The Critical Third Parties (Designation) Regulations 2026

Designated Amazon Web Services, Google Cloud, Microsoft, and Oracle as critical third parties to the UK financial system.


The Critical Third Parties (Designation) Regulations 2026 designates four specific technology service providers as 'critical third parties' under the Financial Services and Markets Act 2000.

It applies to Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, and Oracle Corporation UK Limited.

By designating these entities, the Treasury subjects them to a regulatory framework intended to manage risks to the stability of the UK financial system stemming from the services they provide to financial institutions.

Arguments For

  • The Treasury states that a failure in, or disruption to, the services provided by these entities could threaten the stability of, or confidence in, the UK financial system.

  • The document asserts that the Treasury complied with statutory requirements by consulting the Financial Conduct Authority, the Prudential Regulation Authority, and the Bank of England.

  • The Treasury notes that it provided written notice to the designated entities and allowed a reasonable period for those persons to make representations.

  • Proponents may argue that identifying these specific service providers allows for more robust oversight of systemic risks in the financial sector's supply chain.

Arguments Against

  • Legal scholars may question the criteria used to determine whether a disruption to these specific entities constitutes a threat to financial stability compared to other non-designated providers.

  • Affected parties might argue that the designation imposes an unequal regulatory burden on these four specific entities relative to their competitors.

  • Critics may point out that the Treasury did not produce a full impact assessment, claiming no significant impact is foreseen, which may be contested by agencies facing new compliance or oversight costs.

  • There may be concerns regarding the cross-border legal complexities since several designated entities (e.g., those based in Ireland or Luxembourg) are managed outside the UK's immediate jurisdiction while serving the UK financial system.

  1. —(1) These Regulations may be cited as the Critical Third Parties (Designation) Regulations 2026. (2) These Regulations come into force on 13th July 2026. (3) These Regulations extend to England and Wales, Scotland and Northern Ireland.
  1. Each of the following persons is designated as a critical third party with effect from the dates as detailed— (a) Amazon Web Services EMEA SARL from 13th July 2026; (b) Google Cloud EMEA Limited from 13th July 2026; (c) Microsoft Ireland Operations Limited from 13th July 2026; (d) Oracle Corporation UK Limited from 13 July 2026.

Related

The Air Navigation (Restriction of Flying) (Trawsfynydd) Regulations 2026

Tue 18th Aug 26

Restricted flight operations below 3,000 feet in the Trawsfynydd area for a specific nine-hour period on 18 August 2026.

Read More

The Air Navigation (Restriction of Flying) (Billing, Northampton) (Emergency) Regulations 2026

Tue 18th Aug 26

Established an emergency no-fly zone for drones below 1,300 feet in Billing, Northampton, effective August 18, 2026.

Read More

The Air Navigation (Restriction of Flying) (Dowlais, South Wales) (Emergency) (No. 2) Regulations 2026

Mon 17th Aug 26

Established an emergency restricted airspace zone for unmanned aircraft near Dowlais, South Wales, effective 15 August 2026.

Read More

The Air Navigation (Restriction of Flying) (Llantrisant, South Wales) (Emergency) Regulations 2026

Mon 17th Aug 26

Established an immediate no-fly zone for drones below 1,500 feet in a 0.54 nautical mile radius around Llantrisant due to an emergency.

Read More