Cloud computing has become fundamental to the financial services industry, giving firms the scalability and flexibility to modernise their technology infrastructure. But as institutions increasingly rely on a small number of providers, that dependence is creating a new concentration risk, with implications for operational resilience, regulatory compliance and the wider financial system.

For RegTech, the challenge extends beyond managing individual firms’ cloud exposure. As regulators sharpen their focus on third-party dependencies and systemic vulnerabilities, technology providers and financial institutions must demonstrate not only that their systems are resilient, but that critical compliance functions can withstand disruption. The question is whether the industry’s cloud foundations are becoming a risk that compliance technology itself must help solve.

How exposed are financial institutions to a small number of cloud providers? Emil Kongelys, CTO of Muinmos, states he would frame the question slightly differently.

He said, “The short answer is that financial institutions are not necessarily more exposed than they were before cloud providers existed. Running systems on bare metal offers no greater guarantee of availability than running them in the cloud. Cloud concentration becomes a material risk when a provider stops operating in a region and workloads cannot be moved to another region, for example because of regulations.”

In that scenario, Kongelys said the more important question is how exposed financial institutions are to providers that are not cloud-agnostic.

“This risk is often underestimated because cloud providers now offer far more than infrastructure,” he remarked.

Systems can become deeply dependent on proprietary services, he added, making it extremely difficult to migrate at short notice.

Source link