the financial perimeter.
The Bottom Line
The UK bringing Microsoft, Google, AWS and Oracle under direct regulatory oversight is a recognition of a reality the rest of us have been living with for years: modern organisations run on someone else's infrastructure, and that dependency is now a strategic risk to be governed, not an operational detail to be assumed. The designated providers will be held to higher resilience standards. But the responsibility to understand, document and rehearse your own reliance on them stays firmly with you.
If you're not confident you could answer the question "What happens to our business if one of these providers goes down?," now is the moment to find out. Talk to us at Cyber Management Alliance about a third-party risk assessment or vCISO engagement, and turn this regulatory wake-up call into genuine, tested resilience.
.webp)
