MPs have asked regulators for details of how they will respond to a Google Cloud outage now the IT supplier falls within their regulatory remit of Critical Third Parties (CTPs).
Within hours of Google Cloud’s UK outage this week, Treasury Committee chair Meg Hillier MP fired off a letter to the governor of the Bank of England and the CEO of the Financial Conduct Authority (FCA).
In July, four suppliers – the local operations of Amazon Web Services, Google Cloud, Microsoft and Oracle – were labelled CTPs. This gives the FCA and the Bank of England powers of investigation and enforcement over non-financial firms that provide critical services to the UK financial services sector.
The sector is heavily dependent on cloud services from a few large tech companies, and as artificial intelligence (AI) use accelerates, more suppliers will become critical.
On 20 October, a power problem in Google Cloud’s London region knocked out banking apps, the courts’ video platform and delivery networks across the UK, with no second Google UK region for customers to fall back on. Financial services firms affected included Revolut, Lloyds Bank, HSBC, Barclays, Bank of Scotland, NatWest, Halifax and Nationwide.
In her letter, Hillier asked nine questions and demanded an initial response by 4 November, and full details by 20 January 2027.
“The Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority (the authorities) all have a role in implementing the critical third party regime,” she wrote.
Details required
Hillier asked for details about when the regulators were first alerted to a problem at Google Cloud, and by whom. She also asked for details of the cause of the outage, how many finance firms were impacted and how many of their customers were affected.
The Google Cloud outage began just after 7am BST (20 October), when the europe-west2-b availability zone – one of three inside Google’s London region, europe-west2 – lost power. Google Cloud confirmed the cause: “A power event caused an outage within europe-west2-b zone. The power event is mitigated. We are seeing the recovery of services and are prioritising the recovery of existing workloads.”
The incident is the latest reminder that the UK’s largest businesses remain dangerously exposed to cloud outages. Because europe-west2 is Google’s only UK region, customers that had not built multi-region resilience had no second UK location to failover to.
When the four tech giants were made CTPs, The Bank of England said: “The regulators will work together with the CTPs to address system‑level risks and reduce the risk of disruption to the services they provide spreading across the UK financial system.
“CTPs must identify and manage risks to their critical services effectively, and maintain open, timely communication with regulators and the firms that rely on them, particularly during major incidents.
“As many firms rely on these services, disruption or failure could affect multiple firms or markets at the same time, potentially impacting UK financial stability and services used by millions of consumers and businesses,” the UK central bank added.
This was a significant development and followed demands from MPs for IT suppliers to be included in the CTP regime.
