UK Regulators Question Google Over Cloud Outage That Disrupted Major Banks

UK lawmakers have ordered the Bank of England and the Financial Conduct Authority to detail how they will penalize Google Cloud, setting a November 4 deadline for an initial response. The demand follows a severe power outage in London that knocked millions of banking customers offline, testing new regulatory powers over tech giants.[2][3]

On October 20, a power failure in Google Cloud's "europe-west2" region disabled the mobile apps and payment systems of major financial institutions. Revolut, Lloyds Bank, HSBC, and Barclays all reported severe service disruptions. The outage began shortly after 7:00 a.m. UK time and persisted into the afternoon.[2][5]

The disruption froze card payments, transfers, and cash withdrawals for millions of retail customers. Revolut alone saw more than 1,500 users report problems simultaneously on outage-tracking platforms. Courts also lost access to their live-streaming video platforms, halting legal proceedings across the country, while delivery networks struggled to process logistics data.[5]

The incident triggers the UK's newly minted Critical Third Parties regime, which took effect in July 2026. The framework grants financial regulators direct oversight and enforcement authority over four major cloud providers: Google Cloud, Amazon Web Services, Microsoft, and Oracle.[2]

Treasury Committee Chair Meg Hillier initiated the regulatory action, publishing a formal letter to Bank of England Governor Andrew Bailey and FCA Chief Executive Nikhil Rathi. Hillier asked nine specific questions regarding how the watchdogs will deploy their new investigative powers.[2][3]

Testing the new oversight framework

“The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority (the authorities) all have a role in implementing the critical third party regime,” Hillier wrote. Her letter requires the regulators to outline their immediate response by November 4, with a comprehensive report due by January 20, 2027.[2]

The committee wants to know exactly how the authorities will hold Google accountable for the systemic disruption. The FCA confirmed it is already engaging directly with Google regarding the incident, seeking details on the scale of the disruption and any quantifiable financial harm caused to consumers.[1][2]

Under the new rules, designated technology providers are legally obligated to report serious outages to both the FCA and the central bank. A spokesperson for the Bank of England declined to comment on the ongoing investigation, but the central bank is reportedly in contact with affected firms.[1]

Google issued a public apology for the disruption, attributing the failure to a localized power event in one of its London zones. The company stated that its engineering teams were seeing the recovery of services for most workloads by early Tuesday afternoon.[5]

“We apologise to all who are affected by the disruption,” Google said in a statement. The company advised affected enterprise customers to “try to migrate their workload impacted to another available location (zone or region)” as a temporary workaround.[5]

The systemic risk of concentrated infrastructure

The workaround proved difficult for many domestic banks, as the London-based region is Google Cloud's only UK location. Without a secondary domestic region to fall back on, migrating workloads offshore could violate strict data sovereignty requirements for UK financial institutions.[2]

The disruption highlights the financial sector's heavy reliance on a handful of external technology providers. As banks accelerate their transition to cloud infrastructure and artificial intelligence, their operational resilience becomes entirely dependent on the physical stability of third-party server farms.[2]

Despite the new regulatory regime, UK rules dictate that financial institutions remain ultimately responsible for the services they provide to customers. Banks cannot simply blame their cloud providers for downtime; they are legally required to maintain robust continuity plans and map their dependencies.[1]

The regulatory scrutiny extends beyond Britain, aligning with the European Union's Digital Operational Resilience Act. In November 2025, EU regulators similarly designated 19 technology companies as critical computing providers upon which the bloc's entire finance industry depends. The European framework places strict reporting and auditing requirements on these providers.[4]

This is not an isolated event for cloud infrastructure. The financial sector has faced repeated disruptions, including a major AWS outage in October 2025 that knocked out Halifax and Lloyds alongside government websites. Before that, the global CrowdStrike software failure in July 2024 grounded flights and froze banking systems worldwide.[2]

Assessing the financial fallout

The inability to access funds disproportionately affected lower-income workers and the hospitality sector. Customers relying on weekly wages found themselves unable to make essential payments or withdraw cash during the prolonged downtime, triggering widespread complaints on social media.[4][5]

Financial watchdogs are currently assessing the total scale of the disruption and any quantifiable financial harm caused to consumers and businesses. The findings will likely inform the severity of any subsequent regulatory enforcement actions against Google Cloud.[1]

The Bank of England and the FCA must now demonstrate whether the Critical Third Parties regime has actual teeth. If the regulators impose significant penalties or mandate structural changes, it will set a global precedent for how governments manage cloud infrastructure risks.[2][3]

The November 4 deadline forces the regulators to show their hand quickly. Until then, the financial sector remains tethered to the same concentrated cloud architecture, waiting to see if the new oversight framework can actually compel better reliability from the tech giants.[2]

For now, the banking industry is watching closely to see how aggressively the FCA and the Bank of England will utilize their new authority. The outcome of this inquiry will likely dictate the future terms of engagement between global cloud providers and the financial institutions that rely on them.[1][2]