AWS designated as a critical third party to the UK financial sector
July 10, 2026 · AWS Security · Severity: CRITICAL
Amazon Web Services EMEA Sarl (AWS) has been designated as a critical third party (CTP) to the UK financial sector by HM Treasury, effective January 1, 2025. This designation places AWS under the oversight of UK regulators, including the Bank of England, Prudential Regulation Authority (PRA), and Financial Conduct Authority (FCA). The CTP regime establishes a framework for setting requirements on designated CTPs to ensure the resilience of the UK financial system. AWS will now conduct a self-assessment of its Systemic Third-Party Services (STPS) against the regime’s criteria, aligning with regulatory timelines. The company has actively engaged with UK authorities during the development of the regime and will continue to meet its obligations. The CTP regime does not alter the accountability of financial services firms, their boards, or senior management for operational resilience, even when relying on third-party services like AWS. Financial services customers of designated CTPs retain their existing obligations. AWS plans to publish materials to assist customers in operational resilience planning and third-party risk management. The company remains committed to supporting financial services customers through resources such as the AWS Well-Architected Framework and cloud incident management guidance. AWS also offers regulatory and technology expertise to help customers navigate the regime and broader operational resilience challenges. Customers can contact their AWS account teams for further information.
Amazon Web Services EMEA Sarl (AWS) has been designated as a critical third party (CTP) to the UK financial sector by HM Treasury.
The CTP regime came into force on January 1, 2025, and establishes a framework through which the Bank of England, PRA, and FCA (collectively the UK regulators) can set requirements on and have direct oversight of designated CTPs.
AWS supports the objectives of the UK regulators to ensure a robust financial system.
AWS obligations under the regime
The CTP regime is an outcomes-focused framework. Under the regime, AWS will be subject to requirements in relation to its designated Systemic Third-Party Services (STPS). The first step will be a self-assessment of these STPSs against the CTP regime criteria, which AWS will now carry out in line with regulators’ expected timelines.
AWS has actively engaged with the UK authorities as they’ve developed the CTP regime, and we will continue this constructive approach as we work to meet our obligations under it.
Impact on customers
The UK regulators have clarified that the requirements under the regime don’t eliminate, reduce, or replace the accountability of firms, their boards, and senior management for remaining operationally resilient, including when they rely on services provided by third parties.
The regime doesn’t change obligations on financial services customers of designated CTPs. As we manage our obligations, we expect to publish materials that customers can use to inform their own operational resilience planning and third-party risk management.
The AWS commitment to operational resilience
We’re focused on supporting financial services customers in enhancing their operational resilience and providing a range of services and guidance—including the AWS Well-Architected Framework and resources for cloud incident management—to help organizations deliver effective resilience outcomes.
AWS has a team of regulatory and technology experts with expertise in financial services ready to support customers with questions about this regime or operational resilience more broadly. Customers can contact their AWS account team for further information.
Key Takeaways
- AWS EMEA Sarl was designated a critical third party to the UK financial sector.
- The designation places AWS under oversight of UK financial regulators.
- The CTP regime came into force in January 2025.