When the Cloud Goes Down, Who Is Really Accountable?

The recent fintech disruption raises an uncomfortable question: have financial institutions outsourced their technology, or have they inadvertently outsourced their resilience?

Intercept Technologies | 25 October 2026

When a major technology provider experiences an outage, the consequences can be immediate. Financial applications stop working, payments are interrupted and customers lose access to essential services.

The conversation inevitably turns to the technology provider.

But perhaps we should be asking a different question.

Why should a failure at a cloud provider be capable of bringing critical financial services to a standstill?

That is the issue highlighted in today's Sunday Times article, “Why Revolut’s service outage has regulators asking questions,” featuring commentary from Joe McCann, Managing Director of Intercept Technologies, and Peter Oakes of Fintech Ireland.

Their perspectives highlight two sides of the same challenge: technical resilience and regulatory accountability.

Outsourcing Technology Does Not Mean Outsourcing Responsibility

Cloud computing has transformed financial services, enabling fintech businesses to innovate and scale rapidly.

But relying on a major cloud provider does not automatically make an organisation resilient.

Google Cloud, like other leading providers, offers multiple availability zones, geographically separated regions, database replication and disaster recovery capabilities.

However, these protections must be deliberately designed, implemented and tested.

At Intercept Technologies, our position is that with appropriate and proportionate technical and organisational measures, foreseeable infrastructure failures should not result in prolonged disruption to critical financial services.

The technology exists to reduce these risks. The question is whether organisations have implemented it effectively.

Cyber Resilience Is More Than Preventing Cyberattacks

Cybersecurity is often associated with ransomware, data breaches and malicious activity.

But resilience is equally about maintaining the availability and integrity of critical systems.

A cloud infrastructure failure may not be a cyberattack, but the impact on customers can be just as serious.

A properly designed environment should consider geographically independent infrastructure, resilient databases, secure backups and tested recovery procedures.

For example, a fintech operating on Google Cloud could maintain independent application environments across different regions, with replicated databases and controlled traffic failover.

Such an architecture cannot guarantee uninterrupted service or zero data loss. It can, however, materially reduce dependence on a single geographical location when correctly designed and tested.

A disaster recovery plan is only valuable if it works when you need it.

The Regulatory Question: Can Firms Demonstrate Resilience?

The regulatory perspective is just as important.

Peter Oakes, of Fintech Ireland and a former Director of Enforcement at the Central Bank of Ireland, highlighted in The Sunday Times the scrutiny financial institutions face over IT resilience.

The EU's Digital Operational Resilience Act (DORA) and the UK's operational resilience frameworks reinforce the importance of understanding third-party dependencies, maintaining appropriate controls and testing recovery arrangements.

The question for financial institutions is no longer simply whether they have a business continuity plan.

It is whether they can demonstrate that their critical services will remain within acceptable disruption tolerances when a major technology dependency fails.

That requires evidence, not assumptions.

The Question Every Fintech Board Should Be Asking

The recent disruption should prompt every fintech board to consider three questions:

1. If our primary cloud region failed tomorrow, could our critical services continue operating?
2. Have we tested our ability to recover, including our applications, data and security dependencies?
3. Can we demonstrate to customers and regulators that our resilience measures are appropriate and effective?

These are not simply IT questions. They are questions of governance, customer protection and business continuity.

Resilience Should Be Designed, Not Assumed

No technology provider can guarantee that infrastructure will never fail.

But organisations can control how prepared they are for that failure.

At Intercept Technologies, we believe resilience should be treated as a fundamental business requirement, not an optional technology investment.

The recent disruption is a reminder that a cloud provider's failure should not automatically become a financial institution's failure.

Because ultimately, customers do not care whose infrastructure went down.

They care whether their money and essential financial services remain accessible.

Intercept Technologies | Cybersecurity, Cloud Resilience & Technology Risk

Is your organisation genuinely resilient, or simply highly available until something goes wrong?

Contact Intercept Technologies to discuss your cyber and operational resilience strategy.