UK regulators now oversee four cloud firms. Such lists rarely grew in three months.

What happened

HM Treasury designated Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited as the first Critical Third Parties, and the Bank of England, the PRA and the FCA began jointly overseeing them on Monday 13 July 2026.

HM Treasury says UK finance depends on these four technology suppliers, so three regulators now watch them directly: the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. They use powers added to the Financial Services and Markets Act 2000.

The regulators do not license the four firms. They can make rules for them, ask them for information and act against them only for the services they supply to banks and other regulated firms.

The Treasury calls the four a first group. Its press notice describes a rolling system in which more providers may be named over time, if that is needed to protect the UK. The Bank’s notice says the list will keep changing as more names are considered. In both, the Treasury decides, usually on the regulators’ advice. Neither names a date or a candidate for a second group.

Adding a name is a change in the law, which makes it easy to check. Each new firm needs a further statutory instrument, a type of law made by ministers, that changes the Critical Third Parties (Designation) Regulations 2026. The regulators’ rules apply to a firm only after the Treasury has named it.

The last UK case moved slowly. Vocalink, the last technology supplier put under direct Bank supervision, was named in April 2018 and faced its first enforcement action only in 2025.

Sources: Bank of England (2, 3), GOV.UK

The Pattern

We looked for first lists of this kind: a national or EU authority used a new legal power to name specific financial firms as critical to the system and to supervise them directly. We checked whether at least one more firm was added to the list within 90 days of the start. We found seven first lists since 2012, and only one grew in that time.

The Read

History points to the list staying at four. Six of the seven first lists went 90 days without a new name. The one that grew was the US Financial Stability Oversight Council in 2013, which added Prudential Financial from a queue of companies it had already put on formal notice a year earlier. In the UK, a new name needs a new law made by ministers, and the Treasury has named no candidate.

The doubt comes from the Treasury’s own words. It and the Bank both called this a rolling system whose scope will change, and the regulators can recommend more names at any time. Cloud is also not the only service UK finance depends on heavily. The prediction fails if a second instrument is laid quickly, most likely for a payments or market-data provider the regulators have already assessed.

The second market, a new document from the regulators, is an easier test, but the record there is slow too. The Bank’s existing rules and guidance for these firms came out in November 2024, 20 months before anyone was named.