European and British financial regulators have escalated their scrutiny of Big Tech's role in critical banking infrastructure, formally demanding that Google explain the circumstances behind a cloud computing outage that temporarily knocked out online services at multiple major banks. The intervention by the European Banking Authority (EBA) and the Financial Conduct Authority (FCA) marks a significant moment in the ongoing regulatory reckoning over the financial sector's deepening dependence on a handful of dominant cloud providers.
The outage struck on Tuesday, persisting for several hours before services were restored. Its origin was a power-related incident at a third-party data center facility — the kind of seemingly mundane infrastructure failure that, in an era of cloud-dependent banking, can cascade with remarkable speed into customer-facing disruption across an entire continent. While the incident was eventually resolved, the hours during which retail and institutional banking clients found themselves locked out of online services were sufficient to alarm supervisors who have spent years warning about precisely this category of systemic risk.
The EBA and the FCA's decision to formally reach out to Google reflects the seriousness with which both authorities regard operational resilience in financial services. For the EBA, the incident lands squarely within the framework of the Digital Operational Resilience Act (DORA), the European Union regulation that came into full effect in January 2025 and was specifically designed to hold financial entities — and their critical technology providers — to binding standards of continuity, incident reporting, and third-party risk management. DORA, notably, extended its reach beyond regulated banks to cover the information and communication technology firms that serve them, placing cloud giants like Google, Amazon, and Microsoft in the direct sightline of European supervisors for the first time.
The FCA's parallel engagement is equally telling. Post-Brexit, the United Kingdom has pursued its own operational resilience framework, requiring firms to identify their most important business services and demonstrate that they can remain within agreed impact tolerances even when technology failures occur. That the FCA is acting in concert with the EBA — rather than independently — underscores the cross-border nature of the disruption and suggests regulators on both sides of the Channel recognize the limits of purely national responses to infrastructure that operates without regard for geographic boundaries.
At the heart of the regulatory unease is a structural vulnerability that the industry has acknowledged for years without fully resolving: the concentration of critical banking workloads within a small number of hyperscale cloud providers. Google, Amazon Web Services, and Microsoft Azure collectively underpin an enormous share of the digital operations of European and British financial institutions. When any one of these platforms suffers a material disruption, the ripple effects are no longer confined to a single firm or sector — they propagate across the financial system in ways that regulators were not designed to manage under frameworks built for on-premise, firm-specific outages.
The power-related nature of Tuesday's triggering incident adds a layer of irony to the episode. Banks and their regulators have invested heavily in cybersecurity preparedness, stress-testing scenarios involving sophisticated cyberattacks, ransomware, and state-sponsored intrusions. Yet it was a comparatively prosaic physical infrastructure failure — a power issue at a third-party facility — that ultimately disrupted customer access to banking services across multiple institutions simultaneously. The incident is a pointed reminder that the threat surface for operational resilience extends well beyond the digital and into the physical dependencies of the data center ecosystem.
Google has not yet made public any detailed technical account of the incident, and regulators have not disclosed a formal timeline for the company's response. However, under frameworks such as DORA, critical third-party providers face structured obligations around incident notification and root-cause disclosure, and supervisory bodies retain the authority to demand comprehensive post-incident reporting. The EBA and FCA's outreach signals that both authorities intend to exercise those powers fully.
What This Means for Cloud Providers and Financial Institutions
The regulatory response to Tuesday's outage sends a message that will reverberate well beyond Google. For every major cloud provider with significant financial-sector exposure, the episode demonstrates that European and British supervisors are willing to act swiftly and visibly when banking resilience is compromised. Firms that have outsourced mission-critical workloads to hyperscalers should expect renewed pressure to revisit their contractual arrangements, multi-cloud contingency plans, and the granularity of their third-party risk assessments. For the banks themselves, the episode reinforces that outsourcing operational infrastructure does not outsource regulatory accountability — and that their own supervisors will hold them responsible for the resilience standards of the partners they choose. The broader industry is watching closely to see what answers Google provides, and what consequences, if any, follow.
Written by the editorial team — independent journalism powered by Codego Press.