Businesses should heed the lesson in Revolut’s nightmare Tuesday

Revolut users grabbing a coffee on their way to work on Tuesday (yesterday) were in for an unpleasant surprise when their card was repeatedly declined.

Around Europe, baristas glared and queues grew agitated as the bewildered costumers of the continent’s most valuable tech startup tried to understand what was happening, and whether their money was safe.

More pressingly – how on Earth they were supposed to pay for their latte with a piece of plastic stamped with the Revolut logo.

With a customer base of around 100 million, recent expansion beyond Europe, and an IPO in the works, it’s probably fair to say that the staff and executives working in the fintech giant’s Canary Wharf headquarters had it even worse.

At first, details behind the outage were scarce.

Revolut may well have preferred to keep it that way, because when they finally emerged, the details were no less damaging to its reputation.

By the afternoon, it became clear that millions of people suddenly lost access to their own money because Revolut – valued at around $115 billion – is apparently entirely dependent on a single region of a single cloud provider.

When the London infrastructure of Google Cloud went down due to a “power event”, Revolut went down with it.

MaltaCEOs.mt spoke to BMIT Chief Service Delivery Officer Sean Cohen and Melita Chief Information Officer Roderick Farrugia to understand what went wrong, and how businesses can shield themselves from similar situations.

“Yesterday’s Google Cloud disruption, centred on its London region and affecting services such as Revolut, is another reminder that even the largest technology providers can experience significant outages,” says Mr Cohen.

“It will happen again, and businesses need to plan for it when deciding how their systems are designed and where they are hosted.”

While cloud “remains the right choice for many workloads,” he continues, “it does not remove the need to plan for disruption, particularly when several business functions depend on the same provider, or on a single region of that provider.”

Significantly, the EU’s Digital Operationl Resilience Act (DORA) “already requires fintech companies to manage that concentration risk.”

Explaining how an issue in Google London-area data centres and infrastructure left Maltese Revolut users unable to send and receive transfers or make cash withdrawals, Mr Farrugia notes that “whether a service is affected by an incident like this depends on where that service’s provider has chosen to host it, not on where its users are located.”

He points out that companies use different cloud providers and regions, “so a service hosted in London would be affected for all its users, whether they are in Malta or elsewhere.”

However, services hosted locally or in other regions would not be.

Mr Cohen agrees, noting that local data centres “give businesses something a second region of the same provider cannot: infrastructure that sits entirely outside that provider’s network, in Malta, with full visibility of where data is held and how it is run.”

In practice, businesses can approach the question of operational continuity in several ways.

“Local hosting can run production systems in its own right, not just hold backups or serve as a recovery site,” says the BMIT executive. “Spreading workloads across more than one cloud provider is another way to remove a single point of failure. Continuity does not always require duplicating the entire IT estate: a smaller environment focused on essential operations may be enough.”

The details matter: “Multi-cloud only helps if critical systems can actually run on the second platform. A backup needs a workable restoration plan, and a recovery system must stay accessible if the affected cloud also provides your login or other supporting services. Local infrastructure can fail too, so independence and regular testing matter wherever systems are hosted.”

BMIT and Melita employ both local hosting and cloud solutions for internal operations and client offerings.

“Melita’s core IT systems and platforms are hosted locally in our data centres in Mrieħel and Madliena, with built-in redundancy and failover between sites,” says Mr Farrugia. “The same applies to business customers’ data hosted on Melita’s Smart Cloud platform.”

Similarly, Mr Cohen says BMIT sees “global cloud services and local infrastructure, including our own data centres and cloud platform, as complementary parts of that planning.” He adds: “Our data centres in Ħandaq and SmartCity Malta connect to all of Malta’s telecoms operators, and our international network runs across multiple subsea cables to our points of presence in Frankfurt and Milan.”

The first question, then, is “what the business actually needs to keep operating if a major platform is unavailable for several hours. For some, that means access to essential records. For others, it means continuing to process orders or serve customers.”

The right balance, he says, “starts with understanding what the business can afford to lose access to, and for how long.”