When a Cloud Outage Becomes a Financial System Risk

A bank can remain financially sound while customers temporarily lose access to its services.

Its balance sheet may remain intact.

Its employees may still be working.

Its own core systems may not be the original source of the disruption.

And yet payments can fail.

Cards can become temporarily unavailable.

Customers can lose access to essential financial functions.

The source of the disruption may sit outside the financial institution itself.

It may sit inside the digital infrastructure on which several institutions depend.

That is becoming an increasingly important financial-regulation question.

The 20 October Google Cloud Outage Made the Dependency Visible

On 20 October, Google Cloud experienced a significant disruption in its London region, known as europe-west2.

Google reported problems across multiple cloud services in the region.

Reuters reported that the incident was associated with a power event at a third-party facility.

The disruption affected organisations including Revolut, Lloyds Bank, HSBC, NHS England, Royal Mail, and other services.

Revolut reported disruption to services including card payments and ATM withdrawals before services were restored.

The incident did not become a banking crisis.

Revolut said customer funds and data remained secure.

What the outage demonstrated was something different: infrastructure outside a financial institution can still affect the financial service experienced by its customers.

Sources: Google Cloud Service Health; Reuters, 20 October 2026.

Independent Financial Firms Can Still Share Infrastructure

Banks and payment companies may compete with one another.

They can have separate management, applications, customers, and regulatory licences.

But some of the infrastructure beneath those services may still be shared.

A disruption affecting a major technology provider can therefore reach several organisations during the same event.

This changes the nature of operational risk.

A problem does not necessarily remain confined to the company in which customers first notice it.

European Regulators Are Now Looking Beyond the Financial Institution

On 21 October, the European Banking Authority contacted Google Cloud for additional information about the outage.

The purpose was to understand the incident and assess its implications for financial institutions in the European Union.

That regulatory response is significant.

The event was not treated only as a technology problem inside each affected bank.

Regulators also looked toward the infrastructure provider supporting financial services.

Source: Reuters, 21 October 2026.

DORA Has Expanded the Regulatory Perimeter

The European Union’s Digital Operational Resilience Act recognises that financial-sector resilience can depend on technology companies outside the traditional financial system.

Under DORA, critical ICT third-party providers can be brought under direct European supervisory oversight.

The assessment considers factors such as the systemic importance of the services, the financial institutions depending on them, their support for critical functions, and how difficult those services would be to replace.

Google Cloud EMEA Limited is among the technology companies formally designated as critical ICT third-party providers at EU level.

This reflects a broader regulatory recognition: technology infrastructure can become important to financial stability when large parts of the financial sector depend on it.

Sources: European Supervisory Authorities; Digital Operational Resilience Act.

Having Another Provider Does Not Mean a Service Can Move Immediately

Cloud markets contain several major providers.

But the existence of another provider does not mean a critical financial service can be transferred instantly during an outage.

Modern applications can be deeply integrated with infrastructure, data, security systems, and operating processes.

Changing providers can therefore require substantial technical and organisational work.

This is why regulators consider practical substitutability, rather than simply counting how many technology companies exist in the market.

The United Kingdom Has Reached a Similar Conclusion

The United Kingdom introduced its own direct oversight regime for critical third parties in July 2026.

The first four designated providers were:

Amazon Web Services.

Google Cloud.

Microsoft.

Oracle.

Their designated systemic services are jointly overseen by the Bank of England, Prudential Regulation Authority, and Financial Conduct Authority.

The reason is straightforward.

A disruption affecting a sufficiently important technology provider can potentially affect multiple financial firms and services at once.

Sources: Bank of England; Financial Conduct Authority, July 2026.

Outsourcing Infrastructure Does Not Outsource Accountability

Direct supervision of major technology providers does not remove responsibility from financial institutions.

UK and EU frameworks continue to require financial firms to manage their own operational and third-party risks.

The technology provider has responsibilities for the resilience of its services.

The financial institution remains responsible for the continuity of the regulated service it provides customers.

Direct oversight therefore adds another regulatory layer.

It does not transfer accountability entirely away from the bank.

Backup Infrastructure Is Valuable Only When It Can Actually Preserve Service

Financial institutions invest heavily in redundancy and disaster recovery.

But the existence of backup infrastructure does not automatically mean customers will experience uninterrupted service.

Backup systems can still depend on common infrastructure or common technical services.

