|
Getting your Trinity Audio player ready...
|
The Hidden Risk Banks Are Finally Being Forced to Confront: Their Own Cloud Dependence
Every time your banking app refuses to load, there’s a decent chance the actual problem has nothing to do with your bank at all. It’s sitting somewhere inside a data center owned by Amazon, Microsoft or Google, hundreds of miles away, running software that dozens of other banks depend on too. That quiet, largely invisible dependency is now drawing serious attention from regulators, and 2026 has given them plenty of fresh evidence to point to.
The clearest example came on March 1 and 2, when Amazon Web Services suffered one of the most severe infrastructure failures in the history of cloud computing. A catastrophic physical event at AWS data center facilities triggered a region-wide disruption that rippled well beyond Amazon’s own products. Reuters reported that financial institutions running on AWS were directly affected, with regional banks confirming their platforms and mobile apps simply stopped working for customers during the outage. Microsoft’s Azure cloud has had its own string of incidents too, including a content delivery network failure and a separate government-focused outage, disruptions that knocked out everything from Microsoft Teams and Outlook to Alaska Airlines systems and US government portals in the same stretch.
What makes these incidents worth understanding, rather than just filing away as another tech headline, is a concept regulators call concentration risk. Decades ago, every bank ran its own servers in its own building, which meant a failure at one bank generally stayed contained to that one bank. Today, a large share of the entire banking sector runs on infrastructure owned by just three companies, Amazon, Microsoft and Google, often referred to as the Big Three. AWS has struck major cloud deals with banks including Barclays and HSBC, while Microsoft Azure and Google Cloud have both partnered with Lloyds Banking Group. When one of those three providers has a bad day, it’s no longer one bank’s problem. It can become dozens of institutions’ problem simultaneously, with no one else to fall back on because the entire industry is leaning on the same small set of load-bearing pillars.
Britain’s Prudential Regulation Authority has been watching this trend closely and is moving to scrutinize major cloud providers more aggressively as a result. The concern isn’t primarily about data security in the way most people think of cybersecurity, it’s specifically about the scale of disruption that could follow if multiple services running on the same provider failed at once. The regulator has reportedly been considering tougher testing requirements around how quickly banks can detect and recover from an outage, part of a broader joint effort with the Bank of England and the Financial Conduct Authority to understand exactly how exposed Britain’s financial system has become.
Europe has gone further, building concentration risk directly into binding regulation through the Digital Operational Resilience Act, known as DORA. Under that framework, if a bank’s cloud provider goes down, the bank itself can face regulatory consequences unless it can show a credible, tested contingency plan was already in place beforehand. That’s a meaningful shift in how accountability works. Rather than treating a cloud outage as an unavoidable act of nature outside a bank’s control, regulators are increasingly asking banks to prove they planned for exactly this scenario in advance, the same way they’d be expected to plan for a liquidity crunch or a cyberattack.
One detail that genuinely illustrates how underprepared much of the industry still is: analysts who study bank cloud architecture have found that many institutions have detailed, carefully documented plans for migrating onto the cloud, but little to no documented plan for what happens if they ever need to operate without a critical provider during a sustained outage, or how they’d move off that provider entirely if things went seriously wrong. Banks have spent years perfecting the on-ramp without building an off-ramp.
The risk also runs deeper than most banks can actually see. A bank might feel fully confident in the cloud provider it chose, having vetted its security practices and signed detailed contracts. But that same bank often has no visibility into the third-party security software or infrastructure components that its own cloud provider quietly relies on behind the scenes, an extra hidden layer of dependency that sits entirely outside the bank’s own audit process. Tom Vartanian, author of The Unhackable Internet, has argued that the internet itself is simply fragile by nature, and that incidents like the AWS outage are part of an ongoing stream of glitches, and worse, rather than isolated bad luck.
That fragility may actually be getting worse before it gets better. Research firm Forrester has predicted that the rush to retrofit cloud infrastructure for AI workloads will trigger at least two major, multi-day cloud outages across the industry in 2026 alone, as providers race to upgrade systems faster than they can be fully tested. In response, Forrester expects large cloud customers to start pushing providers harder to rebuild their infrastructure with operational risk in mind, and predicts that at least 15 percent of enterprises will shift toward private AI systems running on private clouds specifically to avoid getting locked into one vendor’s infrastructure.
That last point hints at where some of this pressure is actually heading. Rather than abandoning cloud computing altogether, which would be both impractical and expensive, some providers are now offering hybrid models designed to ease concentration risk without giving up cloud benefits entirely. Oracle, for instance, offers what it calls a Dedicated Region, letting a bank, airline or hospital run a complete, fully managed cloud environment physically inside its own secure facility, keeping direct control over the hardware while still getting the automation and flexibility that made cloud computing attractive in the first place. Whether approaches like that become standard practice, or whether the industry keeps leaning on the same handful of giant providers and hoping the next outage lands on someone else’s weekend, is likely to be one of the more consequential infrastructure questions in banking over the next few years.
