Europe's financial regulators query Google over cloud outage that hit banks

By Phoebe Seers and Elizabeth Howcroft

LONDON/PARIS, Oct 21 (Reuters) - Financial regulators in Europe are questioning Google after a cloud computing outage on Tuesday left millions of bank customers without access to key financial services for hours.

The European Banking Authority said that it had been in contact with Google Cloud to obtain further information on the incident, understand its implications and assess its potential impact on financial entities in the EU, a spokesperson for the watchdog told Reuters.

Alphabet's Google said the disruption, which lasted several hours, was caused by a "power event" in a London-based network that serves customers across Europe. Revolut, Lloyds and HSBC were among the banks affected.

HSBC and Lloyds did not comment.

A Google spokesperson said: "We have resolved a disruption to Google Cloud services at a third-party facility in our europe-west2 cloud region due to a power event. Services have been restored. We will update our public status dashboard with an analysis."

At Revolut, which has around 13 million UK customers, a wide range of services including logging in, card payments and cash withdrawals were affected on Tuesday, according to the bank's website.

Revolut said in a statement that it was reviewing the incident to reduce the impact of any future third-party disruptions, and that customer funds and data had remained safe throughout.

The outage is the first major test of new rules across Europe designed to strengthen the resilience of technology providers, including cloud firms, on which the financial sector depends.

The European Union last year designated 19 technology firms as critical third-party providers to the financial sector, bringing them under joint direct oversight of three financial regulators — including the EBA — for the first time. Britain took similar steps for four cloud providers, citing the risk that an outage at a major supplier could affect multiple financial firms at the same time. Google Cloud falls under both regulatory frameworks.

"The designation of a provider as a Critical third-party provider establishes an EU-level oversight framework; it does not transfer responsibility for incident management from the provider or relieve financial entities of their own regulatory obligations," the EBA said in emailed comments.

In Britain, parliament's Treasury Committee has written to the Bank of England and the Financial Conduct Authority (FCA), seeking details of the regulators' response to the outage on Tuesday, the scale of the disruption and any financial harm caused.

The FCA said it was engaging with Google over the incident. Under Britain's critical third party regime, designated providers like Google Cloud must report serious outages to the FCA and the BoE.

A spokesperson for the Bank of England declined to comment.

Under EU and UK rules, banks are ultimately responsible for the services they provide to customers, including when they rely on third-party providers.

(Reporting by Elizabeth Howcroft in Paris and Phoebe Seers in London; additional reporting by Lawrence White in London; Editing by Xevi Fontdegloria and Sanjeev Miglani)