This is why operational resilience increasingly focuses on whether essential services can continue or recover, rather than only whether backup resources formally exist.

Recovery Time Matters

Technology failure cannot always be prevented.

The economic impact therefore depends partly on how quickly important services can return.

Financial-sector downtime can affect:

Payments.

Card transactions.

Cash withdrawals.

Transfers.

Trading.

Settlement.

Business liquidity.

A brief disruption may create temporary inconvenience.

A prolonged disruption can create wider economic consequences.

Recovery capability is therefore part of operational resilience.

For Customers, Service Availability Is What Matters

Customers generally do not see the infrastructure contracts behind their bank.

They experience the result.

Can they make a payment?

Can they access their money?

Can a business receive funds or settle an invoice?

This is one reason modern operational-resilience regulation increasingly focuses on continuity of important business services.

Cloud Infrastructure Is Still Physical Infrastructure

Cloud computing can appear almost entirely digital from the user’s perspective.

But it remains dependent on physical systems.

Data centres.

Electricity.

Cooling.

Fibre networks.

Servers.

Backup power.

Buildings.

The October incident, linked to a power event, made that physical dependency particularly visible.

Digital infrastructure has not eliminated physical infrastructure risk.

It has changed where that risk is concentrated.

Large Cloud Providers Can Increase Resilience

Concentration itself should not automatically be interpreted as weakness.

Large cloud providers can invest enormous resources in cybersecurity, monitoring, engineering, redundancy, and disaster recovery.

Many individual financial institutions could not economically reproduce the same infrastructure capabilities independently.

Cloud adoption can therefore improve resilience as well as efficiency.

The challenge is that scale also changes the potential reach of a major failure.

Concentration Changes the Shape of Failure

A highly resilient provider can still experience disruption.

When one provider supports many important institutions, a sufficiently large incident can affect several services at the same time.

The relevant issue is therefore not whether concentration is inherently dangerous.

It is whether the wider financial system can continue to provide essential services when shared infrastructure becomes unavailable.

Technology Supply Chains Can Contain Dependencies Below the Contract

Cloud services themselves depend on other infrastructure.

Data centres use electricity.

Networks use physical fibre routes.

Applications may depend on external software and technical services.

Two financial firms can therefore appear to use different suppliers while still sharing some underlying infrastructure.

This makes technology concentration more complex than the name appearing on a commercial contract.

Operational Resilience Has Become a Financial-Regulation Issue

Traditional financial supervision rightly focuses on capital, liquidity, credit risk, and market risk.

Those protections remain essential.

But a financially sound bank can still become temporarily unable to provide an important customer service when technology infrastructure fails.

Digital dependency has therefore moved operational resilience closer to the centre of financial supervision.

Regulators increasingly need to understand both financial institutions and the critical infrastructure supporting them.

Efficiency and Resilience Can Pull in Different Directions

Cloud infrastructure creates substantial economic benefits.

Standardisation.

Flexible capacity.

Lower infrastructure costs.

Specialized security expertise.

Rapid deployment.

At the same time, operational resilience can require additional redundancy, recovery capabilities, and testing.

Those safeguards have economic costs.

But service interruption can have economic costs too.

Financial infrastructure is especially sensitive because payments, settlement, and access to liquidity are time-sensitive services.

Digital Convenience Has Become Infrastructure Dependency

Cloud adoption originally offered financial institutions greater flexibility, scalability, and lower infrastructure costs.

Those benefits remain.

But as cloud services become embedded more deeply inside essential financial operations, their role changes.

They become part of the infrastructure on which modern financial services depend.

And infrastructure dependency creates questions of resilience, concentration, and accountability.

Conclusion

Modern financial institutions increasingly depend on infrastructure they do not operate entirely themselves.

Cloud computing has delivered significant benefits in cost, scalability, security expertise, and operational flexibility.

But shared infrastructure also creates shared dependencies.

The Google Cloud disruption on 20 October showed how a physical infrastructure problem inside a technology provider can interrupt customer-facing services across several organisations.

The incident did not demonstrate that cloud computing is unsafe.

Nor did it create a banking crisis.

It demonstrated why operational resilience can no longer be assessed only inside individual financial institutions.

Regulators are increasingly examining the critical technology providers and infrastructure beneath those institutions too.

As digital services become financial infrastructure, the question changes.

It is no longer only whether each bank is individually sound.

It is also whether the shared infrastructure supporting many banks can preserve essential financial services when disruption occurs.