A power failure at Google's London Cloud data centre on Tuesday morning took down a single availability zone — europe-west2-b — and in doing so knocked offline the video system used by courts across England and Wales, card payments and withdrawals at Lloyds, HSBC, Halifax, and Revolut, property portal Rightmove, Royal Mail, and parcel service DPD. Services began recovering around 1pm and were largely restored by 3pm, but not before court hearings were delayed (including those involving defendants in custody), millions of bank customers lost access to their money, and the brittleness of UK digital infrastructure was briefly visible to everyone. The FCA confirmed it contacted Google for information, marking the first real-world test of powers the City regulator and Bank of England were granted this summer to oversee cloud providers deemed 'critical' to UK financial services. Those powers exist precisely because regulators saw this scenario coming: a small number of hyperscale cloud providers — Google, AWS, Microsoft Azure — underpin an enormous share of UK financial, legal, and governmental operations, and a failure at any one creates correlated outages across ostensibly independent institutions. What matters is not the outage itself — hardware fails, power systems trip, and a few hours of downtime is not catastrophic in isolation. What matters is the topology. Lloyds, HSBC, Revolut, HMCTS (the court video system), Rightmove, Royal Mail, and DPD are not related businesses. They share no supply chain, no regulator, no customer base. The only thing that connected their simultaneous failure was a single Google Cloud zone in London. That is a concentration risk that no individual institution can manage, because it lives one layer below their own architecture. Google's statement was boilerplate: a 'power event,' an internal investigation to follow, thanks for your patience. The banks followed the same script — aware of issues, apologise for inconvenience, expect resolution soon. Revolut's statement that 'all customers' money and data are safe' is the tell: when a digital bank has to reassure you your money still exists, the abstraction layer has failed. The structural question is whether the new FCA/BoE oversight powers have teeth. Cloud providers are not banks; they have no depositors, no capital requirements, no resolution regime. The regulators can demand resilience standards and information, but they cannot force Google to build redundant power at a second London site, or require banks to maintain failover across multiple cloud vendors. The incentive structure — cloud is cheap precisely because it concentrates — cuts against resilience. For the banks, this is an embarrassment but not an existential event. For the courts, it is more serious: delayed hearings for defendants in custody have real liberty implications. For the regulators, it is an opening to demonstrate that the new critical-third-party regime is more than a statutory placeholder. And for the public, it is a reminder that the convenience of digital services comes with a hidden architectural bet — that a building in London will keep its lights on.
