On a Wednesday morning in October 2026, banks did not fail because of bad loans, a liquidity crisis, or a rogue trader. They faltered because Google did. A significant outage affecting Google's cloud infrastructure cascaded almost immediately into disrupted banking services for customers who never once thought their ability to check a balance or complete a transaction had anything to do with a technology company headquartered in California. It is a moment that financial regulators, central bankers, and chief risk officers will be studying for years — and one that commentator Chris Skinner of The Finanser had been warning about well before it arrived.

The episode crystallises a systemic risk that has been building quietly for over a decade. As banks raced to modernise their infrastructure, cut costs, and accelerate digital delivery, they migrated core operations — payments processing, customer authentication, data storage, real-time fraud detection — onto the cloud platforms of a very small number of technology giants. Google Cloud, Amazon Web Services, and Microsoft Azure collectively underpin a staggering share of global financial services infrastructure. When one of them experiences a significant disruption, the blast radius is no longer contained to a single institution or even a single sector. It is systemic.

Skinner frames this with a pointed and historically resonant comparison. For the better part of two decades following the 2008 financial crisis, regulators on both sides of the Atlantic devoted enormous intellectual and legislative energy to the problem of banks being "too big to fail." The premise was straightforward: certain financial institutions had grown so large and so interconnected that their disorderly collapse would drag the broader economy down with them. Trillions in taxpayer funds and entire regulatory frameworks — from the Financial Stability Board's systemically important bank designations to the Federal Deposit Insurance Corporation's resolution planning requirements — were constructed around this concern. Yet while regulators were staring intently at the banks, an analogous concentration risk was crystallising in the technology layer that now sits beneath those very banks.

The question Skinner poses is both simple and devastating: who is really in control? A licensed, regulated retail bank is subject to capital requirements, stress testing, operational resilience standards, and in many jurisdictions explicit rules about recovery and resolution. The cloud hyperscalers that now host that bank's customer-facing and back-office systems operate under an entirely different and far less prescriptive framework when it comes to financial-sector dependencies. They are commercial technology vendors. Their service-level agreements are contracts, not regulatory obligations. Their outages are incidents, not prudential failures — at least not yet in the eyes of most supervisory regimes.

Regulatory bodies have begun to move, if not yet at the pace that October's outage demands. The European Banking Authority and the European Central Bank have pressed financial institutions hard on third-party and Information and Communication Technology risk under the Digital Operational Resilience Act, known as DORA, which entered application in January 2025. DORA explicitly requires financial entities to manage concentration risk arising from critical third-party providers, including cloud platforms, and mandates that major providers of information and communication technology services to the financial sector register and submit to oversight. It is a meaningful step. But a regulatory framework designed to make banks more resilient is not the same as a framework that makes the cloud providers themselves accountable for systemic failures.

The October 2026 Google outage is also a reputational inflection point for the cloud-first banking model. Neobanks and digital-native lenders, whose entire value proposition rests on seamless, always-on service, were among the most visibly affected. Customers who abandoned legacy institutions precisely because of their perceived unreliability found themselves locked out of accounts routed through the same disrupted infrastructure. The irony is sharp: the pursuit of technological modernity created a new and arguably more concentrated form of single-point-of-failure risk than the mainframe era it replaced.

What this means for the industry is a forced and overdue reckoning. Financial institutions must interrogate their cloud strategies not merely for cost efficiency or feature velocity, but for genuine systemic resilience. Multi-cloud architectures — distributing critical workloads across more than one hyperscaler — have long been advocated by risk professionals and resisted by engineering and procurement teams who cite complexity and cost. The events of October 2026 make that resistance considerably harder to justify to a board, a regulator, or a customer standing in front of a darkened cash machine. Regulators, meanwhile, face pressure to extend systemic-risk designation logic beyond the financial sector to the technology infrastructure layer. The concept of "too important to fail" has migrated. It is past time that the supervisory architecture migrated with it.

Written by the editorial team — independent journalism powered by Codego Press.