UK Regulators to Begin Overseeing Systemically Important Vendors

The Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority stated they will begin to oversee "critical third parties" serving the UK financial system.

A "critical third party" is a technology or service company relied on by so many financial firms that the company's failure could disrupt the UK financial system.

The Treasury named four global cloud providers as the critical third parties: Amazon Web Services, Google Cloud, Microsoft, and Oracle. The regulators require that the four providers identify and manage risks to the critical services they supply to UK financial firms and that the providers communicate openly and promptly with regulators and client firms, especially during a major outage or incident.

The new regulatory oversight does not replace existing rules for banks and other firms and regulated firms remain responsible for their own vendor due diligence, third-party risk management, and contingency plans.

Oversight begins Monday, July 13, 2026.