How is cloud computing used in banking?

Cloud computing in banking is the use of computing, storage, databases or software delivered as a service over a network. A bank can rent infrastructure, a managed platform or a complete application. The provider operates part of the stack, while the bank remains responsible for its regulated service, customer data and risk decisions.

Infrastructure as a service leaves operating systems and applications with the bank. Platform services also manage databases or runtimes. Software as a service delivers the application itself. Identity, encryption, logging, backups and network controls cut across all three models. The contract must state who operates each control, because the phrase shared responsibility does not allocate a specific task by itself.

Banks use cloud capacity for analytics, development, customer channels, fraud detection and some core workloads. Elastic capacity fits peaks in payment or market-data processing, and managed services shorten provisioning. Cloud banking software features can create measurable benefits, but security and integration challenges remain. Moving an unchanged legacy application to rented servers may change the hosting bill without improving release speed, resilience or data quality.

Concentration, outages, privileged access and the ability to switch provider are the main bank concerns. Encryption protects stored and transmitted data, but keys, administrators and logs still require a control model. A bank also needs tested exports, replacement capacity and a sequence for restoring dependent services. The exit plan is part of the design, not a document written when the contract ends.

DORA governs ICT third-party risk for EU financial entities. Contracts need service descriptions, locations, security, incident support, audit rights and termination provisions, with extra clauses for critical or important functions. The ECB's cloud outsourcing guide explains supervisory expectations for significant banks. GDPR controls personal-data processing and transfers separately.

German banks report to BaFin or the ECB, Austrian institutions to the FMA and Swiss banks to FINMA. Switzerland is outside DORA but applies its own outsourcing and operational-risk rules. Frankfurt hosts the ECB and several large bank technology operations. The location of a data center matters, yet supervision also asks who can access the service and whether the bank can continue or exit after a disruption.