--- title: UK names Microsoft, Google, Amazon, Oracle 'critical' description: The UK has designated Microsoft, Google, Amazon, and Oracle as 'critical third parties' to its financial system, effective 13 July. The designation — the first... canonical: https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: UK names Microsoft, Google, Amazon, Oracle 'critical' | daily.dev og:description: The UK has designated Microsoft, Google, Amazon, and Oracle as 'critical third parties' to its financial system, effective 13 July. The designation — the first... og:url: https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm og:image: https://api.daily.dev/og/posts/COPdMkVTM.png og:image:alt: UK names Microsoft, Google, Amazon, Oracle 'critical' og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # UK names Microsoft, Google, Amazon, Oracle 'critical' **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 2 upvotes · 0 comments ## Summary The UK has designated Microsoft, Google, Amazon, and Oracle as 'critical third parties' to its financial system, effective 13 July. The designation — the first under the Financial Services and Markets Act 2023 — brings the four cloud giants under direct oversight by the Bank of England, the PRA, and the FCA. The trigger is concentration risk: over 65% of UK organisations rely on the same four providers, meaning a single outage could cascade across banks, insurers, and payment systems. Regulators can now require resilience testing, self-assessments, and incident reporting. The EU made a similar move under DORA in November 2025, naming 19 tech firms. None of the four companies is resisting the designation; Google Cloud framed it as beneficial for long-term trust in regulated finance. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the UK's new 'critical third party' designation mean for Microsoft, Google, Amazon and Oracle? It places Microsoft Ireland Operations, Google Cloud EMEA, Amazon Web Services EMEA, and Oracle Corporation UK under direct financial oversight for the first time, effective 13 July. The Bank of England, Prudential Regulation Authority, and Financial Conduct Authority gain power to run resilience testing, require self-assessments, and mandate major incident reporting, covering only the systemic services these firms sell into finance. _Teams building on regulated cloud infrastructure follow oversight shifts like this via daily.dev._ ### Why did UK regulators decide to designate cloud providers as critical to the financial system? HM Treasury found that more than 65% of UK organizations rely on the same four cloud providers for infrastructure, creating concentration risk where a single outage could disrupt many financial firms simultaneously. The Financial Services and Markets Act 2023 created this supervisory status specifically to let regulators watch suppliers the sector leans on collectively, since regulators previously could only oversee licensed banks, not their outside cloud suppliers. _Architects weighing multi-cloud strategies track concentration risk stories like this on daily.dev._ ### How does the UK's cloud oversight designation compare to the EU's Digital Operational Resilience Act rules? The EU acted first, naming 19 technology firms including AWS, Google Cloud, and Microsoft as critical providers to European finance under the Digital Operational Resilience Act in November 2025, but Oracle was not included on that list. The UK's July designation follows the same approach and adds Oracle alongside the other three, making it the first jurisdiction to include all four providers together. _Engineers navigating cross-border compliance differences follow regulatory comparisons like this on daily.dev._ ## Similar posts on daily.dev - [Contributing to U.K. financial sector resilience as a critical third party](https://daily.dev/posts/contributing-to-u-k-financial-sector-resilience-as-a-critical-third-party-p45y8500c) · Google Cloud · 0 upvotes · 0 comments - [Britain's US cloud habit is now a billion-pound risk](https://daily.dev/posts/britain-s-us-cloud-habit-is-now-a-billion-pound-risk-s5eiyldig) · The Next Web · 0 upvotes · 0 comments - [UK urged to cut out US Big Tech for sake of digi sovereignty](https://daily.dev/posts/uk-urged-to-cut-out-us-big-tech-for-sake-of-digi-sovereignty-l37cxivd1) · The Register · 1 upvotes · 0 comments - [Supporting customers as a critical provider under EU DORA](https://daily.dev/posts/supporting-customers-as-a-critical-provider-under-eu-dora-e480kslin) · Google Cloud · 0 upvotes · 0 comments - [Europe wants to end its dangerous reliance on US internet technology](https://daily.dev/posts/europe-wants-to-end-its-dangerous-reliance-on-us-internet-technology-bxej5byjw) · Hacker News · 25 upvotes · 1 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#aws](https://daily.dev/tags/aws), [#azure](https://daily.dev/tags/azure), [#gcp](https://daily.dev/tags/gcp), [#regulation](https://daily.dev/tags/regulation) [View this post on daily.dev](https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"UK names Microsoft, Google, Amazon, Oracle 'critical'","url":"https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm"},"datePublished":"2026-07-10T12:58:21.766Z","dateModified":"2026-09-14T06:36:16.730Z","description":"The UK has designated Microsoft, Google, Amazon, and Oracle as 'critical third parties' to its financial system, effective 13 July. The designation — the first...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/782a62209a1333e45784f15c3d323203?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/782a62209a1333e45784f15c3d323203?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,aws,azure,gcp,regulation","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"UK names Microsoft, Google, Amazon, Oracle 'critical'"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/uk-names-microsoft-google-amazon-oracle-critical--copdmkvtm#faq","mainEntity":[{"@type":"Question","name":"What does the UK's new 'critical third party' designation mean for Microsoft, Google, Amazon and Oracle?","acceptedAnswer":{"@type":"Answer","text":"It places Microsoft Ireland Operations, Google Cloud EMEA, Amazon Web Services EMEA, and Oracle Corporation UK under direct financial oversight for the first time, effective 13 July. The Bank of England, Prudential Regulation Authority, and Financial Conduct Authority gain power to run resilience testing, require self-assessments, and mandate major incident reporting, covering only the systemic services these firms sell into finance. Teams building on regulated cloud infrastructure follow oversight shifts like this via daily.dev."}},{"@type":"Question","name":"Why did UK regulators decide to designate cloud providers as critical to the financial system?","acceptedAnswer":{"@type":"Answer","text":"HM Treasury found that more than 65% of UK organizations rely on the same four cloud providers for infrastructure, creating concentration risk where a single outage could disrupt many financial firms simultaneously. The Financial Services and Markets Act 2023 created this supervisory status specifically to let regulators watch suppliers the sector leans on collectively, since regulators previously could only oversee licensed banks, not their outside cloud suppliers. Architects weighing multi-cloud strategies track concentration risk stories like this on daily.dev."}},{"@type":"Question","name":"How does the UK's cloud oversight designation compare to the EU's Digital Operational Resilience Act rules?","acceptedAnswer":{"@type":"Answer","text":"The EU acted first, naming 19 technology firms including AWS, Google Cloud, and Microsoft as critical providers to European finance under the Digital Operational Resilience Act in November 2025, but Oracle was not included on that list. The UK's July designation follows the same approach and adds Oracle alongside the other three, making it the first jurisdiction to include all four providers together. Engineers navigating cross-border compliance differences follow regulatory comparisons like this on daily.dev."}}]} ```