UK regulators gain direct oversight of four hyperscale clouds

The UK financial regulatory framework is extending its reach beyond banks and insurers to include the cloud providers that underpin much of the sector’s infrastructure. Starting 13 July 2026, Amazon Web Services (AWS), Microsoft, Google Cloud, and Oracle will be classified as critical third parties, subject to direct oversight by UK financial regulators. This shift acknowledges the growing reliance of financial institutions on these hyperscale platforms and the systemic risks posed by potential outages or cyber incidents affecting their services.

What the new regime entails

Under the new rules, regulators will have the authority to conduct resilience testing, request detailed operational information, and enforce provider-specific safeguards. The oversight applies to all services these cloud providers offer to financial institutions across the UK. The move aims to address a regulatory gap where cloud providers, despite their integral role in banking operations, have not been subject to the same level of scrutiny as financial firms themselves. Previously, responsibility for managing cloud-related risks largely rested with the financial institutions using these services, rather than the providers.

Why the change matters

The decision to bring these cloud providers under direct financial-sector supervision reflects broader concerns about the concentration of critical infrastructure within a small number of hyperscale providers. Financial institutions in the UK, as in many other markets, have increasingly migrated core operations to cloud platforms, making the stability and security of these services a matter of national financial stability. Regulators are now positioned to intervene directly if they identify vulnerabilities or risks that could disrupt banking services, rather than relying on financial firms to manage these risks independently.

The move also aligns with a global trend of regulators scrutinising the role of cloud providers in critical sectors. Similar discussions are underway in the European Union and the United States, where financial regulators are exploring ways to mitigate risks associated with the outsourcing of essential services to a limited number of cloud providers. For the hyperscale providers, this means adapting to a new regulatory environment where their operations are subject to financial-sector standards, potentially influencing how they design and deliver services to financial clients.

What to watch

The immediate impact will be on the compliance and operational practices of AWS, Microsoft, Google Cloud, and Oracle in the UK. These providers will need to establish processes for responding to regulatory requests, conducting resilience tests, and implementing safeguards specific to financial-sector clients. Financial institutions, meanwhile, may see changes in how cloud services are structured or priced, as providers adjust to meet regulatory expectations.

Longer-term, the UK’s approach could serve as a model for other jurisdictions considering similar oversight. If the regime proves effective, it may accelerate efforts in other markets to bring cloud providers under direct financial-sector supervision. Conversely, if the regulatory burden leads to reduced competition or innovation, it could prompt a reassessment of how such oversight is structured. For now, the focus will be on how smoothly the new rules are implemented and whether they achieve their goal of enhancing the resilience of the UK’s financial infrastructure.