Google Cloud London Outage Hits Revolut, Halifax, Lloyds and NHS as Regulators Scrutinise Critical Third-Party Dependency
A disruption at Google Cloud's London-based europe-west2 data centre on Tuesday 20 October 2026 caused widespread service outages across UK financial services, public infrastructure, and consumer platforms, exposing the depth of the sector's reliance on a single cloud provider's regional infrastructure. Revolut, the UK digital bank, suffered a service outage affecting card payments and ATM withdrawals. Halifax Bank reported customers facing issues online and with its app. Outage tracking data indicated disruption for users of Lloyds Bank, HSBC, Bank of Scotland, property platform Rightmove, parcel delivery firm DPD, NHS England, and Royal Mail. ING Germany separately reported problems with online banking and its app due to a technical issue. Lloyds confirmed some customers were experiencing issues with certain online services but said its app was operating normally. Google confirmed its engineering team was investigating the issue. The europe-west2 data centre is primarily designed to serve customers in the UK and Ireland, which bore the brunt of the disruption. The outage is directly relevant to the UK's critical third-party (CTP) regime: in July 2026, the UK designated four technology companies, including Google Cloud EMEA Limited, as critical third-party suppliers to the financial sector, bringing them under direct regulatory oversight. Google Cloud was also among 19 technology companies designated by EU regulators in November 2025 as critical ICT third-party providers under the EU's Digital Operational Resilience Act (DORA). European regulators have explicitly flagged growing concern about financial sector concentration in cloud infrastructure from a small number of major providers.
Why this matters
This outage is the first significant real-world stress test of the UK's critical third-party designation regime since Google Cloud EMEA Limited was formally brought within it in July 2026. The breadth of the disruption, spanning retail banks, a digital challenger bank, public services, and consumer platforms simultaneously, is precisely the systemic scenario that regulators warned about when designing the oversight framework. The fact that both UK and EU regulators had already flagged concentration risk in cloud dependency means this event will likely accelerate regulatory scrutiny of operational resilience planning across all designated critical third parties and the financial firms that depend on them.
On the Ground
The immediate legal work falls in financial regulation and operational resilience: banks and payment firms affected by the outage will need to assess their notification obligations to the FCA and PRA under operational resilience rules, review their business continuity and incident response documentation, and consider whether their third-party risk management frameworks are adequate. The CTP regime itself creates ongoing compliance mandates for firms relying on Google Cloud and other designated providers, including contractual obligations around access, audit rights, and exit planning. No legal advisers are named in the sources. A trainee on this type of matter would be updating the firm's remediation tracker, drafting a regulatory notification to the FCA, and reviewing the firm's critical third-party contract against the relevant regime requirements.
Interview prep
Question you might get
“What obligations does the UK's critical third-party regime place on financial firms and their cloud providers following an operational disruption of this kind, and what gaps does this outage reveal?”
Sign up free to see the full answer
A model answer you can lift into an interview — how to frame this story for a partner.
Sign up freeSources
My notes
saved