Revolut and the Google Cloud outage: a real-world test of the UK Critical Third Parties regime

A power event in a single Google Cloud availability zone in London disrupted banks, courts and websites across the UK on 20 October, and with them Revolut's app and cards, still partly degraded at 5pm. Monzo has built a completely separate backup bank for exactly this scenario, which underlines that the damage was as much a consequence of design as of bad luck.

The outage is also a real-world test of the UK's Critical Third Parties regime. In force since 13 July 2026, the regime puts four designated global cloud providers, Google Cloud among them, under the direct oversight of the FCA, the Bank of England and the PRA. Until now, no financial regulator oversaw the suppliers directly; accountability ran through the banks' own outsourcing obligations. What happens next will show what the new powers are for: whether the regulators ask how a single zone failure reached so many banks at once, and what they require in response.

What the regime does not change is who answers to the customer. Revolut carries the accountability to its own customers for infrastructure it neither controls nor can easily supervise. That shape will be familiar to anyone who has negotiated an outsourcing agreement, in which the customer-facing party keeps the accountability while operational control sits with a supplier that will not accept unlimited exposure.

The same arrangement is now forming around AI models. A business that builds its customer service, credit decisions or claims handling on a third-party model answers to the customer, and to the regulator, for a dependency it cannot supervise. The regime exists precisely because regulators concluded that firms were not managing that dependency on their own.

For any board relying on a handful of cloud and model providers, the deciding question is a practical one. If one supplier's building lost power tomorrow, which of your critical services would stop, and whose name would be on the regulator's letter?

Source: Linas's Newsletter, Fintech Pulse #1141 (21 October 2026), https://lnkd.in/gUPavrPS. Incident reported by the Guardian and BBC (20 October 2026); regime details from HM Treasury and Bank of England Critical Third Parties announcements (July 2026). The Guardian described the outage as the first major test of the regulators' new powers.

#OperationalResilience #CloudComputing #AIGovernance