UK Could Regulate Tech Giants Under Financial Umbrella

Could tech giants like Google and Amazon fall under the purview of British financial regulators?

A trio of those regulators — The Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) — announced Thursday (Dec. 7) they are reviewing rules that would cover services provided by “critical third parties” (CTPs) to the financial sector.

These third parties include cloud providers, as well as information and communications technology firms.

“Financial market infrastructure firms are becoming increasingly dependent on third-party technology providers for services that could impact UK financial stability if they were to fail or be disrupted,” Bank of England Deputy Governor Sarah Breeden said in the statement.

Companies that offer services to the financial sector and whose sudden absence “could threaten the stability of, or confidence in, the UK financial system,” will come under the requirements, the statement said.

The regulators are proposing “fundamental rules” that would apply to all the services CTPs provide to the British financial sector, as well as more “granular operational risk and resilience requirements,” on things like cyber resilience, supply chain risk and incident management.

CTPs would also have to submit a yearly self-evaluation and conduct regular tests of their ability to keep serving clients “in severe but plausible disruption.”

This isn’t the first time U.K. regulators have made this argument. Last year, the British Treasury released a policy paper proposing a new regulatory framework that would give the Bank of England and the FCA new powers to oversee tech firms that provide critical services to the financial industry.

“The government is concerned about the growing dependence of banks on cloud computing, as these services are mostly provided by a handful of players,” PYMNTS wrote at the time. “As of 2020, over 65% of U.K. firms used the same four cloud providers for cloud infrastructure services, according to the Treasury statement.”

The government did not then — or now — identify any companies by name, though Amazon, Microsoft and Google account for a bulk of the world’s cloud computing market.

The regulators are taking feedback on their proposal until March 15 of next year. Based on that information, they plan to publish their final requirements and expectations for CTPs in the second half of 2024.