Bank of England gains power to regulate Amazon and Google cloud services from Monday
New rules mean the UK's central bank can directly oversee the tech companies that keep British banking running, cutting the risk of outages that could freeze millions of accounts.
Key points
- From Monday, the Bank of England and the Financial Conduct Authority gain direct oversight of major cloud providers to UK banks.
- Four large-scale cloud and tech firms, including Amazon and Google, fall under the new regime.
- Regulators can now require these firms to prove their systems are resilient and actively guarded against cyber-attacks.
- The rules aim to protect millions of UK consumers and businesses from outages that could freeze banking services.
British banking runs on cloud computing, the remote computer servers owned by technology giants that store data and run the software banks depend on. Until now, the Bank of England and the Financial Conduct Authority (FCA) could only police the banks themselves. They had no direct grip on the tech firms underneath.
That changes on Monday.
The Bank of England and the FCA will take on oversight of what the government calls "critical third parties": Amazon Web Services, Microsoft, Google Cloud and Oracle, whose systems are so deeply woven into British finance that a serious failure could ripple across the economy. The Guardian first reported the move.
If a cloud provider suffers a major outage, the bank using it could go down too. You might suddenly be unable to pay at a shop or complete a mortgage transfer. That's precisely what these new powers are designed to prevent.
Those same data centres are already under scrutiny for other reasons. As we reported on 13 July 2026, Microsoft, Amazon and Google collectively produced 119 million metric tonnes of carbon dioxide in a single year, largely to feed AI demand. The companies now face regulators scrutinising not just their emissions but the reliability of the services themselves.
What does this actually mean for bank customers?
For most people nothing changes overnight, and that's the point. The rules are designed to stop a crisis before it starts.
Under the new framework, regulators can demand that cloud providers meet specific standards for resilience, meaning their systems must stay up even under stress. They can also require firms to show they're actively reducing cyber-attack risk, the kind of targeted digital break-in that knocks services offline or steals data.
If a tech firm fails to meet those standards, regulators can now act directly, without going through the bank first.
The four named firms underpin not just banks but payment processors and other financial firms across the UK. Critics have long argued that concentrating so much of the financial system on a handful of private tech companies creates a single point of failure. One serious incident at one provider, and a large portion of UK banking could stall at once.
Regulators have been watching this risk grow for years. Monday's move is their formal answer.
What matters most here is something the headline doesn't quite capture: this isn't about punishing tech giants after a crisis, it's about making them accountable before one happens. Watch whether the FCA uses these new powers proactively or waits for the first outage to force the issue.
