UK Extends Direct Oversight to Microsoft and Other US Cloud Providers

UK financial regulators have designated Microsoft, Google, Amazon and Oracle as critical third parties, placing their cloud units under Bank of England and FCA supervision effective July 13. The move responds to heavy reliance by UK banks and market infrastructure on a handful of US providers, which together hold 73% of named cloud services. Regulators can now require annual self-assessments, disclosures and scenario testing to mitigate outage risks, following disruptions such as last year’s AWS incident that affected Lloyds, LSE and HMRC. The regime, available since January 2025, adds compliance pressure but stops short of restricting cloud usage.