UK puts Microsoft, Google, Amazon, Oracle under new oversight: Here’s why

The UK has designated Microsoft, Google, Amazon and Oracle as critical third parties to the country's financial system, bringing the four cloud giants under direct regulatory oversight for the first time since the framework became law.

The designations, announced Friday, take effect July 13 and mark the first companies ever named under the UK's Critical Third Parties regime.

The government stated that an increasing dependence on cloud services by banks, insurers, and financial market infrastructure is such that an outage at any one of the big players could affect many organisations at once, with potential consequences for millions of individuals who depend on those services.

It was HM Treasury which had previously determined that more than 65% of UK organisations depended on the same four cloud service providers to deliver infrastructure services, leading to the establishment of the oversight regime under the Financial Services and Markets Act 2023.

The supervision will apply to specific UK companies, namely Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, and Oracle Corporation UK Limited, but only with regard to the systematic services they offer to the financial sector.

It is proposed that the Bank of England, together with the Prudential Regulation Authority and Financial Conduct Authority, supervise these institutions with the right to collect information, evaluate resilience, and develop and enforce specific rules for each individual critical third party.

All four companies issued supportive statements. Microsoft's Freddy Dezeure called the designation "a new chapter" in the company's decades-long relationship with UK government agencies, while Google Cloud said it expects the framework to build transparency and trust across the industry over time.