Why Financial Firms Can No Longer Treat Cloud Concentration as Someone Else’s Problem

For most of the last decade, moving to the cloud was sold to financial firms as a way to become more resilient. Large providers offered redundancy, security teams and uptime figures that few in-house data centres could match. That argument still holds, but it has a second half that regulators are now forcing into the open: when a large share of the financial system runs on a handful of providers, a single outage can stop thousands of firms at once.

From outsourcing risk to systemic risk

Traditional outsourcing rules looked at the relationship between one firm and one supplier. A bank was expected to carry out due diligence, negotiate audit rights and keep an exit plan. That framework works when suppliers are numerous and interchangeable. It struggles when the same three or four hyperscale providers sit underneath core banking platforms, trading systems, payment processors and data vendors all at once. Survey work by UK authorities has shown just how concentrated the market for cloud, data and model services has become.

The July 2024 incident in which a faulty security software update knocked Windows machines offline around the world showed how this plays out in practice. Airlines, hospitals, broadcasters and banks were all affected by a single third-party failure, even though many of them had never thought of that vendor as a critical dependency. It was not a cloud platform outage, but it was exactly the kind of correlated failure that supervisors worry about.

Regulators are reaching the providers directly

The response has been to add direct oversight of the providers themselves to the existing firm-level rules. In the European Union, the Digital Operational Resilience Act has applied since January 2025 and includes an oversight framework for critical ICT third-party providers. In the United Kingdom, a separate regime lets HM Treasury designate critical third parties, which are then overseen jointly by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. The first designations covered the largest cloud platforms, and an analysis of the UK’s new critical third parties regime points out a detail many firms have missed: the framework relies on oversight, testing and remediation rather than fines against the providers.

That design choice matters for regulated firms. If regulators cannot simply penalise a cloud provider into better behaviour, much of the practical leverage sits with the firms that buy the services and with the transparency the regime creates. Self-assessments, incident reporting and scenario testing will give supervisors a much clearer picture of where the system is fragile, and that picture will shape what they expect from the firms that depend on those providers.

Accountability stays with the firm

The most important point for any regulated business is that none of this transfers responsibility. A bank, broker or payment firm remains accountable for its own operational resilience, whatever oversight its providers face. UK firms were expected to be able to stay within impact tolerances for their important business services by March 2025, and that obligation does not soften because a supplier has been designated. If a cloud outage takes a customer-facing service offline, the conversation with the regulator will still be about the firm’s own mapping, testing and recovery plans.

In practice, the questions boards should be asking have changed. It is no longer enough to know that a provider is reputable and certified. Firms need to understand which of their important services depend on which providers, which regions and data centres they rely on, how quickly they could recover from a prolonged failure, and whether their exit plans are realistic or simply written to satisfy an auditor.

Resilience is a design decision

Some of the most effective resilience work happens long before an incident. An architecture that spreads critical workloads across regions, or keeps a tested fallback for the handful of services customers truly cannot do without, costs money up front but limits the damage when something breaks. Contract terms matter too. Notification commitments, access to incident information and cooperation during testing are far easier to negotiate before signing than after an outage.

Smaller firms often assume this is a problem only for systemically important banks. It is not. A mid-sized broker or payments company may be even more exposed, because it typically depends on a single provider for almost everything and has less room to absorb downtime. Proportionate planning, rather than no planning, is what supervisors increasingly expect.

The direction of travel

Direct oversight of critical providers is still new, and the first rounds of testing will reveal gaps on both sides. What is already clear is that operational resilience has stopped being a narrow IT topic. It is a board-level question about how a firm would keep serving customers on its worst day. Firms that treat cloud concentration as their own problem, rather than someone else’s, will be far better placed when that day comes.