Cloud Concentration Risk Threatens Banking System Resilience

The banking industry's reliance on cloud providers like Microsoft, Amazon, and Google has created a hidden concentration risk. A failure or cyber event at one of these shared providers can affect multiple institutions simultaneously.

This issue is not just about the technical capabilities of the individual provider but also about the correlated dependency between them. The Bank of England and FCA 2024 AI survey found that the top three cloud providers accounted for 73% of reported cloud-provider relationships among respondents, with a third of AI use cases being third-party implementations.

The UK Competition and Markets Authority's investigation into the cloud services market in 2025 found Amazon and Microsoft to have significant market power, with barriers limiting customer choice. This concentration risk is not just about an outage that makes a bank's application unavailable but also affects critical banking functions like databases, identity systems, developer pipelines, cyber controls, analytics tools, AI services, and data layers.

The European Central Bank's Guide on outsourcing cloud services emphasizes the need for effective management of security, continuity, and exit arrangements. The guide reflects a broader view that concentration risk reaches further than just an outage, creating a recovery trap where backup data may not equal service portability. A resilience plan that fails unless the original provider is available is not an exit plan but rather a recovery plan inside the same dependency.