The Bank of England, together with the Financial Conduct Authority (FCA), has been granted powers to directly regulate a small group of major technology firms that provide cloud and IT services to UK banks, taking effect from Monday. The move is aimed at ensuring these providers remain resilient against cyber-attacks and outages that could threaten financial stability and disrupt banking for millions of consumers and businesses. It matters because everyday banking now depends heavily on a handful of foreign tech firms, meaning a single failure abroad can cause widespread chaos across the UK.

The four companies designated as "critical third parties" are Amazon Web Services, Google Cloud, Oracle and Microsoft, whose technologies underpin data storage, fraud detection and digital banking. Under the new regime they must carry out stress testing and report major incidents, such as cyber-attacks and power outages, to regulators. The change follows disruptions including an October outage at Amazon's Northern Virginia operations that hit Lloyds and more than 2,000 companies, and Treasury committee figures showing UK banking customers endured over a month's worth of IT failures between 2023 and 2025. The government was criticised for taking more than 18 months to name the firms after gaining the powers in January 2025, though all four companies have welcomed the announcement, and Treasury committee chair Meg Hillier urged ministers to consider extending oversight to AI firms.