European regulators question Google after cloud outage lasting 7 hours and 52 minutes
Key Facts
The European Banking Authority contacted Google Cloud to request information about an outage affecting its cloud services and assess its potential implications for financial institutions in the European Union, according to Reuters. The company's service status dashboard recorded a Cloud Run outage lasting 7 hours and 52 minutes as part of the incident. Britain's Financial Conduct Authority also said it was in contact with Google about the outage, which was accompanied by disruptions at British banks. The European authority's follow-up focuses on obtaining further details about the incident and assessing its potential impact on financial institutions within its remit. The regulatory contacts come as the company is already subject to a British oversight regime for third-party providers supplying services of systemic importance to the financial sector.
Google attributed the outage to a power-related incident in one of its cloud availability zones, according to an incident notice published by the company. Describing the cause, it said "a power-related incident caused an outage within the availability zone." British banks that reported disruptions included Lloyds, Halifax, HSBC and Revolut, according to the Associated Press. During the disruption, Revolut confirmed that customers' money and data were safe, saying: "We confirm that all our customers' money and data are safe." The bank's assurance about money and data came during the disruption it reported, while Google's technical statement focused on the cause of the cloud infrastructure outage.
The British regulatory backdrop to the incident dates to the start of oversight of the first group of critical third parties on 13 July 2026, according to the Bank of England. Those designated in this group included Google Cloud EMEA Limited. Britain's contact with Google over the outage therefore follows the company's inclusion among providers subject to direct financial oversight. The regime allows regulators to gather information from designated providers and assess their operational resilience, according to Britain's Treasury. This framework links a provider's designation as a critical third party to regulatory assessment of the operational resilience of its services to the financial sector.
British oversight is limited to the services of systemic importance that designated companies provide to the financial sector, according to the Treasury. The ministry said "regulatory oversight applies only to systemic services provided to the financial sector and does not cover companies' wider operations." Within this scope, regulators can gather the necessary information about providers covered by the designation. They can also assess the resilience of the services those providers supply to financial institutions, under the powers granted by the British regime. This places Google's services to the financial sector within an oversight remit defined by the service and its systemic importance, while the company's other activities remain outside the scope of this regime.
Financial institutions themselves remain responsible for managing their arrangements with third-party providers, under the rules outlined by the Bank of England when it announced the start of oversight. This responsibility includes due diligence when dealing with providers and managing the risks associated with those arrangements. It also extends to preparing contingency plans as part of financial institutions' obligations regarding services obtained from third parties. Sarah Breeden, the Bank of England's deputy governor for financial stability, warned of the risks arising from these providers' integration into financial operations. She said they "could introduce new forms of systemic risk," in a warning about the role of third parties in the operations on which the financial sector depends.
Scrutiny also extended to the British parliament, where the chair of the Treasury Committee wrote to the governor of the Bank of England and the chief executive of the Financial Conduct Authority about the outage. According to the committee's announcement, the correspondence addressed regulators' handling of the incident under the powers available to them. The committee specifically asks how those authorities will use their powers in dealing with this outage. The parliamentary request thus focuses on the response of the authorities responsible for financial oversight to the incident that affected banking services. The committee directed its request to both the central bank and the Financial Conduct Authority, while the authority has already said it is in contact with Google about what happened.
On the technical review, Google pledged to publish an analysis of the incident once it completes its internal investigation into the outage. The company said: "We will publish an analysis of this incident once we complete our internal investigation." For the parliamentary follow-up, the Treasury Committee set a deadline for an initial response by Wednesday, 4 November 2026, according to its letter to regulators. The committee also requested a full response by 20 January 2027 on the issues raised in its correspondence. Its request includes clarification of how regulatory powers will be used in response to the incident, as part of the replies the Bank of England and the Financial Conduct Authority are expected to submit to the committee.