If you're a bank or insurance company in Europe and your systems go down because your cloud provider had a bad day, regulators now want a say in preventing that scenario. On Tuesday, the European Union made it official: the biggest names in cloud computing are now subject to direct oversight when it comes to serving the financial sector.
Nineteen Companies Get the "Critical" Label
Under the Digital Operational Resilience Act, EU regulators designated 19 technology firms as "critical" third-party service providers, according to Reuters. The headline names? Amazon.com, Inc.'s (AMZN) Web Services, Alphabet Inc.'s (GOOG) (GOOGL) Google Cloud, and Microsoft Corp (MSFT).
The logic is straightforward enough: when half the financial sector relies on the same handful of cloud providers, an outage at one of those providers becomes everyone's problem. EU authorities want to make sure these companies have their house in order before something breaks at an inconvenient moment.
The designation hands three EU financial watchdogs the authority to directly supervise these tech giants. The European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority will now scrutinize whether these firms maintain robust cybersecurity defenses, effective risk management protocols, and proper governance frameworks.
Tech Giants Signal Cooperation
The response from the companies has been diplomatically positive. Google Cloud welcomed the regulatory clarity, while Microsoft said it remains committed to meeting Europe's cybersecurity and resilience standards. AWS indicated it had prepared for this new oversight role and plans to work closely with regulators going forward.
IBM (IBM) chimed in as well, noting that it's continually strengthening its defenses and looks forward to engaging with EU authorities.
A spokesperson for the London Stock Exchange Group said the organization welcomes the designation, suggesting that at least some financial institutions see this as a net positive for sector stability.
The stakes are real. A significant service disruption at any of these providers could ripple through banks, insurers, asset managers and trading platforms across the bloc. By bringing these tech companies under direct regulatory supervision, EU authorities are essentially acknowledging that cloud infrastructure has become as systemically important to finance as the banks themselves.