UK to Directly Oversee Cloud Service Providers as Critical Third Parties for Financial Sector

HM Treasury has designated the cloud units of Microsoft, Google, Amazon, and Oracle as critical third parties for Britain’s financial sector, effective July 13, 2026. Designation is not authorisation; it puts these providers under the joint oversight of the Bank of England, the Prudential Regulation Authority, and the Financial Conduct Authority, and that oversight runs to the resilience of the critical services they supply to UK finance.

The firms must now identify and manage risks to those critical services and keep open, timely communication with the regulators and the institutions that rely on them, particularly during major incidents. The UK government framed the move as a response to concentration risk: disruption at a major cloud supplier could affect multiple banks, insurers, and financial market infrastructures at the same time. The existing outsourcing and operational resilience rules stay where they are, so a regulated firm still carries its own third-party due diligence.

Comparable oversight already runs in the European Union under its Digital Operational Resilience Act, and the two sets of regulators have signed a memorandum of understanding to coordinate on providers that fall under both. The UK version still previews what U.S. vendor due diligence may be asked to cover. The same dependency on a small number of cloud providers exists in the United States, and many insurers use the same hyperscalers for core systems, data platforms, and AI workloads. The UK requirements suggest that resilience testing, regulatory reporting, and business continuity plans should be extended beyond the AI model itself to the cloud layer underneath it.

Insurer vendor oversight programs now have to carry cloud resilience as a documented part of third-party due diligence. Questions to answer include whether the cloud provider can demonstrate independent resilience testing, whether contractual audit rights cover the cloud layer, and whether business continuity plans account for a failure at a shared infrastructure provider.

This development also has a direct link to AI governance. Many insurers are deploying AI models on cloud infrastructure, and the Bank’s deputy governor for financial stability, Sarah Breeden, has said that as critical third parties become increasingly embedded in the operations of financial institutions, they can introduce new forms of systemic risk. The UK rule does not replace model-level governance, but it adds a layer of infrastructure governance that U.S. carriers may need to mirror proactively.

The assessment framework built for exactly this kind of third-party exposure is in AI vendor risk assessment for insurers.