European financial regulators have opened lines of inquiry with Google over a cloud computing outage that disrupted services at banks across the region, according to reporting published Wednesday.
The episode marks the latest instance of a now-familiar pattern: a technical failure inside one of the handful of companies that supply the world’s computing infrastructure cascades outward, surfacing as frozen payment screens, delayed transfers and unavailable mobile apps for ordinary customers who have never heard of the systems involved.
Why regulators are asking questions
Supervisors in Europe have spent several years warning that the banking sector’s migration to the public cloud, while delivering genuine gains in resilience, cost and speed, has also concentrated risk in a small number of providers. Google Cloud, along with Amazon Web Services and Microsoft Azure, sits at the centre of that concentration.
The concern is structural rather than reputational. If dozens of banks in multiple countries depend on the same provider, and in some cases the same regional data centre clusters, then a single fault can become a sector-wide event rather than a problem confined to one institution. Regulators have limited visibility into the internal engineering of those providers, and historically limited legal authority over them, because cloud companies are technology vendors rather than regulated financial firms.
That gap is precisely what European rule-makers have been trying to close. The EU’s Digital Operational Resilience Act, known as DORA, established a framework for designating certain technology suppliers as critical third parties to the financial system and subjecting them to direct oversight. An outage that visibly affected banks is the kind of test case the regime was designed for.
What regulators typically want to know
Inquiries of this type generally focus on a consistent set of questions. What was the root cause of the failure? How long did services remain degraded, and which functions were affected? Did the provider’s own redundancy arrangements work as designed, or did failover mechanisms themselves fail? How quickly and clearly were affected customers notified? And crucially, what changes will be made to prevent a recurrence?
Supervisors will also be examining the banks themselves. Firms are expected to maintain contingency plans for the loss of a major supplier, including the ability to continue critical services during an outage. An incident like this provides an unwelcome but useful stress test of whether those plans exist on paper only.
The wider debate
The outage is likely to sharpen arguments that have been running for years over so-called digital sovereignty â the idea that Europe’s banks, governments and critical infrastructure rely too heavily on American technology platforms. Proponents of greater European cloud capacity will point to incidents like this as evidence; sceptics counter that domestic alternatives would not automatically be more reliable, and that the scale of the hyperscalers is itself a source of resilience.
A more practical response may be multi-cloud architecture, where institutions spread workloads across several providers so that no single failure takes down core services. That approach is costly and technically demanding, and in practice many banks remain heavily weighted toward one supplier.
For now, the immediate consequence is procedural: letters, data requests and meetings between supervisors, banks and Google. The longer-term consequence may be a clearer answer to a question regulators have been circling for a decade â how do you supervise a company that is not a bank but has become indispensable to banking? Read More
Leave a Reply