Summary
- On 21 October, the European Banking Authority confirmed that it had contacted Google Cloud about the outage's effects on EU financial institutions.
- Britain's Treasury Committee wrote to the Bank of England and FCA on 20 October, seeking information about their regulatory response.
- Google Cloud is designated for direct oversight under UK and EU frameworks, but no regulatory breach or enforcement finding has been announced.
The European Banking Authority has contacted Google Cloud following the disruption of financial services caused by a power event in the company’s London cloud infrastructure, as regulators examine the operational risks associated with critical technology suppliers.
The EBA confirmed its enquiries on 21 October, one day after the outage affected banks and other organisations using Google’s europe-west2 cloud region. The authority is seeking information to understand the incident and assess its possible impact on financial institutions operating in the European Union.
The European Banking Authority is one of the European supervisory authorities responsible for oversight arrangements established under the Digital Operational Resilience Act, known as DORA.
Its contact with Google represents an information gathering step. The authority has not announced that the company breached regulatory requirements, opened formal enforcement proceedings, or reached a conclusion about the adequacy of its resilience arrangements.
Google attributed the disruption to a power event at a third-party facility serving its London cloud region. Its public incident record describes the resulting problems across cloud services and their eventual restoration.
The outage disrupted digital services used by several banks, including Revolut, Lloyds, and HSBC. Reported problems included access to mobile applications, customer transactions, and other services dependent on affected computing infrastructure.
Individual organisations experienced different consequences, reflecting the particular applications and cloud services they used. A disruption originating in one supporting facility can affect customers across several countries when their systems depend on the same regional infrastructure.
Google has restored the affected services and indicated that a fuller technical analysis will follow. The public information available when regulators began their enquiries did not establish the precise equipment failure or complete sequence of events underlying the power disruption.
In Britain, parliamentary scrutiny began on 20 October. The House of Commons Treasury Committee published correspondence from its chair, Dame Meg Hillier, to the Governor of the Bank of England and the chief executive of the Financial Conduct Authority.
The committee requested information about the authorities’ use of their powers under the Critical Third Parties regime and the possible financial consequences of the cloud outage. The correspondence was sent on the day of the disruption, rather than constituting a separate enquiry first launched on 21 October.
Britain’s Critical Third Parties framework gives financial regulators direct oversight of certain technology suppliers whose disruption could threaten the stability of financial services.
In July 2026, the government designated Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, Microsoft Ireland Operations Limited, and Oracle Corporation UK Limited under the regime.
Those suppliers fall within the supervisory arrangements operated by the Bank of England, Prudential Regulation Authority, and FCA. The framework provides powers to assess resilience, obtain information, and investigate serious disruption affecting services considered critical.
Designation does not mean that every incident involving a supplier constitutes a regulatory breach. The authorities must consider the relevant services, applicable duties, circumstances, and evidence before determining whether further action is appropriate.
The EU’s DORA framework establishes a separate regulatory approach covering technology risk management, incident reporting, operational resilience testing, and the management of external technology dependencies within financial institutions.
In November 2025, the European supervisory authorities designated 19 critical information and communications technology providers for direct oversight, including Google Cloud EMEA Limited.
The EU regime involves the EBA, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority, with responsibilities spanning different parts of the financial services sector.
Although the British and EU systems are legally distinct, both respond to the concentration of essential financial services within a relatively small number of external technology platforms.
The arrangements also preserve responsibilities for the banks and other regulated organisations purchasing those services. Outsourcing computing infrastructure does not remove their obligations to maintain operational resilience, manage technology dependencies, and plan for service disruption.
A central technical question concerns how failures propagate through cloud infrastructure. Providers divide their systems across regions and availability zones, allowing customers to distribute applications and data between different facilities or locations.
That architecture can support resilience, but the benefit depends on how each application is designed. A service may still rely on a database, identity system, network component, or other dependency affected by an incident, even where some computing resources remain available elsewhere.
Recovery can require more than restarting an application on a different server. Data consistency, network routing, access controls, available computing capacity, and the dependencies of other services can determine how quickly operations resume.
Financial institutions must therefore understand not only which cloud provider hosts a service but also which locations and supporting systems the service depends on, together with the consequences of losing them.
The enquiries may examine those dependencies alongside incident communications, service restoration, contractual arrangements, and the effectiveness of continuity measures. Neither the EBA nor the British authorities have publicly established the scope of any completed investigation.
The latest regulatory development is distinct from the original outage. The technical incident occurred on 20 October and has already been reported, while the EBA’s subsequent contact with Google raises questions about oversight of the infrastructure supporting European financial services.
Further conclusions will depend on the detailed incident analysis and the information gathered by the authorities. At this stage, the confirmed development is regulatory scrutiny rather than a finding of non-compliance.
