GRC

Google Cloud outage puts UK critical third parties regime to the test

A Google Cloud London outage hit UK banks and courts. MPs now ask the Bank of England and FCA how they will use their new critical third parties powers.

Illustration of scales over a cloud network representing UK regulation of critical cloud providers

A power failure in Google Cloud’s London region knocked out banking apps, card payments and court video hearings for hours on Tuesday. It appears to be the first serious incident involving a provider designated under the UK’s critical third parties regime, and MPs want to know whether the regulators’ new powers will be used.

What happened

Trouble started at 06:08 UTC (07:08 BST) on Tuesday 20 October 2026, when europe-west2-b, one of the three availability zones that make up Google Cloud’s London region, began failing. Google’s status page later put it down to a “power event” in that zone. Affected services included Google Kubernetes Engine, Cloud Run, App Engine and Cloud Filestore.

The effect downstream was wide. Customers of Lloyds, HSBC, NatWest, Halifax, Bank of Scotland and Revolut reported problems. These ranged from app features not working to failed cash withdrawals and declined card and contactless payments. Royal Mail, DPD and Rightmove were also hit. Computer Weekly reported that HM Courts & Tribunals Service’s Cloud Video Platform was still not fully restored late in the afternoon, and that Google said backup generators had not kicked in during the initial failure. By 14:03 UTC Google said most customers had recovered, although a small number were still affected. It has promised a post-incident analysis once its internal investigation is finished.

Later the same day Dame Meg Hillier, who chairs the Treasury Committee, wrote to Bank of England Governor Andrew Bailey and FCA chief executive Nikhil Rathi. She asked nine questions about how the authorities found out, what they did and what they have learned. She wants an initial reply by 4 November and a full one by 20 January 2027. The FCA said it was engaging with Google and the firms affected, and that it expects firms to make sure “no one is left out of pocket”. Neither the Bank nor the PRA would comment.

How the regime works

The regulators’ rules for the critical third parties (CTP) regime took effect on 1 January 2025. Until this summer it had nobody to apply to. On 13 July 2026 HM Treasury’s designations came into force for four entities: Google Cloud EMEA Limited and the relevant Amazon Web Services, Microsoft and Oracle entities. The Bank of England, the PRA and the FCA oversee them jointly.

The rules in the Bank’s policy statement PS16/24 set six fundamental rules and eight operational risk and resilience requirements for the services CTPs provide to the financial sector. Among other things, the requirements deal with governance, mapping of services, change control, cyber and technology resilience, supply chain dependencies, incident handling and orderly exit. A CTP that has an operational incident must send initial, intermediate and final reports both to the regulators and to the affected firms. It must also file an interim self-assessment within three months of designation. For the July cohort, that deadline fell in mid-October, only days before this outage.

The regulators’ toolkit includes information gathering, resilience assessments and skilled person reviews. In serious cases they can restrict how a CTP serves financial firms. Two points matter here. First, the Treasury has said designation says nothing about the “quality, security or reliability” of a provider’s services. Second, the regime explicitly does not move accountability away from the banks. Firms, their boards and their senior managers still own their outsourcing risk and their operational resilience.

Timeline from the start of the critical third parties rules in January 2025 to the Google Cloud outage and Treasury Committee deadlines

Why it matters for UK organisations

For financial services firms, this is the moment the CTP regime stops being theory. Several of the Treasury Committee’s questions go to the core of the design. Did the incident reporting chain work, and who first alerted the regulators: Google, the banks or someone else? The committee is also asking the regulators what they have learned about running the regime itself, which suggests it is ready to push for changes if the answers are weak.

The eighth question is aimed directly at regulated firms: what should they learn about their own operational resilience? Expect supervisors to ask why a single zone failure, in a region with three zones, was enough to stop customers paying for things. When the designations were announced in July, DCD highlighted a 2024 Bank and FCA survey that put Microsoft, Google and Amazon at 73 per cent of cloud services supplied to UK financial firms. Concentration is no longer an abstract risk.

The lesson reaches beyond finance. The courts, NHS-linked services and logistics firms were hit as well, and none of them sits under the CTP regime. The Cyber Security and Resilience Bill, which returns to the House of Lords for report stage on 26 October, is set to update the UK’s network and information systems rules. But a public body running its video hearings on one hyperscaler region has no equivalent of a Treasury designation to fall back on.

Expert view

In my experience, resilience reviews tend to stop at the contract. The SLA, the certifications and the zone count on the architecture diagram get ticked off, and losing a whole zone is assumed to be covered. Multi-zone is not the same as tested failover. If stateful workloads, Kubernetes node pools or file stores were tied to one zone, or if the surviving zones could not take on new workloads, which Google’s own status messages hinted at, the extra zones gave less protection than the diagram suggested.

The CTP regime was never designed to stop outages. Its purpose is to make the largest providers tell regulators and customers what went wrong, quickly and in a structured way, and to give the authorities the tools to act on that. Tuesday tests the first half of that promise. The quality of Google’s intermediate and final reports, and whether affected banks receive them as the rules require, will show whether the regime has substance.

Redress will be the most politically charged question. When customers cannot pay for food, regulators will look to the bank, not the hyperscaler.

What to do now

  1. Map your exposure to europe-west2 today. Inventory which workloads, managed services and SaaS suppliers depend on the London region, including fourth parties.
  2. Check zone and region assumptions. Confirm that stateful services, storage and cluster node pools really span several zones. Test that the surviving zones can scale up when one zone is lost.
  3. Re-run impact tolerance scenarios. Regulated firms should use Tuesday’s timeline as a severe but plausible scenario for important business services, and record any breach of tolerance.
  4. Prepare for supervisory questions. Record when you detected the problem, when you heard from Google, what you told customers and how redress is being handled.
  5. Request the post-incident report. Make sure the right people receive CTP incident reports and that someone owns reviewing them against your controls.
  6. Keep the basics in view. Cyber Essentials does not address availability, so pair it with tested backups, documented recovery runbooks and exit plans for concentrated cloud dependencies.

Bottom line

One failed power supply in one London zone was enough to disrupt banks, couriers and courts. The critical third parties regime now faces its first real test, and the Treasury Committee has set the deadlines. The accountability for keeping customers’ services running stayed with firms when they moved to the cloud.

Sources

Related Posts