Cards were declined at tills, apps would not open and some customers could not reach their money after a power failure at a Google Cloud data centre in London knocked out services at Revolut and disrupted other banks across Britain on Tuesday.
The incident has revived a question that regulators have been asking for years: what happens when a large share of the financial system depends on a handful of technology providers, and one of them goes down?
What happened
Google said the problem began at about 06:08 UTC in its europe-west2 region, which serves customers in the UK and Ireland, and that a power event in one zone caused the outage. At least 38 Google Cloud products were affected, including core services that banks and fintech firms use to run applications.
Google said its engineers were investigating errors and intermittent network failures in the region. Services were gradually restored through the day, and the company later posted a final update saying the disruption was over.
Revolut, the digital bank, was among the hardest hit. Customers reported failed card payments, problems with cash withdrawals and an inability to log in. The company said customers’ money and data were safe throughout. By Tuesday evening it said services had been restored.
Customers of Lloyds, HSBC, Barclays, Bank of Scotland, NatWest, Halifax and Nationwide also reported difficulties accessing accounts or making payments, along with users of Royal Mail, DPD and other services. Streaming and delivery platforms also reported problems. The budgeting app Emma said it, too, was affected and had since recovered.
The cause
The available evidence points to an outage rather than an attack. Neither Google nor Revolut pointed to malware, ransomware or an intrusion, and reports described a service failure rather than a breach or data theft. The Telegraph reported that the failure was not linked to a substation problem, and UK Power Networks said its systems were operating normally across London.
Regulators step in
The Financial Conduct Authority said it is in touch with Google and seeking more information, and the Prudential Regulation Authority is understood to be speaking to the company as well.
The timing is awkward for the industry. This summer the government designated Google Cloud, Microsoft, Amazon Web Services and Oracle as critical third parties to the financial sector, placing them under direct oversight by the Bank of England, the PRA and the FCA, with the regime taking effect on 13 July. It requires resilience testing, regular self-assessments and the reporting of major incidents.
Under UK operational resilience rules, firms must also identify their important business services and set limits on how much disruption they can tolerate.
A familiar warning
Tuesday’s disruption came almost exactly a year after an outage at Amazon’s cloud arm took down a wide range of online services, including some UK banks and financial firms. Regulators said at the time that they were ready to supervise technology providers more closely.
The concern is concentration. When many banks, fintech firms and public services rely on the same cloud regions, a single fault can ripple across otherwise unconnected businesses, as it did on Tuesday.
Revolut is far from alone in building core banking systems on a public cloud rather than its own data centres. Cloud platforms offer speed and scale that few lenders could match alone, but they also create shared points of failure.
What customers can do
Banks stress that funds were not at risk, and nothing suggests customer money was lost. Even so, the episode is a reminder to build in some resilience.
Customers can carry a second payment card from a different provider, keep a small amount of cash for emergencies and use official channels, such as a bank’s status page or verified social media account, to check whether a service is down before assuming an account problem.
The bigger question
Bank customers rarely think about where their app is hosted, and for most of the year they do not need to. Tuesday showed how quickly that changes. The next test for the industry and its regulators will be whether new oversight rules translate into measurable improvements in recovery times, and whether banks can show they can keep core services running when a cloud region fails.
