UK and European financial authorities are seeking information after a power-related Google Cloud disruption in London interrupted access to banking functions including app logins, card payments and cash withdrawals. The October 20 incident was restored within hours, but the regulatory follow-up has made it more than a routine cloud-service outage: it has become an early practical test of rules aimed at technology suppliers whose failures can affect many financial firms at once.
Google said a power event at a third-party facility caused the disruption in its London-based europe-west2 region, which serves customers across Europe. Revolut told customers that some logins, card transactions and ATM withdrawals were affected, while saying funds and data remained safe. Reports also identified problems or reported effects at organisations including Lloyds, HSBC, Royal Mail and NHS England, though the available accounts do not establish identical failures or a common customer impact at every organisation.
Regulators seek the scale and consequences
The Reuters report carried by Yahoo Finance said the European Banking Authority had contacted Google Cloud for information about the outage and its possible implications for financial entities in the EU. In Britain, the Financial Conduct Authority said it was engaging with Google and affected firms to understand what happened and how customers were affected.
The response has a third layer. Reuters reported that Parliament’s Treasury Committee wrote to the Bank of England and the FCA seeking detail on the regulators’ actions, the disruption’s scale and any potential financial harm. That is not an assertion that consumer losses or data compromise occurred. It is a request for the information needed to establish whether harm occurred and how far the incident spread.
There is a reason officials are treating a single provider’s operational problem as a financial-sector question. Banks increasingly obtain computing, data storage and other digital services from a relatively small group of large cloud companies. A shared supplier can therefore create an exposure that does not resemble the old model of one bank suffering its own isolated systems failure. Customers may see separate brands and separate apps, but some of the infrastructure beneath them can be shared.
The UK has a framework for oversight of critical third-party suppliers to the financial system. Reuters reported that designated providers, including Google Cloud, are required to report serious outages to the FCA and Bank of England. At EU level, the EBA’s request signals the concern regulators have about whether disruption at a technology provider could impair regulated firms’ operations across borders. The present inquiries are fact-finding, not a published finding that Google breached any requirement.
What the outage did — and did not — establish
Reporting from Technology Magazine placed the initial disruption shortly after 7 a.m. UK time in europe-west2-b, an availability zone in the London cloud region. Google attributed the event to a power problem at a third-party facility. The same account said full availability had returned by midday; Google said services were restored after several hours.
That sequence narrows the known cause more than many high-profile outages do. There is no basis in the reports to describe the event as a cyberattack, nor as a data breach. Revolut’s statement that customer funds and information were safe is particularly relevant because the visible symptoms involved payment access and cash withdrawals, functions that can quickly make an infrastructure incident feel like a banking failure to a customer.
The headline figure needs similar care. Reuters described millions of bank customers as being unable to use key services for hours. Revolut has roughly 13 million UK customers, but that number is the company’s customer base, not a measured count of people affected by this outage. Neither the company statements summarized in the reporting nor the regulator comments provide a verified total for affected users, failed payments, failed cash withdrawals or financial losses.
Nor should reports of a named company’s difficulties be read as proof that every service it operates depended on the same disrupted component. The Reuters account carried by Insurance Journal noted that outage-monitoring data is based on user reports and that actual impact can vary. In an incident involving several organisations, that distinction is practical: an unavailable mobile login, a delayed payment, a customer-service problem and a complete back-end service outage are different events, even when they occur on the same morning.
A resilience test beyond a single cloud zone
The incident nevertheless shows why regulators are focused on concentration rather than simply on the duration of an individual outage. Cloud providers divide systems into regions and smaller availability zones partly to support resilience, but financial firms must decide which services can tolerate a zone-level failure and which need a different design, a different region or another way to continue operating. Those choices are technical, contractual and operational; they cannot be answered by a provider’s public status page alone.
Industry and academic specialists cited by Technology Magazine argued that organisations should reassess resilience planning and their dependence on common cloud infrastructure. That is an expert view rather than an official verdict on the October incident. The regulatory inquiries could eventually reveal whether individual firms’ contingency arrangements worked as intended, whether notifications were prompt and whether supervision needs to change. None of those conclusions has yet been published.
For consumers, the episode is a reminder that a card, cash machine or banking app can depend on infrastructure far outside the bank’s own data centres. For supervisors, it presents the harder question: how to assess a supplier whose disruption can simultaneously reach payment access, retail banking and public services, while the precise number of affected customers remains unknown.
