Cloud Computing in Finance

Quick Definition

Cloud computing in finance refers to the delivery of computing services (storage, databases, servers, networking, software, and analytics) over the internet to financial institutions. Instead of owning and operating physical data centers, banks and financial firms rent computing capacity from providers like Amazon Web Services (AWS), Microsoft Azure, and Google Cloud, paying only for what they use.

What It Means

For decades, banks ran their own massive data centers. Every server, every database, every backup tape was owned and managed in-house. This infrastructure was expensive, slow to scale, and required thousands of IT staff to maintain.

Cloud computing flips this model. A bank can provision new computing capacity in minutes rather than months, deploy software globally with a click, and pay variable costs that scale with usage rather than fixed capital investments. The shift is transformational. Cloud is to banking infrastructure what the smartphone was to consumer banking.

How Cloud Computing Works

Cloud services are delivered through several models:

Deployment Models

Why Finance Is Moving to the Cloud

Cost Savings

• No capital expenditure: No buying servers. Pay operating expenses instead.
• Elasticity: Scale computing during market volatility (election day, market crashes) without permanently over-provisioning.
• Reduced IT staff: Cloud providers handle hardware maintenance, patching, and physical security.

Speed and Innovation

• Faster deployment: New applications deployed in days instead of months.
• Access to cutting-edge tools: AI, machine learning, and analytics services available immediately.
• Testing environments: Spin up testing environments instantly. Shut them down when done.

Resilience and Disaster Recovery

• Cloud providers offer 99.99%+ uptime SLAs with automatic geographic redundancy.
• Data automatically replicated across multiple data centers.
• Disaster recovery that once cost millions to implement is now a configuration setting.

Cloud Adoption by Financial Institutions (2026)

Where the Industry Stands

According to the Cloud Security Alliance's 2026 survey of 340 financial institutions worldwide, cloud adoption has reached near-universality:

Only 1.7% of financial institutions remain entirely on-premises. The hybrid model remains the most common strategy, reflecting the reality that most banks still operate legacy core banking systems alongside cloud-native applications.

Fintech startups and digital banks (Chime, Revolut, Nubank) are 100% cloud-native. Traditional banks are in a multi-year hybrid transition. Insurance companies are earlier in their journey, with claims and customer-facing systems moving first.

Major Banking Cloud Deals

• Goldman Sachs: AWS as strategic cloud provider
• JPMorgan Chase: Multi-cloud with AWS and Microsoft Azure
• HSBC: Google Cloud partnership
• Capital One: AWS. Described itself as "all in on cloud" in 2021.
• DTCC: Working with AWS to migrate core clearance and settlement systems to public cloud, with a target completion of 2030. The SEC granted a Notice of No Objection in June 2025.
• ASX: Went live with its new CHESS equity clearing platform on AWS in April 2026, processing 21 million trades per day at three times the speed of the previous system.

The Core Banking Challenge

The hardest part of bank cloud migration is the core banking system, the central ledger that processes every transaction. Many bank core systems run on COBOL code written in the 1970s and 1980s. Replacing or migrating these systems is a multi-year, billion-dollar project with enormous operational risk.

New core banking platforms (Temenos, Thought Machine, Mambu) are cloud-native and are used by digital banks and banks doing full core replacements.

Cloud Security in Finance

Security is the most cited concern for financial cloud adoption. Cloud providers invest more in security infrastructure than most individual banks can afford.

AWS, Azure, and Google Cloud each:

• Have achieved FedRAMP authorization (U.S. government security standard)
• Comply with PCI DSS (payment card industry security)
• Support SOC 1/2/3 audit certifications
• Maintain ISO 27001 certification (information security management)

Shared responsibility model:

• Cloud provider is responsible for security OF the cloud (physical hardware, network, facilities)
• Financial institution is responsible for security IN the cloud (data, access controls, application code)

Key controls banks implement:

• Encryption of all data at rest and in transit
• Multi-factor authentication for all cloud access
• Private network connectivity (AWS Direct Connect, Azure ExpressRoute) rather than public internet
• Strict identity and access management (IAM) policies

The CrowdStrike Incident and Cloud Outage Risk

The operational risks of concentrated technology dependencies became painfully clear on July 19, 2024. A faulty content update to CrowdStrike's Falcon sensor caused an estimated 8.5 million Windows devices to crash worldwide. Banking sector losses alone were estimated at $1.15 billion, with JPMorgan Chase, Bank of America, and Wells Fargo among the affected institutions.

Additional cloud disruptions followed in 2025:

• A 15-hour AWS outage in October 2025 affected over 4 million users
• A Google Cloud IAM failure in June 2025 disrupted Lloyds Bank, Bank of Scotland, Coinbase, and Robinhood
• Multiple Azure regional outages throughout the year

Between August 2024 and August 2025, AWS, Azure, and Google Cloud experienced more than 100 combined service outages. Cloud disruption has become a recurring operational reality, not an exceptional event. This validates years of regulatory warnings about cybersecurity and concentration risk.

