EU and UK financial regulators question Google over the cloud outage that stopped card payments

A day after a power event at a third-party facility in Google's europe-west2 region took card payments, logins and cash withdrawals offline at Revolut, Lloyds and HSBC for several hours on 20 October, the European Banking Authority said it had contacted Google Cloud to understand the incident and assess its impact on EU financial entities. In the UK the FCA said it was engaging with Google, and the Treasury Committee wrote to the Bank of England and the FCA asking about the regulators' response, the scale of the disruption and any financial harm.

The Bank of England declined to comment. Google said services were restored and that it would publish an analysis on its status dashboard.

This is the first visible exercise of the oversight machinery both the EU and the UK built for cloud dependence: Google Cloud is one of the 19 providers designated critical under DORA and one of four designated in the UK regime. The EBA used the moment to restate the limit of that machinery - designation creates EU-level oversight but does not move incident management away from the provider, and does not reduce the obligations of the banks and PSPs that depend on it.

For acceptance, the outage showed how far a single cloud region now sits inside the card authorisation path, and the inquiries will shape what resilience evidence acquirers and their bank partners have to produce.

Whether the EBA's information request turns into a formal oversight step against Google Cloud, what the Bank of England and the FCA tell the Treasury Committee about the scale of harm, and whether Google's published root-cause analysis on its status dashboard explains why a single power event in europe-west2 reached card authorisation.

• thestar.com.my