European financial regulators are seeking answers from Google after a cloud computing outage on October 20, 2026, disrupted banking services at Revolut, Lloyds and HSBC, raising questions about the resilience of technology infrastructure supporting millions of customers.
The European Banking Authority (EBA) has contacted Google Cloud to assess the incident and its potential impact on financial institutions in the European Union, according to Reuters reporting published October 21.
In Britain, Parliament's Treasury Committee has questioned how the Bank of England and Financial Conduct Authority (FCA) will respond. The disruption represents an early test of recently introduced European rules designed to strengthen oversight of critical technology suppliers. The inquiries do not, by themselves, establish any regulatory violation.
What Happened During the Google Cloud Outage?
The disruption began at 6:08 a.m. UTC (7:08 a.m. British Summer Time) on October 20, affecting Google's London cloud region, known as europe-west2.
According to Google Cloud's official incident record, a power event caused an outage within the europe-west2-b availability zone. Multiple cloud services became unavailable or experienced elevated errors and intermittent network failures.
Google subsequently said the disruption occurred at a third-party facility serving its London cloud region.
The incident record lists an end time of 2:00 p.m. UTC, approximately seven hours and 52 minutes after the initial disruption. Google reported that services had recovered for most affected cloud customers, although a very small number could still experience problems when it issued its final update.
Restoration of Google's infrastructure did not necessarily mean that every banking application and transaction service recovered at exactly the same time.
Google has said it will publish a more detailed analysis after completing its internal investigation. Its reported power-event explanation should therefore be distinguished from a comprehensive account of the underlying failure and recovery process.
Why European Regulators Are Questioning Google
The EBA told Reuters that it had contacted Google Cloud to obtain more information, understand the incident's implications and assess the potential effects on EU financial institutions.
The inquiry reflects concern that failures at a major shared technology supplier can disrupt several financial institutions simultaneously, rather than remaining confined to one bank's systems.
In the United Kingdom, Treasury Committee Chair Dame Meg Hillier wrote to the Governor of the Bank of England and the chief executive of the FCA seeking details of their response, the disruption's scale and any resulting financial harm.
The committee published its announcement on October 20, identifying the incident as relevant to Britain's critical-third-party regulatory framework.
Reuters also reported that the FCA was engaging with Google over the incident, while a Bank of England spokesperson declined to comment.
These steps amount to information-gathering and supervisory scrutiny. They should not be interpreted as confirmation that Google breached its obligations or that enforcement proceedings have begun.
How Europe's New Cloud Oversight Rules Apply
The outage comes as European authorities are expanding direct oversight of external technology companies whose services are critical to the financial sector.
In November 2025, the EU's three European Supervisory Authorities designated 19 critical information and communications technology providers under the Digital Operational Resilience Act (DORA).
The official designation announcement explains how the framework brings designated providers under coordinated European financial supervision. Google Cloud EMEA Limited is among those providers.
Britain operates a separate critical-third-party regime. In July 2026, the UK designated four major technology suppliers: Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Amazon Web Services EMEA SARL and Oracle Corporation UK Limited.
These frameworks recognize that banks increasingly depend on technology infrastructure outside their direct operational control. A cloud provider may support multiple institutions, creating the possibility that one infrastructure failure affects services across the financial system.
Regulators can examine critical providers' resilience arrangements and how serious disruptions are handled. Under the UK regime, designated providers also have incident-reporting responsibilities.
However, direct oversight of cloud companies does not remove banks' own accountability. Financial institutions remain responsible for managing operational risks and maintaining appropriate arrangements for delivering services to customers, including when essential technology is outsourced.
What the Disruption Means for Bank Customers
The October 20 incident affected everyday banking activities, including access to mobile applications, card payments, transfers and cash withdrawals. Revolut, Lloyds and HSBC were among the institutions reporting disruption, while Halifax customers also experienced problems.
Revolut, which has approximately 13 million customers in the UK, experienced interruptions across several services. That customer-base figure should not be confused with the number of people who actually encountered problems during the outage.
Revolut said its customers' funds and data remained safe throughout the incident. The company also said it was reviewing what happened to reduce the impact of future disruptions involving external suppliers.
An inability to access an account or complete a payment is not the same as evidence that customer deposits have disappeared or personal information has been compromised. Nevertheless, temporary service failures can create practical difficulties for people trying to pay bills, make purchases or obtain cash.
Independent reporting by Associated Press also documented banking-service interruptions and subsequent recovery efforts.
The precise number of affected customers, the aggregate value of delayed or unsuccessful transactions and any compensable financial losses have not been independently established.
What Happens Next for Google and the Banks?
The most immediate outstanding question is what Google's detailed investigation reveals about the power event, the effectiveness of infrastructure safeguards and the steps taken to restore services.
For regulators, the incident raises broader questions about whether banks and their technology suppliers have adequate arrangements to withstand disruptions that affect multiple institutions simultaneously.
Supervisory authorities may seek further information about incident management, resilience testing, reporting procedures and the extent to which financial institutions can maintain critical operations when a major external provider fails.
Those are potential areas of examination, not confirmed findings or announced enforcement measures.
Banks also face questions about their contingency arrangements and communication with customers during outages. The appropriate safeguards depend on the services involved and the operational risks each institution faces.
As of October 22, Google's public incident record indicates that the cloud disruption has ended, while its detailed technical analysis remains pending. The available reporting establishes regulatory inquiries but does not establish penalties, proven regulatory breaches or a comprehensive accounting of customer losses.
The broader significance extends beyond a single cloud failure: Europe's newer financial-technology oversight regimes must demonstrate how effectively they can address infrastructure disruptions that cross institutional and national boundaries.
0 Comments