UK Brings Large Tech Providers into Regulatory Perimeter as Critical Third Parties

Related Practices Introduction Financial regulators globally have become concerned about the increasing reliance of financial institutions and financial market infrastructure ("FMI") on a small number of third-party service providers, particularly in cloud and data services. In response, in 2023 the UK introduced a Critical Third Party ("CTP") regime, the policy objective of which is to mitigate the systemic risks that could arise if the disruption or failure of a major service provider were to affect the resilience of financial institutions or the wider UK financial system. Last week, HM Treasury ("HMT") designated, with effect from 13 July 2026, the following global cloud services and technology providers as CTPs: Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, and Oracle Corporation UK Limited. [1]