Google Cloud outage exposes new fault line in UK bank oversight

A single failed backup generator at a London data center on October 20 triggered a chain of outages that locked customers of some of Britain's largest banks out of their accounts for hours, and it has become the first real test of a new regime giving UK regulators direct power over the cloud companies that increasingly run the plumbing of the financial system.

The disruption originated in Google Cloud's europe-west2-b availability zone, one of three zones that make up the company's London region. According to Google's own incident report, a power grid disturbance hit the facility shortly after 7 a.m. British time. Backup generators should have taken over automatically, but both the primary and backup programmable logic controllers that trigger the transfer failed to start them. Battery backup units kept servers running for a time, then were depleted, and the zone's computing, networking and storage systems went dark. Google said a full root-cause analysis is still underway.

The outage lasted roughly six hours before most services were restored, with a small number of customers still affected afterward. In that window, Downdetector logged more than 1,500 reports of problems at Revolut alone, and Lloyds Banking Group, HSBC and Barclays all reported disruptions to online and mobile banking. Customers described being unable to check balances, move money or complete card payments. The outage also reached beyond banking, affecting Royal Mail, the property website Rightmove, and video links used for remote court hearings in England and Wales.

A regime built for exactly this moment

The timing was notable. Just over three months earlier, on July 10, Britain's Treasury designated Google Cloud, Amazon Web Services, Microsoft and Oracle as the first "critical third parties" under a regulatory framework that had existed on paper since January 2025 but had never been used. The designations, which took legal effect July 13, gave the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority joint power to set resilience and incident-reporting requirements directly on the cloud providers themselves, rather than relying solely on the banks that use them.

That authority had not been tested until last week. Dame Meg Hillier, who chairs Parliament's Treasury Select Committee, wrote the same day as the outage to Bank of England Governor Andrew Bailey and FCA chief executive Nikhil Rathi, asking how the two regulators intended to use their new powers in response. Her letter, published by the committee, poses a set of direct questions: when regulators learned of the problem, which banks were affected, how many customers experienced difficulties, whether any lost money, and specifically how the new oversight powers are being applied to this incident.

Hillier set a short clock. She asked for an initial response by November 4 and a fuller account within three months, and raised the question of compensation for customers who were unable to access their money.

Regulators say they are watching, not yet acting

The Financial Conduct Authority said it was aware of the incident and was working with Google and the affected firms, adding in a statement that "people need to be able to access their money and make payments, so we expect firms to fix issues quickly." The Bank of England, which oversees financial stability more broadly, said it was in contact with both the banks and Google as part of its supervisory role. Neither institution has yet said whether it will use its new critical-third-party enforcement powers to compel changes at Google, and both responses so far describe monitoring rather than formal action.

In Brussels, the European Banking Authority has said it is in contact with Google Cloud to establish the facts and assess the potential impact on EU financial institutions, under the bloc's own, broader Digital Operational Resilience Act framework for ICT third parties. No EBA enforcement step has been announced.

• The outage began around 7 a.m. BST on October 20 and was substantially resolved by roughly 1 p.m., per Google's incident timeline.
• Revolut, Lloyds, HSBC and Barclays all reported customer-facing disruptions; Royal Mail, Rightmove and UK court video hearings were also hit.
• Google's preliminary finding: a power failure combined with a backup-generator control failure at one London data center zone.
• The Treasury Committee has set a November 4 deadline for an initial response from the Bank of England and FCA.

Why one data center matters so much

The episode has sharpened a concern regulators and economists have flagged for several years: that a handful of cloud providers now sit underneath a large share of the financial system, so a localized hardware failure at one of their facilities can ripple across institutions that have no direct relationship with each other. The October 2026 UK incident follows a separate, larger Amazon Web Services outage in October 2025 that also disrupted numerous financial firms — the episode regulators cite as the direct impetus for designating cloud providers as critical third parties in the first place.

"People need to be able to access their money and make payments, so we expect firms to fix issues quickly," the Financial Conduct Authority said in a statement after the outage.

For the banks themselves, the incident is a reminder that outsourcing core infrastructure does not outsource the obligation to customers. Each of the banks affected is still individually responsible to UK regulators for operational resilience under rules that predate the critical-third-party regime, meaning Lloyds, HSBC and Barclays could face their own supervisory questions about contingency planning even as attention also turns to Google.

What happens next

Google has said it will publish a full post-incident report once its internal investigation concludes, including preventive measures, but has not given a date. The Treasury Committee's November 4 deadline will produce the first public accounting of how UK regulators used their year-old authority over a major cloud provider, and the fuller report due roughly three months after that is expected to address whether any customers suffered financial harm and whether compensation is warranted. Parliament has not said whether it will hold a hearing on the matter, but the committee's willingness to invoke its new powers within hours of the outage suggests cloud outages affecting banks will now draw a different, more direct regulatory response than they did before July's designations took effect.