UK regulators to oversee Microsoft, Google, Amazon, Oracle cloud services

Britain has placed major cloud service providers, including Microsoft, Google, Amazon, and Oracle, under direct regulatory oversight, designating them as 'critical third parties.' This regulatory action, effective July 13, is a proactive measure to safeguard the United Kingdom's financial system.

The government stated that as financial institutions like banks, insurers, and market infrastructures increasingly depend on cloud services, a disruption at a major supplier could simultaneously affect multiple firms, potentially impacting essential customer services. The designated entities include Microsoft, Google, Amazon, and Oracle.

From July 13, the Bank of England and the Financial Conduct Authority (FCA) will be responsible for ensuring these providers are resilient and actively reducing the risk of cyber-attacks and major outages. Companies will be required to conduct adequate stress testing and report any significant incidents such as cyber-attacks or power outages to the regulators. This move comes amid concerns that system failures could threaten financial stability and harm consumers, with glitches in cloud services having previously caused widespread disruption to UK banking customers.

The UK government faced criticism for the extended period it took to implement these regulations, with theoretical powers granted over 18 months prior. However, all four designated companies publicly welcomed the announcement, expressing support for the government's objectives to enhance the resilience of the UK's financial sector.

Treasury committee chair Meg Hillier noted the progress but suggested further consideration for regulating AI firms under a similar regime as AI use in financial services expands.