Google Cloud Outage Disrupts UK Banks, Tests Oversight Regime

A Google Cloud outage knocked the apps of several large UK banks offline for much of Tuesday morning, 20 October 2026, in the first real-world test of the regime that brought the hyperscaler under direct UK financial supervision three months earlier. Customers of Lloyds, Halifax, HSBC and the digital bank Revolut reported being locked out of digital services from shortly after 06:08 GMT, as a fault centred on Google's London data-centre region rippled across online banking, card payments and transfers.

Google said its engineering team was investigating and reported the first signs of recovery within hours. By late morning Lloyds said its app was operational again and that it expected all services to return to normal, while Revolut said customer money and data remained safe throughout. Google had not published a root-cause analysis at the time of writing. Some reports characterised the fault as power related, which would fit a documented pattern at the London region, though Google had not confirmed a cause.

Which services went down, and for how long?

The disruption centred on Google's London data-centre region, known as europe-west2, which the company confirmed sat at the centre of the incident. Because applications hosted in other countries sometimes route through London-based infrastructure, the effects were not confined to the UK, and problems were reported elsewhere in Europe, although it was unclear whether those were connected.

Revolut told affected customers it was working to fix the problem and apologised for the inconvenience. Downdetector-style tracking cited by UK media logged complaint spikes against Lloyds, Halifax, Bank of Scotland, HSBC and Revolut across the same window, with Revolut the most visible single name. Reports of knock-on disruption extended beyond banking to other digital and public-sector services, though those accounts rested on user trackers rather than company confirmations. The banking impact appears to have lasted a matter of hours rather than a full working day.

Why does one cloud fault take down four banks at once?

The answer is concentration. A small number of hyperscalers, Amazon Web Services, Microsoft, Google and Oracle, now run much of the computing that sits behind retail banking, so a single regional fault can surface simultaneously at institutions that otherwise compete head to head. The Bank of England has warned for years that this clustering creates systemic risk: when many firms depend on the same supplier, no individual bank can manage the fallout of that supplier failing. Figures attributed to the Bank have put the share of UK financial firms relying on a handful of cloud providers for critical infrastructure above 65 per cent.

That dependency is now a supervised one. On 10 July 2026, HM Treasury made the UK's first designations under the Critical Third Parties regime, created by the Financial Services and Markets Act 2023. The designations named Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited, placing all four under the joint oversight of the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. The rulebook behind the regime was published by the three authorities in November 2024. Tuesday's outage is therefore the first time a designated provider has failed in a way that hit multiple UK banks since the oversight took effect.

What can the regulators actually do?

Oversight is not the same as prevention. The Critical Third Parties framework lets the authorities set minimum resilience standards, demand incident reporting and run resilience testing on the systemic services these providers deliver to the financial sector. It does not regulate a hyperscaler's entire global business, and crucially it does not remove responsibility from the banks themselves, which remain accountable for mapping their dependencies and maintaining workable continuity plans. Sarah Breeden, the Bank of England's Deputy Governor for Financial Stability, has argued that as these suppliers become more deeply embedded in financial operations they introduce new forms of systemic risk, which is the logic that drove the designations in the first place.

The UK regime is the domestic counterpart to the EU's Digital Operational Resilience Act, under which European regulators designated 19 technology providers as critical in November 2025, including the European arms of Google Cloud, AWS and Microsoft. The UK version puts more of the onus on the suppliers to identify and report risks in their own supply chains, rather than leaving firms to do all the mapping.

Have we seen this before?

Repeatedly, and recently. Google Cloud's London region has a documented history of infrastructure failures, including a cooling-driven shutdown of a europe-west2 zone during the July 2022 heatwave and a power failure that hit the same region in August 2024. In July 2026, a separate electrical fault took Google Cloud's Netherlands zone offline for close to 15 hours. A wider Google Cloud outage on 12 June 2025 disrupted services well beyond banking, taking down parts of Cloudflare, Spotify and other platforms.

Nor is the problem unique to Google. The disruption fell on the first anniversary, almost to the day, of the AWS outage of 20 October 2025, which triggered more than 6.5 million problem reports worldwide and knocked out Halifax, Lloyds and government websites alongside Amazon and Reddit. Before that, the July 2024 CrowdStrike software failure grounded flights and froze hospital and banking systems globally. Each episode has pointed at the same vulnerability from a different angle.

Why This Matters to FinanceX Readers

For finance professionals and investors, Tuesday was less about a few hours of app downtime and more about a live demonstration of the risk the UK spent two years building a regime to contain. The timing is the story: a provider formally designated as systemically important in July went down in October, handing the Bank of England, PRA and FCA their first chance to show what supervision of a hyperscaler looks like in practice. Watch for whether the regulators request a formal incident report, and whether banks face questions about their fallback arrangements. The outage resolved by lunchtime. The open question for every board is what happens the day a critical provider goes down and does not recover on the same timetable.