According to Financial Times News, City minister Lucy Rigby told MPs that big tech groups will start being supervised by UK financial regulators by next year, responding to criticism about the Treasury’s slow pace in designating cloud services providers that serve British banks. Since January, the Treasury has had power to designate companies providing essential services as “critical third parties,” enabling direct Bank of England and Financial Conduct Authority oversight. Rigby confirmed that regulators would designate at least one company under these new rules within the next year, marking the first time the government has set a specific timeline. The regime allows regulators to impose conditions on service provision and public censure, with recent outages at Amazon’s cloud business disrupting Lloyds Banking Group, London Stock Exchange Group, and HMRC services. A Bank of England and FCA survey found that Amazon, Google, and Microsoft provide 73% of cloud computing services to UK financial companies.
Sponsored content — provided for informational and promotional purposes.
The Regulatory Lag Problem
Here’s the thing: we’ve known about this concentration risk for years. The fact that it’s taken until 2025 to even start designating these companies shows just how slow regulatory processes can be compared to technological reality. MPs like Liberal Democrat Bobby Dean weren’t shy about calling out the government’s sluggish response, noting that recent cloud failures “make us feel slow and not quick enough to respond to these developments in technology.” And he’s absolutely right.
Think about it – Amazon’s recent outage in northern Virginia wasn’t some theoretical risk. It actually cut off access to banking websites and government services. Yet Treasury deputy director James Fairburn says it will take about six months to decide which companies to designate even after regulators identify them. That’s six more months where the entire UK financial system remains vulnerable to single points of failure.
The Real Danger Nobody’s Talking About
Look, the 73% market share figure for Amazon, Google, and Microsoft is terrifying when you really think about it. We’re not just talking about convenience here – we’re talking about systemic risk. When three American companies control nearly three-quarters of the cloud infrastructure supporting British banks, what happens if there’s a geopolitical incident? Or if multiple outages hit simultaneously?
Basically, we’ve outsourced our financial system’s backbone to a handful of foreign tech giants without adequate oversight. The new powers under the 2023 Financial Services and Markets Act are a step in the right direction, allowing for annual self-assessments and scenario testing during severe disruptions. But why did it take until 2023 to even get these powers? The cloud dominance problem has been building for over a decade.
And let’s be honest – these companies aren’t exactly begging for more regulation. As parliamentary testimony revealed, they’re “waiting to be placed on this regime” while the government drags its feet. The imbalance between how quickly technology evolves and how slowly regulation responds creates dangerous gaps where everyone assumes someone else is watching the store.
What Actually Changes Now?
So what does “designation” actually mean in practice? According to the minister, it means financial regulators can “impose conditions on the provision of services and indeed public censure.” That sounds good, but is it enough? We’re talking about companies whose cloud outages can literally freeze financial transactions across multiple institutions simultaneously.
The Bank of England and FCA’s own research on AI in financial services shows this concentration risk extends beyond cloud into emerging technologies too. We’re building tomorrow’s financial infrastructure on today’s concentrated foundations.
I suspect the real test will come when regulators actually try to impose meaningful conditions on these tech giants. Will they push back? Will they threaten to raise prices? Or will they treat this as cost of doing business in the financial sector? The next year will tell us whether this is genuine oversight or just regulatory theater.
