UK names Microsoft, Google, Amazon, and Oracle as critical third parties: what the new cloud oversight regime means for financial stability

What new powers do the Bank of England, PRA, and FCA now hold?

The Financial Services and Markets Act 2023 inserted a new Chapter 3C into Part XVIII of FSMA 2000, granting the Bank of England, Prudential Regulation Authority (PRA), and Financial Conduct Authority (FCA)—collectively referred to as "the regulators"—a suite of new direct oversight powers over designated CTPs . These include:

• Rule-making power – Each regulator may impose duties on CTPs in connection with services they provide to financial firms, as necessary to advance its statutory objectives .
• Power of direction – A regulator may direct a CTP to do, or refrain from doing, anything specified. Where the direction addresses a threat to the stability or integrity of the UK financial system, the CTP and its officers and staff receive immunity from damages for compliant actions .
• Information gathering and skilled-person reviews – The regulators can require CTPs to provide information and commission reports by skilled persons .
• Enforcement and disciplinary measures – The regulators may impose penalties and take disciplinary action for breaches of CTP rules, including through a dedicated CTP enforcement statement of policy .

Can regulators prohibit a cloud provider from offering a service?

The FSMA 2023 does not include an explicit standalone power to "prohibit service provision" by name. However, the power of direction under section 312N of FSMA is broad enough to cover such an outcome: a regulator can direct a CTP to refrain from doing anything if it appears necessary or expedient for advancing that regulator's objectives, which could in practice include prohibiting the provision of a specific service that poses a systemic risk .

Resilience standards and testing requirements that apply from day one

The detailed requirements are set out in the regulators' joint Policy Statement PS16/24 and Supervisory Statement SS6/24, both published in November 2024 . Key requirements that apply from the designation date include:

• CTP Fundamental Rules – Six high-level, outcomes-focused rules covering governance, risk management, operational resilience, and cooperation with regulators, applying to all services the CTP provides to financial firms .
• Operational risk and resilience requirements – CTPs must identify, manage, and recover from disruption to their "systemic third party services." They must set a maximum tolerable level of disruption for each such service .
• Scenario testing – CTPs must conduct scenario testing to assess their ability to remain within their maximum tolerable levels of disruption under severe but plausible scenarios .
• Incident notification – CTPs must notify the regulators of material operational incidents affecting systemic third party services .
• Annual self-assessments – CTPs must provide annual self-assessments against the regulators' expectations, and they are subject to deep-dive and thematic reviews, including skilled-person reports .

Transitional period and what comes next

The first year after designation is a "mobilisation" phase focused on the regulators building an understanding of each CTP's operations and risk profile. Full compliance against all requirements will be phased in over time . An important caveat: the specific resilience standards and testing requirements were finalised before any CTPs were designated . The exact metrics, thresholds, and maximum tolerable levels of disruption will be determined through individual oversight engagement with each of the four providers during the first year .