Four Technology Firms Formally Designated Structurally Unavoidable, Confirming What Every Procurement Team Already Knew

Four global technology providers have been formally designated Structurally Unavoidable Suppliers by the Ministry of Sensible Future Consultation, bringing them under the joint oversight of the Financial Clipboard Authority, the Prudential Clipboard Authority and the Nation's Official Interest-Rate Weather Service.

The designation follows a four-year assessment programme established to determine which suppliers the financial sector could not continue to function without. The programme concluded that the financial sector could not continue to function without the four largest suppliers of computing.

The finding was described in the accompanying policy statement as significant.

The scope of oversight

Oversight applies exclusively to the systemic services the designated firms provide to regulated institutions. It does not extend to their wider operations, their commercial terms, their pricing schedules, their contract renewal cycles, their outage notification thresholds, their capacity allocation practices, their support tier definitions, or their occasional decision to retire a service with eighteen months' notice delivered by changelog.

"We now have visibility," said a senior compliance professional at a mid-tier institution. "We are working through what to do with it."

The four designated entities — Vast Compute Holdings, Nimbus Continental, Perpetual Uptime Systems and the Rectangular Database Corporation — each issued statements welcoming the framework. Three of the four noted that they had been engaging constructively with supervisors for some time. The fourth noted that it looked forward to engaging constructively with supervisors at a future point.

The supervisory platform on which the new oversight regime will be administered is hosted by two of the four designated suppliers. The consultation portal used to collect industry responses on concentration risk was unavailable for six hours in March, during an incident at a third.

Resilience testing

Under the regime, regulated firms must demonstrate they can continue to deliver important business services in the event that a designated supplier becomes unavailable. Submissions received to date describe migration to an alternative provider as the primary mitigation.

In the majority of cases, the alternative provider is also designated.

"The point of the exercise is not to remove the dependency," said an industry observer. "The point is to have a folder about it."

A sentence-release officer from the Department of Optics confirmed that the designations form part of a rolling programme, and that further entities may be designated as the operational resilience landscape evolves. Asked which entities were under consideration, the officer indicated that the list was not being published, on the grounds that publication could create market sensitivity around firms whose systemic importance already appears in every architecture diagram produced since 2016.

Next steps

Designated suppliers now have twelve months to establish governance arrangements, submit self-assessments, and nominate a senior individual accountable for resilience within the designated services.

Two of the four have advised that the nominated individual will be appointed once the relevant reporting line has been agreed. Agreement requires a review. The review is scheduled to conclude ahead of the first self-assessment deadline, which will be confirmed in due course.