On October 20 a power failure at Google Cloud’s London europe-west2-b zone disrupted Revolut, Lloyds, HSBC and HM Courts remote hearings for hours. The FCA and Bank of England engaged Google under the UK Critical Third Parties regime; Parliament’s Treasury Committee asked both regulators how they will use those powers even though banks remain legally responsible for customer services.
A power event at a third-party facility serving Google Cloud’s europe-west2-b zone in London on 20 October cascaded into hours of elevated errors across UK banking and public services. Revolut, Lloyds and HSBC customers reported login, card and payment failures; HM Courts and Tribunals Service said remote hearings on its cloud video platform were affected. Google restored services by late afternoon and promised a public post-incident analysis. The longer consequence is supervisory: regulators already designated Google Cloud a critical third party, and Parliament wants to know how the Bank of England and Financial Conduct Authority will use that toolkit.
What failed, and for how long
Google attributed the disruption to a power failure confined to one London zone, not a global control-plane collapse. Reuters reported several hours of impairment across Europe-facing workloads; the Guardian placed partial recovery around 1 p.m. London time and broader restoration by about 3 p.m. Revolut, with roughly 13 million UK customers, listed login, card payments and cash withdrawals among affected functions and said funds and data remained safe. Lloyds and HSBC acknowledged user-facing issues without immediate detail on duration.
The outage also reached civilian infrastructure outside retail finance — court video hearings stalled, illustrating how a single zone fault can cross sector boundaries when government agencies buy the same hyperscale stack as banks.
The accountability chain
UK rules place ultimate responsibility on banks for services delivered to customers, including when a third-party cloud fails. That principle does not leave hyperscalers outside supervision. In July, the Treasury designated Google Cloud EMEA Limited alongside Microsoft, AWS and Oracle under the Critical Third Parties regime. Designated firms must report serious disruptions to the FCA and Bank of England; supervisors can demand resilience evidence and remediation plans.
The FCA told Reuters it was engaging with Google. The European Banking Authority said it contacted Google Cloud to understand implications for EU financial entities — parallel to Britain’s post-Brexit framework, which Reuters described as the outage’s first major test of cloud resilience rules on both sides of the Channel.
Treasury Committee chair Dame Meg Hillier wrote to the BoE governor and FCA chief executive on the day of the outage, asking how regulators will deploy powers tied to the incident. The committee had already recommended designating AI and cloud providers critical to finance; the letter turns October 20 from an availability event into a governance hearing about whether designation bites in practice.
What supervisors will want next
Expect three lines of inquiry.
Incident reporting and root cause — whether Google’s disclosure met CTP timelines and whether the power event exposes single-zone dependencies banks certified as tolerable.
Concentration mapping — how many regulated firms shared the same region and whether operational resilience statements described that exposure accurately.
Remediation versus information — whether the BoE and FCA request contractual changes, multi-region mandates, or merely incident briefings.
None of that requires Google to become a bank. It does require a hyperscaler that is not prudentially regulated like a deposit taker to accept financial-sector continuity obligations — the same structural theme Culled traced when platform liability stacked onto household balance sheets and when the PRA examined how banks classify risky exposures.
Cloud concentration warnings are years old. October 20 supplied a dated example: a London power fault became a payments and court-access problem, and supervisors who spent 2026 designating vendors now have a live file to open. The outage is resolved; the oversight chapter is not.
Continue reading
Sources
BBC, Guardian, and Reuters reporting on the October 20 outage; UK Parliament Treasury Committee correspondence; European Banking Authority contact with Google; prior Culled platform-liability coverage.
