Google Cloud Outage in London Region Disrupts Revolut, Lloyds and HSBC Services, Putting UK Critical Third-Party Oversight to an Early Test

A power problem at a single Google data-centre region disrupted parts of the UK's financial system on Tuesday, October 20, 2026. According to a Reuters report published by Insurance Journal, Google said its UK cloud services were "back up" after an hours-long outage. The company attributed the disruption to a "power event" in its europe-west2 cloud region, which is based in London. The article does not give exact start or end times, so the precise duration is not known from the sources used here.

The financial services impact was visible. Revolut, the digital bank, reported disruption to multiple services, including card payments and ATM withdrawals, and said customers' money and data were unaffected. Lloyds Bank and HSBC appeared in reports on the outage-tracking site Downdetector. Lloyds said it expected services to return to normal soon, and HSBC acknowledged that some customers had trouble accessing its services. ING Germany flagged website and app issues, but said it saw no sign of an external cause or any third-party link, so its problem should not be attributed to Google on the basis of this report.

The disruption extended beyond banking. Downdetector also showed reports involving the property website Rightmove, the parcel firm DPD, NHS England and Royal Mail. Royal Mail said its letter and parcel deliveries were not affected. A Downdetector report indicates that users are having problems; it does not prove the cause or the scale of the problem, so these should be read as signs of possible links, not confirmed impacts.

The Financial Conduct Authority (FCA) responded quickly. It said: "We are aware of an incident affecting services provided by Google." It added that it is working with Google and affected firms to assess the impact. The regulator's statement shows how closely the authorities now watch concentration in cloud services.

The timing is notable because of recent regulation. According to the report, in July the UK placed Google Cloud, Microsoft, Amazon Web Services and Oracle under direct oversight as critical third-party providers to the financial sector. Under the regime, which allows HM Treasury to designate providers whose failure could threaten financial stability, regulators can set requirements directly for the technology companies rather than only for the banks that use them. The report also notes that last year EU regulators designated Google Cloud among 19 critical third-party computing providers. The outage therefore arrived only a few months after the UK brought the firms into its supervisory perimeter, and the regulators' handling of this incident will be a first practical test of the arrangement.

What does it mean for insurance? The Reuters article, as carried by Insurance Journal, does not discuss insurance coverage, insured losses or claims. The page is tagged with "business interruption" and "cloud insurance", but gives no details of either. Any analysis of insurance consequences is therefore general and should not be read as a report on actual claims. In general terms, cyber and business interruption policies can cover losses when a firm's operations are interrupted by an outage at a technology supplier, but the cover varies. Some policies include dependent business interruption cover for outages at named or unnamed third-party providers, often with waiting periods of several hours before losses count, and some exclude infrastructure failures such as power or utility problems unless specifically added. Whether any of the affected firms will claim, and whether their policies would respond, is not known.

The wider point concerns concentration risk. When many firms use the same cloud region, a single failure can affect all of them at once, which is the kind of correlated loss that insurers and regulators worry about most. A well-known aggregation concern for cyber insurers is that a cloud outage could trigger claims across many policyholders in a short period. Insurers manage this through policy wording, waiting periods, limits and exclusions for widespread events. Firms that rely on a cloud provider can reduce their own exposure by spreading critical workloads across regions or providers, testing failovers and agreeing recovery plans, although doing so costs money and adds complexity.

For customers, the practical lesson is that payments systems can fail for reasons outside their bank's control. People who rely on a single card or app for essential spending may want a back-up option, such as a second card from a different provider and some cash. Customers who have lost money because of an outage should contact their provider; the Revolut statement says that balances were unaffected.

For regulators, the incident supports the argument that operational resilience, meaning the ability to keep critical services running through disruption, is as important as capital. The FCA's review will show how many firms were affected, how long services were down and whether they stayed within the limits for impact they have set for themselves. The sources used here do not report any findings yet. Further information from Google about the cause of the power event, and from the FCA about its assessment, would help clarify how serious the outage was and what lessons follow.