Summary

• A power event affecting Google Cloud's europe-west2-b availability zone disrupted services in the London region from approximately 07:08 BST on 20 October.
• Revolut, Lloyds and other organisations reported interruptions, while Google's incident dashboard recorded a duration of seven hours and 52 minutes.
• The Treasury Committee has asked the Bank of England and FCA how they will exercise their powers under the Critical Third Parties regime.

A power failure affecting Google Cloud infrastructure in London disrupted financial services, online businesses and public sector applications on 20 October, prompting parliamentary scrutiny of the UK’s arrangements for overseeing critical technology suppliers.

The incident began at approximately 07:08 BST, with Google identifying a power event affecting the europe-west2-b availability zone in its London cloud region. The failure caused errors and network disruption across multiple managed services, affecting organisations whose applications depended on the infrastructure.

Customers of Revolut, Lloyds Banking Group and other financial services providers experienced interruptions to banking functions, while problems were also reported by retailers, delivery businesses and public services. HM Courts & Tribunals Service confirmed difficulties affecting its Cloud Video Platform, which is used for remote hearings.

Google reported that the power event had been mitigated and that workloads were recovering during the afternoon. Its service health dashboard subsequently marked the regional incident as closed, recording a duration of seven hours and 52 minutes.

One availability zone affects several services

Google Cloud divides its infrastructure into geographic regions and availability zones. Customers can deploy applications across these locations, using managed services for computing, storage, databases and networking.

The power event affected the europe-west2-b zone, but its consequences extended into services used by customers across the London region. Google identified disruption involving products including Google Kubernetes Engine, Cloud Run, Cloud Filestore, AlloyDB and Apigee.

These services perform different functions. Some operate application workloads, while others manage information, databases or communication between systems. Failure of a supporting component can therefore prevent an otherwise functioning application from completing a transaction.

A customer may be able to open a banking app while finding that payments or account information cannot be retrieved. An online retailer may retain its public website but experience problems with orders, authentication or another connected service.

The range of reported effects reflects those dependencies. Revolut customers encountered problems with card payments, transfers and cash withdrawals, while customers of other banks reported difficulties involving particular digital services.

Revolut said customers’ funds and data remained secure. That statement addresses the bank’s assessment of customer information and money during the outage, rather than establishing that every transaction processed normally.

Other affected organisations reported different recovery experiences, depending on their technology arrangements. The disruption at HM Courts & Tribunals Service illustrated how cloud infrastructure can support activities extending beyond conventional commercial applications.

The incident originated in Google’s infrastructure, but the operational effect on each organisation depended on the services it used and the recovery arrangements built around them.

Financial regulators face a practical oversight test

On 20 October, Treasury Committee chair Dame Meg Hillier wrote to the Governor of the Bank of England and the Chief Executive of the Financial Conduct Authority seeking information about their response to the disruption.

The Committee had recommended stronger supervision of critical cloud and artificial intelligence suppliers in a report published in January. In July, the Treasury designated four technology companies under the UK’s Critical Third Parties regime: Google Cloud EMEA, Microsoft Ireland Operations, Amazon Web Services EMEA and Oracle Corporation UK.

The framework is intended to address risks arising when several financial institutions depend on services provided by the same technology business. A disruption at that supplier can affect multiple regulated firms, even where each institution has separately assessed its outsourcing arrangements.

Financial institutions already have responsibilities for operational resilience and the management of external service providers. The Critical Third Parties regime adds oversight directed at designated suppliers whose services may create wider risks for the financial system.

The Committee’s intervention seeks to establish how those powers will be applied to a real incident. Regulators can examine the effect on supervised institutions, the information obtained from the supplier and the adequacy of arrangements for maintaining or restoring critical services.

The FCA said it was investigating the impact with affected firms. Its assessment will need to account for differences between organisations, since a common infrastructure failure may interrupt separate business processes in different ways.

Recovery depends on application architecture

Cloud providers offer deployment options intended to improve resilience, including placing applications across multiple availability zones or geographic regions. The protection achieved depends on which components are duplicated and how workloads respond when a service becomes unavailable.

An application running in several locations may still depend on a database, storage component or authentication service concentrated in one place. If that dependency fails, the wider system can become unusable despite some computing resources remaining available.

Moving workloads between locations can also require changes to network routing and careful handling of information. Financial applications must preserve accurate transaction records during interruption and recovery, particularly where a payment could otherwise be processed twice or recorded inconsistently.

Recovery arrangements therefore need to be tested against specific failures rather than assessed solely through descriptions of the provider’s infrastructure.

Organisations may choose different recovery objectives according to the importance of their services. A temporary interruption to internal reporting has different consequences from the inability to complete payments or operate an essential public service.

Maintaining alternative infrastructure increases operating costs, while recovering from a prolonged outage may involve lost business, additional administration and disruption to customers. The appropriate balance depends on the service involved and the consequences of its unavailability.

Supplier concentration changes incident management

Large cloud providers can deliver services that would be expensive for individual organisations to operate independently. Their scale supports specialist engineering, managed databases, global networks and substantial investment in security.

That scale also concentrates dependencies. Businesses with no direct relationship to one another can become exposed to the same underlying failure through their choice of infrastructure or software suppliers.

These connections may be difficult to identify where an organisation purchases an application from a vendor that itself relies on Google Cloud. Effective resilience planning requires an understanding of significant dependencies beyond the contracts held directly by the organisation.

The October failure has brought that issue into sharper focus for UK financial services. The designated supplier regime gives regulators a means of examining risks that extend across institutions, while each bank or payment provider remains responsible for its own operating arrangements.

Google has said it will publish a fuller incident analysis following its investigation. That report should establish further technical detail about the power event, the components affected and the recovery sequence.

For regulated firms, the immediate evidence will come from reviewing which services failed, how transactions were handled during the interruption and whether recovery arrangements met their operational requirements. The Treasury Committee’s questions will test how regulators use that information to supervise a supplier whose infrastructure supports several important parts of the UK economy.