Financial institutions have become deeply dependent on a small group of global technology providers, creating new operational and geopolitical risks that could threaten financial stability. Regulators warn that banks must better understand their technolog
The rapid shift toward cloud
computing and outsourced digital services has transformed how financial
institutions operate, but it has also created new systemic vulnerabilities that
regulators say the industry must urgently address.
According to André de Groot, Policy
Advisor, De Nederlandsche Bank, the financial sector has undergone a profound
technological evolution over the past few decades, moving from tightly
controlled in house infrastructure toward global digital ecosystems dominated
by a handful of large technology providers.
“Over the years, more and more
financial institutions started to rely on big techs,” de Groot said. “Old risks
related to outsourcing were still there, and new risks emerged.”
Historically, banks operated highly
centralized technology systems inside their own buildings. Core systems ran on
mainframes that were physically located within bank premises, supported by
backup generators and local data storage.
Operational resilience was achieved
through direct control of infrastructure and manual processes such as
physically transporting backup tapes to offsite locations.
However, technological developments
during the early internet era fundamentally reshaped that model.
Advances in communication networks
and the emergence of the World Wide Web enabled software to be delivered
remotely, paving the way for cloud computing and software delivered as a
service.
Major technology firms quickly moved
into the market, offering scalable computing infrastructure and digital
platforms that financial institutions increasingly adopted for both operational
efficiency and innovation.
“What happened after that is that
these companies were becoming bigger and bigger, taking a growing share of
services supporting financial institutions,” de Groot, said.
Initially these services supported
noncritical functions. Over time, however, they expanded into core banking
operations and critical processes, increasing the industry’s dependence on a
small number of global technology providers.
This growing reliance has revived
traditional outsourcing risks while introducing entirely new challenges.
Cybersecurity threats have expanded significantly as financial institutions
connect their systems to global digital networks.
Another concern is concentration
risk. A small group of technology providers now supports large portions of the
financial system’s digital infrastructure, meaning disruptions at a single
provider could have widespread consequences.
“Especially in the era of cloud
computing, you see that concentration becomes much more a risk to be taken into
consideration,” de Groot said.
Regulators are also increasingly
focused on the complexity of modern technology supply chains. Financial
institutions often outsource services to a primary vendor, which in turn relies
on multiple subcontractors and third party providers.
