• The European Banking Authority and the UK Financial Conduct Authority have reportedly contacted Google over an outage that took down several bank websites and services.
• Google attributed the outage to a power event in its London cloud region (europe-west2), according to press reports.
• Revolut said card payments, transfers and sign-ins were affected, while saying customer money and data were safe.
• The regulatory interest is about shared dependency: many firms can fail together when one cloud provider's region goes down.
• Watch for Google's promised incident report and for whether supervisors ask banks to show how they would run through a provider outage.

The European Banking Authority and the UK's Financial Conduct Authority have been in contact with Google over a major cloud outage earlier this week that knocked out several bank websites, Finextra reported. The contact is a request for answers, not an announced enforcement step. It still marks a shift: the question regulators are asking is no longer only whether a bank was down, but which shared supplier sat underneath it.

What reportedly happened

Press reports say Google attributed the outage to a power event in its London cloud region, europe-west2, and apologised. Revolut said card payments, transfers and sign-ins were affected, while stating that customer money and data were safe. Other banks were reported to have had customer issues, though the link to Google was not confirmed in every case. Google has said it will publish a full incident report, so details may change.

Why supervisors care about the supplier

The regulatory interest rests on concentration: when many firms rely on one provider and one region, a single physical fault becomes a sector-wide event. That is a different failure mode from a bank's own outage. A bank can pass its internal resilience tests and still share a dependency with its competitors, which is the gap supervisors are probing when they approach the provider directly.

The second-order effect for compliance teams

Compliance teams should expect questions about evidence, not intent. Supervisors are likely to ask which critical services ran in the affected region, how long customers were impaired, and whether failover to another region or provider was designed and tested. Firms that can only point to a vendor's service-level promise, rather than a rehearsed exit or fallback path, will find that answer harder to defend.

What to watch next

Three signals matter. First, Google's promised incident report and whether it confirms a single-zone or wider regional cause. Second, whether the EBA or FCA publish follow-up expectations for firms that depend on the provider. Third, whether banks disclose how many customers and which services were affected. Until those arrive, the scope of the regulators' inquiries and any consequences remain unconfirmed.

What this means for banks and fintechs

The practical takeaway is to map dependencies to the region level and test a degraded mode. For each customer-facing function such as card authorisation, transfers and authentication, document which provider region it needs, what happens when that region fails, and how customers are told. A tested fallback is a stronger answer to a supervisor than an assurance from the supplier.