• Google Cloud outage disrupts services at major UK banks
• Treasury Committee demands answers from Bank of England and FCA
• Initial regulatory response due November 4
• EBA seeks information about cross-border financial sector impacts
• Incident tests UK's new critical third-party oversight regime
• Cloud concentration and disaster recovery arrangements face scrutiny
• Regulators examine potential customer harm and financial losses
• No regulatory breach findings announced as of October 27

UK financial regulators face growing pressure to demonstrate how they will use their new powers over critical technology suppliers following the Google Cloud outage that disrupted banking services across the country and exposed the financial sector's continuing vulnerability to concentrated third-party infrastructure.

The disruption on October 20 affected customers of several major financial institutions, including Revolut, Lloyds and HSBC, preventing some users from accessing accounts, making payments or withdrawing cash.

The incident has prompted scrutiny from Parliament and European regulators, turning what initially appeared to be a technology failure into an important test of recently introduced operational resilience frameworks.

Treasury Committee Chair Dame Meg Hillier has written to Bank of England Governor Andrew Bailey and Financial Conduct Authority (FCA) Chief Executive Nikhil Rathi, demanding details of the regulators' response and how they intend to exercise their supervisory powers.

The committee has requested an initial response by November 4, followed by a comprehensive assessment by January 20, 2027.

The intervention follows the designation in July of four major technology providers - Google Cloud, Amazon Web Services, Microsoft and Oracle - as critical third parties under the UK's financial services regulatory framework.

The regime gives the Bank of England, Prudential Regulation Authority and FCA powers to oversee designated providers whose operational failures could threaten financial stability or disrupt essential banking services.

The European Banking Authority (EBA) has confirmed it contacted Google Cloud to establish the consequences of the disruption for EU financial institutions.

Google attributed the outage to a power-related incident at a third-party facility supporting its London cloud infrastructure.

The failure affected the europe-west2-b availability zone, part of Google's London cloud region, with services largely restored later that day.

The incident raised questions about whether financial institutions had sufficient redundancy and recovery arrangements to withstand the failure of a critical cloud service.

Revolut confirmed that customer funds and data remained secure and said it was reviewing the disruption to reduce the impact of similar incidents in future.

The EBA's involvement adds a cross-border dimension to the regulatory response, reflecting concerns that outages affecting major technology providers can disrupt financial services across multiple jurisdictions simultaneously.

The outage has also exposed potential weaknesses in banks' disaster recovery arrangements, particularly where institutions depend on a single cloud region for critical services.

Google operates three availability zones within its London region, but the disruption demonstrated that relying on multiple zones does not necessarily guarantee uninterrupted operations.

For banks, the incident raises questions about whether contingency arrangements can maintain essential services when infrastructure failures affect interconnected systems and suppliers.

The FCA has confirmed that it is engaging with Google and affected financial institutions to establish the impact on customers.

"People need to be able to access their money and make payments, so we expect firms to fix issues quickly, keep their customers informed and ensure no one is left out of pocket," an FCA spokesperson said.

The parliamentary inquiry represents an early opportunity to assess whether the UK's critical third-party regime can deliver meaningful improvements in operational resilience.

Hillier has requested information about the number of affected financial institutions, the duration of disruptions, potential customer losses and lessons for both regulators and technology providers.

The committee also wants to understand whether the incident exposed shortcomings in the regulatory framework itself.

Importantly, responsibility for maintaining essential financial services remains with regulated institutions, even where failures originate from external technology suppliers.

So far, no published regulatory findings establish that Google breached its obligations under the new framework, and the parliamentary responses remain outstanding.

Nevertheless, the incident has highlighted the practical difficulties of supervising technology providers whose infrastructure supports multiple banks and other critical services simultaneously.

The coming regulatory assessments will help determine whether existing resilience requirements are sufficient - or whether financial institutions and their technology suppliers must strengthen contingency planning, recovery capabilities and oversight of concentrated cloud dependencies.