A single power failure inside a Google Cloud data centre in London brought banking services to their knees this week — and if that sentence does not alarm you, it should. The incident, which disrupted financial institutions relying on Google's cloud infrastructure, was not a cyberattack, not a sophisticated act of sabotage, and not the result of regulatory failure in any conventional sense. It was a power cut. And that is precisely what makes it so damning.
The financial industry has spent the better part of two decades migrating its most critical operations to a handful of hyperscale cloud platforms. The promise was irresistible: lower costs, elastic scalability, faster innovation, and the ability to shed the burden of maintaining expensive on-premise infrastructure. Banks, insurers, payment processors, and fintechs lined up to hand their workloads to the giants of Silicon Valley. Convenience, as it always does, won the argument. Resilience, as it almost always does, lost it.
Chris Skinner, the financial technology commentator behind The Finanser, framed the moment with characteristic bluntness: society has given Big Tech its data, its money, its businesses, and now its intelligence. In return, it received convenience. At no point, Skinner notes, did anyone stop to ask who would end up controlling the world. It is a question that sounds hyperbolic until a single data centre experiences a power failure and banks go dark.
The concentration risk embedded in modern financial infrastructure has been a concern for regulators for years, but the pace of migration has consistently outrun the pace of scrutiny. The European Banking Authority (EBA), the Bank of England, and the Bank for International Settlements (BIS) have all published frameworks and consultation papers on operational resilience and third-party risk. The Digital Operational Resilience Act (DORA), which entered into force across the European Union, was designed in part to address exactly this kind of systemic dependency. Yet frameworks, however well-crafted, cannot fully substitute for the structural decisions that financial institutions make when they choose to concentrate their operational fate in the hands of one or two cloud providers.
What the London outage illustrates is not merely a technology problem. It is a governance problem of the first order. When a commercial entity — however capable and well-resourced — becomes the de facto utility underpinning national banking systems, the question of accountability becomes urgent. Google is not regulated as a bank. It does not carry deposit insurance obligations, prudential capital requirements, or the same supervisory burden that the institutions depending on it are required to bear. The asymmetry is striking: the regulated party assumes the risk; the unregulated party holds the infrastructure.
There is a deeper philosophical dimension here that Skinner's framing captures well. The migration to cloud was not a decision made by any single institution or regulator. It was the cumulative result of thousands of individual procurement choices, each rational in isolation, each offering a compelling return-on-investment calculation, and each incrementally transferring a piece of financial sovereignty to a small number of American technology corporations. The system-level consequences were never the subject of a democratic debate or a deliberate policy choice. They simply accreted, quarter by quarter, migration project by migration project, until the dependency became structural.
This is not an argument for retreating from cloud technology, which has delivered genuine efficiencies and enabled innovation that legacy infrastructure could never have supported. It is an argument for confronting, honestly and urgently, the governance vacuum that surrounds cloud concentration in systemically important sectors. Multi-cloud strategies, sovereign cloud initiatives, and robust contractual resilience requirements are partial answers. But they require financial institutions and their regulators to treat cloud dependency as the systemic risk it demonstrably is — not as a vendor-management footnote buried in an annual operational risk report.
What This Means for the Industry
The London outage should function as a stress test that nobody planned but everyone needed. Regulators across the United Kingdom and European Union will, in all likelihood, seek post-incident reports from affected institutions and examine whether resilience obligations under existing frameworks were met. That scrutiny is necessary, but it is also retrospective. The harder work — rewriting the risk calculus before the next failure, not after — falls to boards, chief risk officers, and technology leaders who must now make the case internally that operational resilience is not a cost centre but a competitive and regulatory imperative. The convenience bargain that Skinner describes is real. So is the bill that arrives when it fails.
Written by the editorial team — independent journalism powered by Codego Press.