Google Cloud Power Failure Disrupts UK Banks and Public Services

A power incident at Google Cloud’s London data-centre region disrupted banks, payment services and parts of the UK public sector on 20 October, turning one infrastructure failure into a practical test of financial and government resilience.

Google said the event affected its europe-west2 region. Services began returning after several hours and the company later reported full restoration. The interruption reached far beyond customers that identify themselves as technology businesses. Revolut reported failures affecting cards, cash withdrawals and other services, while assuring customers that money and data remained safe. Lloyds Banking Group and HSBC customers also reported problems. NHS England, court services, property platform Rightmove, delivery group DPD and Royal Mail were among the organisations affected, according to Reuters, the Associated Press and the Financial Times.

The breadth of disruption illustrates how cloud concentration changes operational risk. A bank can maintain its own applications, cybersecurity controls and contingency plans yet remain exposed to a physical or software failure inside a supplier’s regional infrastructure. The same provider can support payments, identity, logistics and public administration simultaneously, allowing an incident with a narrow technical origin to produce failures across unrelated sectors.

The UK Financial Conduct Authority said it was engaging with Google and regulated firms. That response matters because the country has moved from treating cloud operators solely as vendors to supervising selected providers as part of the financial system’s critical infrastructure. In July, UK authorities designated Google Cloud, Microsoft Azure, Amazon Web Services and Oracle as critical third parties. The framework permits direct information requests, testing and resilience requirements where a supplier’s failure could threaten financial stability or market confidence.

Europe has taken a similar approach. Google Cloud is among the 19 providers designated as critical ICT third-party providers under the EU’s Digital Operational Resilience Act. DORA gives European supervisors authority over the systemic risks created by major technology suppliers, while banks and other financial firms retain responsibility for managing outsourcing. The London incident offers supervisors a real event against which to test assumptions about regional redundancy, recovery times and customer communication.

Restoration does not settle the important questions. Google has not publicly provided a detailed root-cause analysis, explained why resilience mechanisms did not prevent the disruption or quantified how many customers were affected. Individual institutions will need to determine whether their own failover arrangements worked as designed and whether dependencies shared across vendors created hidden single points of failure.

Multi-cloud strategies can reduce dependence on one provider, but they are expensive and technically difficult. Applications must be portable, data must remain consistent and staff must rehearse a switch under stress. A nominal second provider offers little protection if the service cannot move quickly or if both clouds depend on the same identity, networking or software layer. For regulated firms, the relevant standard is therefore not the existence of a backup contract but the demonstrated ability to keep critical services running.

Geography adds a further complication. Cloud customers choose regions partly to control latency and data location, but concentrating critical workloads in London can make regional power and networking incidents more damaging. Active-active systems spread processing across locations, yet they add cost and can create their own consistency problems. Supervisors will want evidence that firms made deliberate trade-offs, understood which services could tolerate delay and tested recovery with real transaction volumes rather than simplified demonstrations.

The episode also separates financial harm from service interruption. Revolut’s statement that funds and data were safe addresses the most serious customer fears, but an inability to pay or withdraw cash can still be consequential. Missed transactions, delayed deliveries and inaccessible public systems impose costs even when balances remain intact. Institutions will have to assess compensation, customer complaints and any breaches of service obligations.

Why it matters

Cloud infrastructure now functions like financial plumbing. Its economies of scale make services cheaper and more capable, but concentration means a local failure can propagate across banks, businesses and government. The UK and EU have built direct oversight regimes precisely because ordinary outsourcing contracts cannot manage that systemic exposure on their own.

For customers, the immediate concern is whether payments and essential services remain available. For boards and regulators, the larger issue is whether resilience plans survive a real provider outage rather than a controlled exercise. Google’s full incident report, the FCA’s follow-up and any remediation demanded under UK or EU rules will determine whether this becomes a contained operational event or a catalyst for stricter cloud requirements.

Sources: Google Cloud service status · Reuters · UK critical third-party oversight