According to Financial Times News, City minister Lucy Rigby told MPs that big tech groups will start being supervised by UK financial regulators by next year. This comes after criticism that the Treasury has been too slow to use powers it’s had since January to designate cloud providers as “critical third parties.” The move follows last month’s Amazon Web Services outage that disrupted Lloyds Banking Group, London Stock Exchange Group, and HMRC services. Rigby confirmed that once designated, companies like Amazon, Google and Microsoft—who provide 73% of cloud services to UK financial firms—will face direct BoE and FCA oversight. Regulators will be able to impose conditions, require annual self-assessments, and conduct scenario testing for severe disruptions.
What Took So Long?
Here’s the thing: MPs were clearly frustrated. Liberal Democrat Bobby Dean basically called out the government for moving at a snail’s pace while tech giants are “waiting to be placed on this regime.” And he’s not wrong—when you’ve got Amazon’s recent outage causing real problems for banks and tax authorities, it’s hard to argue we’re being proactive.
The Treasury’s had these powers since January under the 2023 Financial Services and Markets Act. But James Fairburn from the Treasury admitted it’ll still take about six months to decide which companies to designate once regulators provide their list. So we’re looking at a pretty lengthy process even after yesterday’s announcement.
Why This Matters
Look, the concentration risk here is massive. That BoE and FCA survey showing Amazon, Google and Microsoft control 73% of cloud services to UK financial companies? That’s basically putting most of our financial infrastructure in three American tech baskets.
And it’s not just about cloud anymore. The regime covers AI model providers too, which is huge given how quickly financial services are adopting artificial intelligence. We’re talking about potential systemic risks that could make a cloud outage look minor by comparison.
<h2 id="what-happens-next“>What Happens Next
So now we wait. The regulators are “monitoring all operational instances very, very carefully” according to Rigby, and last month’s AWS outage “triggered the usual process” for monitoring financial stability risks. But monitoring isn’t the same as actual oversight with teeth.
I think we’ll see the first designations by mid-2025, and honestly, it can’t come soon enough. When a single data center failure in Virginia can knock out UK banking services, we’ve got a problem that needs more than just promises. The Treasury committee hearing made it clear MPs aren’t going to let this slide—they want action, not just assurances.
