Sources: UK financial regulators plan an investigation into AWS, Microsoft, and Google, citing concerns over UK banks' reliance on cloud services
Context & Ripple Effects
This FT report lands between two tracks of UK scrutiny of the hyperscalers. On the competition side, the watchdog had already been preparing a formal Amazon probe over data use in mid-2021 (mirroring the EU investigation), and Ofcom would later find AWS, Azure, and Google may be limiting competition in UK cloud before referring the case to the CMA (the Ofcom referral).
What this story adds is the prudential angle: financial regulators treating banks' dependence on three US providers as a supervisory issue in its own right. That thread matured when the FCA, PRA, and Bank of England issued a joint consultation paper on overseeing banks' cloud providers, making this early signal the seed of a now-formal regulatory workstream.
First-order effects
- AWS, Microsoft, and Google face a new front of UK scrutiny aimed specifically at their banking customers' concentration risk, separate from the competition probes already underway.
- UK banks come under pressure to demonstrate they can exit or fail over from their primary cloud provider, turning resilience planning into a regulatory deliverable.
Second-order effects
- The big three must weigh concessions on portability and interoperability for regulated clients, since the same conduct is being examined by both the CMA (via Ofcom's referral) and the financial regulators.
- Multi-cloud architectures and third-party resilience tooling gain a compliance-driven buyer base among UK banks, shifting spend toward vendors who can evidence exit capability.
Third-order effects
- If the pattern holds, hyperscalers get treated as critical third parties to the financial system — supervised infrastructure rather than ordinary suppliers — a template other jurisdictions can copy.
- The EU's parallel move to consider new restrictions on AWS, Azure, and Google under the DMA after major outages (the Commission's deliberations) points toward converging transatlantic rules on cloud concentration.
The trend: Financial regulators are converting cloud concentration from a procurement choice into a systemic-risk question, with supervision of the providers themselves following.