The question regulators are now asking European banks is not whether they use the cloud. It is whether they could leave it tomorrow without causing a financial incident. That shift from documentation to demonstration is the defining feature of cloud oversight in 2026, and the compliance bill is rising fast.
Market Snapshot
What changed: The multi-cloud conversation has moved from architecture teams to boardrooms, driven by one regulation and one list. DORA is now in its first full year of application, and the European Supervisory Authorities have moved from policy building into oversight execution after publishing the first Union-level list of designated Critical ICT Third-Party Providers on November 18, 2025, including AWS, Microsoft, and Google Cloud. These are no longer voluntary frameworks.
DORA takes aim specifically at systemic risk from ICT third-party concentration, and it allows EU supervisors to run an oversight framework for designated critical ICT third-party providers that serve financial entities. For designated critical ICT third-party providers, continued non-compliance can trigger periodic penalty payments of up to 1% of average daily worldwide turnover, charged per day.
Stocks in Focus
The designated provider list reads like a who’s who of enterprise technology. The 19 named firms include Accenture, Amazon Web Services, Bloomberg, Capgemini, Colt Technology Services, Deutsche Telekom, Equinix, FIS, Google Cloud, IBM, Interxion, Kyndryl, LSEG Data & Analytics, Microsoft, NTT Data, Oracle, Orange, SAP, and Tata Consultancy Services. Each now sits inside the EU’s critical-provider oversight perimeter. Every bank that relies on them must be able to evidence that reliance, map subcontractors, and show it can transition services without operational disruption.
Sector Watch
The real cost is not regulatory fines. It is architecture. Exiting cloud service provider contracts is time-consuming and costly when in-house capability is limited, and the risk is that firms become effectively locked into arrangements that function as single points of failure.
The exit strategy requirement catches many fintech leaders off guard. Regulators are not asking for a theoretical plan. They want evidence that firms can switch providers without operational disruption. That means payment processing, real-time settlement, and core banking functions all need tested migration paths, not slide decks.
What’s changed in practice is that firms are being pushed to show portability and resilience for any material cloud relationship: clear contractual rights, documented and workable exit steps, and testing proportionate to the criticality of the function. For the most systemic-risk-sensitive functions, supervisors are increasingly skeptical of single-provider dependency, even where the formal requirement is “exit and continuity evidence” rather than an explicit two-cloud mandate.
Catalyst Calendar
DORA became applicable on January 17, 2025. Eighteen months later, the posture is more interventionist. Regulators are examining firms for compliance evidence, not just remediation plans, and designated critical ICT third-party providers are now under an EU-level oversight framework that can include information requests, investigations, and inspections.
The UK is moving in parallel. The PRA’s supervisory statement on outsourcing and third party risk management applies to cloud services used for material business services, with expectations around governance, notification for certain arrangements, exit planning, and data portability to reduce lock-in risk.
The Cheat Sheet
- Top Theme: Cloud concentration risk is no longer a theoretical concern. It is an active supervisory priority with named providers, inspections, and daily penalty-payment exposure for designated critical ICT third-party providers.
- Stock to Watch: AWS, Microsoft Azure, and Google Cloud carry the heaviest scrutiny. Banks with concentrated workloads on any single one of the three face the most immediate compliance pressure.
- Sector to Watch: Payment processors and settlement infrastructure. These functions concentrate operational risk, and they are the ones supervisors tend to probe hardest on continuity and exit feasibility.
- Biggest Risk: Many institutions choose multi-cloud because it sounds resilient. In practice, it often means two poorly governed environments instead of one well-governed one. Firms that rushed to split workloads without tested exit procedures may fail inspections even after spending heavily on compliance.
- One Thing to Remember: Regulators are checking for evidence, not intentions. A documented exit strategy that has never been tested is a liability, not a defense.
