European regulators question Google over cloud outage lasting 7 hours and 52 minutes
Key Facts
The European Banking Authority contacted Google Cloud seeking information about a cloud outage the company recorded as lasting 7 hours and 52 minutes on 19 October 2026, as regulators monitored its repercussions for the financial sector. The authority is seeking to understand the circumstances of the incident and assess its potential impact on financial institutions in the European Union, according to Reuters. Britain's Financial Conduct Authority also said it was in contact with Google about the incident. The outage affected several cloud services, and Google attributed it in its technical notice to a power incident within an availability zone in its London region. During the disruption, the company suggested moving affected workloads to another available zone or region where possible.
Banks reporting disruptions included Lloyds, Halifax, HSBC and Revolut, according to the Associated Press. Revolut has about 13 million customers in the United Kingdom, according to Reuters, and was among the institutions whose banking services were affected during the incident. Affected services at the bank included logins, card payments and cash withdrawals, extending from account access to the use of funds for payments and withdrawals. During the disruption, Revolut said that "all our customers' money and data are safe," according to the Associated Press. In an update on service restoration, Lloyds said its app was back up and running.
The European contacts with Google come against a regulatory backdrop that includes the designation of 19 information and communications technology service providers as critical to Europe's financial sector. According to Austria's Financial Market Authority, the European supervisory authorities made the designations under the Digital Operational Resilience Act. In Britain, final rules for critical third parties came into force on 1 January 2025, according to the Bank of England. These rules apply to a supplier once it is designated by the British Treasury, making its coverage contingent on a decision to classify it as critical. British oversight of the first group of these suppliers began on 13 July 2026, and the group included Google Cloud Europe, Middle East and Africa, placing the current incident after the company became subject to this oversight.
British powers allow regulators to gather information from critical third parties and assess their operational resilience, according to the Treasury. They also include setting rules for these entities and enforcing them where necessary, alongside powers to obtain information and conduct assessments. Oversight is limited to the systemically important services that designated suppliers provide to the financial sector. The ministry said oversight applies "only to systemically important services provided to the financial sector and does not cover companies' wider operations," defining the scope of services subject to these powers. Financial institutions themselves remain responsible for conducting due diligence when dealing with suppliers, managing risks associated with outsourcing arrangements and preparing contingency plans, according to the Bank of England.
Scrutiny of the incident also extended to the British parliament's Treasury Committee, which asked when authorities became aware of the problem and who notified them. The committee also requested an assessment of consumers' financial losses, alongside other harm they suffered during the disruption. Its questions covered compensation institutions provided to those affected, bringing the incident's impact on customers and redress measures under parliamentary scrutiny. On the technical investigation, Google pledged to publish an analysis of the incident after completing its internal investigation into the outage. The committee set Wednesday, 4 November 2026 as the deadline for an initial response to the issues it raised. It requested a full response by 20 January 2027, including answers on the timing of notifications, consumer harm and compensation.