Regulatory Considerations

Financial regulators have evolved from cloud skepticism to accommodation:

DORA: The EU's Digital Operational Resilience Act

DORA became enforceable across approximately 22,000 EU financial entities on January 17, 2025. It codifies third-party ICT risk management requirements that go beyond anything previously mandated:

• Financial entities must maintain a register of all ICT third-party arrangements
• Conduct thorough risk assessments of critical ICT third-party service providers
• Ensure contractual provisions for exit strategies and substitutability
• Participate in threat-led penetration testing at least every three years on live production systems

In November 2025, the European Supervisory Authorities published their first list of 19 designated Critical ICT Third-Party Service Providers. These providers face direct oversight by European regulators.

Concentration risk remains a key regulatory concern. If 80% of global banking runs on AWS and AWS has a major outage, it becomes a systemic financial stability issue. Regulators push for multi-cloud strategies and rigorous vendor continuity planning.

Real-World Financial Cloud Applications

• Real-time payments: Cloud elasticity handles payment volume spikes (Black Friday, stimulus checks)
• Fraud detection AI: Machine learning models retrained continuously with new fraud data
• Open banking APIs: Cloud infrastructure for API management at scale
• Regulatory reporting: Process vast regulatory data sets faster and more cheaply
• Risk analytics: Run complex portfolio simulations in minutes instead of hours
• Customer analytics: Personalized offers and recommendations at scale
• Agentic AI: Banks deploying AI agents for customer service, fraud prevention, and advisory functions on cloud infrastructure

Key Points to Remember

• Cloud computing lets financial firms rent computing infrastructure instead of owning data centers, reducing costs and enabling faster innovation.
• AWS, Microsoft Azure, and Google Cloud are the dominant providers. Most major banks use multiple cloud providers.
• 98.3% of financial institutions now use some form of cloud computing. Only 1.7% remain entirely on-premises.
• Fintech and digital banks are 100% cloud-native. Traditional banks are in a multi-year hybrid transition.
• Security in the cloud is a shared responsibility. Cloud providers secure the infrastructure while banks secure their data and applications.
• Regulatory focus is on concentration risk and operational resilience, not prohibiting cloud use.
• DORA (enforceable since January 2025) imposes strict third-party ICT risk management requirements on EU financial entities.
• Cloud outages are a recurring reality, with 100+ combined outages across AWS, Azure, and Google Cloud between August 2024 and August 2025.

Common Mistakes to Avoid

• Assuming cloud is automatically secure: The shared responsibility model means the bank is still responsible for configuring access controls, encryption, and application security. A poorly configured cloud deployment is less secure than a traditional data center.
• Ignoring concentration risk: Running all critical systems on a single cloud provider creates a single point of failure. Multi-cloud strategies add complexity but reduce systemic risk.
• Lift-and-shift without rearchitecting: Moving monolithic applications to the cloud without redesigning them preserves technical debt and limits the benefits of cloud elasticity. Banks that simply "lift and shift" often pay more, not less, in cloud costs.
• Underestimating migration timelines for core systems: Core banking systems running on decades-old COBOL cannot be migrated quickly. Budget years, not months, and plan for extensive testing.
• Neglecting DORA compliance for EU operations: Any financial entity operating in the EU must comply with DORA's third-party ICT risk requirements. Non-compliance can result in regulatory penalties and operational restrictions.

Related Concepts

• API Banking: Cloud infrastructure enables open banking APIs at scale
• AI in Finance: Cloud providers offer the computing power and tools for AI deployment
• Fintech: Cloud-native startups disrupting traditional financial services
• Cybersecurity in Finance: The shared responsibility model for cloud security
• Distributed Ledger: Blockchain technology that often runs on cloud infrastructure

For more on how technology is changing finance, read our guide on crypto as an investment or explore how AI is transforming financial services.

Frequently Asked Questions

Q: Is my banking data less secure in the cloud? A: Not necessarily. Often it is more secure. Cloud providers invest billions in security infrastructure and have thousands of dedicated security engineers. The risk is in how a bank configures and manages its cloud environment, not the cloud itself. A poorly configured cloud deployment is less secure. A well-configured one is typically more secure than a traditional data center.

Q: What happens to my account if a cloud provider has an outage? A: Major cloud providers build redundancy across multiple geographic regions. Banks also maintain failover systems. However, cloud outages have become more frequent. Between August 2024 and August 2025, AWS, Azure, and Google Cloud experienced over 100 combined outages. Banks are required by regulators to have business continuity plans that address cloud provider failures, but the CrowdStrike incident and 2025 outages showed that real-world disruptions still occur.

Q: Can a small bank afford cloud computing? A: Yes. Cloud's pricing model actually benefits smaller institutions most. Instead of spending $20M on a data center, a community bank can run core cloud services for a fraction of that. SaaS core banking platforms like Mambu are specifically designed for smaller institutions.

Q: Will all banks eventually be fully on the cloud? A: The trend points that way. 19% of financial institutions are already fully cloud-based as of 2026. The timeline depends on legacy system complexity. Some banks have core systems that are decades old and extremely difficult to migrate. New entrants are cloud-native by default. The DTCC, which processes trillions in transactions, is targeting 2030 for its cloud migration completion.