A bank can change its technology strategy, renegotiate a supplier contract or decide that a competing platform offers better capabilities, but acting on those decisions is becoming increasingly difficult. Critical banking operations are now closely connected to external cloud infrastructure, core banking systems, payment processors, cybersecurity platforms and artificial intelligence services, many of which have become deeply embedded in the institution’s technology architecture and everyday workflows. While these partnerships have enabled banks to modernise faster, reduce infrastructure costs and access specialist capabilities, they have also created dependencies that can take years and considerable investment to unwind. Moving away from an established provider may require rebuilding integrations, migrating sensitive data, redesigning operational processes and conducting extensive testing to ensure essential services remain uninterrupted. The concern is no longer simply whether a technology supplier can deliver reliable services, but whether a financial institution retains the practical ability to operate without that supplier if commercial circumstances, technology requirements or operational conditions change. As banks deepen their reliance on a relatively small number of critical technology providers, the ability to replace a supplier may become just as important as the decision to appoint one.
Outsourcing Has Changed the Nature of Banking Dependence
The relationship between banks and technology suppliers has evolved considerably from the traditional outsourcing arrangements that primarily involved software maintenance, infrastructure support or specific administrative functions. Modern financial institutions increasingly rely on external providers for capabilities that sit much closer to the centre of their operations, including transaction processing, customer authentication, data storage, fraud detection, digital banking applications and the infrastructure supporting critical business services.
This development has delivered substantial benefits because specialist technology companies can invest in infrastructure, engineering expertise and security capabilities at a scale that would be difficult for individual banks to replicate. Cloud platforms provide computing capacity without requiring banks to maintain equivalent physical infrastructure, while specialised banking software vendors offer functionality that can be deployed across multiple institutions and continuously improved through product development.
However, the economics of outsourcing change when an external provider becomes inseparable from the way a bank operates. A software supplier that originally delivered a particular application may gradually become responsible for integrations, data structures, workflows and operational processes that connect several parts of the institution. Over time, the bank’s dependence extends beyond the original product because employees, internal systems and customer services have been organised around the technology.
The resulting relationship is not necessarily problematic while the service performs reliably, but it can create difficulties when the bank needs to renegotiate commercial terms, introduce alternative technology, respond to regulatory requirements or recover from a significant provider failure. The ability to select a supplier at the beginning of a contract does not guarantee that the institution will retain a practical ability to replace that supplier later.
The Difference Between Having an Exit Plan and Being Able to Exit
Most established banks have formal processes for assessing technology suppliers, negotiating contractual protections and developing contingency arrangements for important outsourced services. These measures are necessary, but they do not always demonstrate that a critical provider can be replaced within a timeframe that would protect customers and maintain essential operations.
Consider a financial institution that has built several customer-facing applications around a particular cloud platform. Its systems may depend on that provider’s databases, identity services, monitoring tools, development environments and proprietary infrastructure capabilities. Although alternative cloud platforms exist, moving applications between them may require substantial redesign, extensive testing and changes to security and operational controls.
The challenge can be even greater for core banking and payment processing systems because these platforms are closely connected to financial records, transaction histories, product configurations and regulatory reporting. Replacing such infrastructure involves more than transferring software or copying data, since the bank must ensure that balances, transactions, customer entitlements and operational processes continue functioning accurately throughout the transition.
This creates a distinction between contractual exit rights and operational substitutability. A bank may have the legal right to terminate a service agreement, access its data and receive transition assistance, yet still face considerable practical barriers to moving its operations elsewhere. The existence of an alternative vendor does not necessarily mean that the alternative can absorb the workload quickly or reproduce the required functionality without significant modification.
For technology risk management, this suggests that the quality of an exit strategy should be judged by its feasibility rather than the completeness of its documentation. Banks need to understand how long replacement would realistically take, which services would be affected during migration and whether alternative arrangements could operate under stressed conditions rather than only during a carefully planned transition.
Cloud Concentration Is Becoming a Financial System Concern
Cloud computing illustrates how individual outsourcing decisions can collectively create concentration risk across the financial system. Each bank may independently conclude that a major cloud provider offers the most suitable combination of security, resilience, scalability and commercial value, but when many institutions make similar decisions, a relatively small number of companies can become responsible for infrastructure supporting a substantial share of financial activity.
The Financial Stability Board (FSB) has identified third-party dependencies and service-provider concentration as important issues for financial stability, particularly where disruptions could affect multiple financial institutions simultaneously. Its 2023 report on enhancing third-party risk management and oversight highlighted the challenges associated with critical service providers, including limited substitutability, complex supply chains and the potential for systemic consequences when services are widely shared.
This creates a problem that cannot be fully addressed through the risk management processes of individual banks. An institution may have strong internal controls and well-tested disaster recovery arrangements, yet still depend on infrastructure that is also used by numerous other financial organisations. If a major provider experiences a widespread disruption, several banks may be affected simultaneously, while their attempts to recover or transfer workloads could compete for the same limited technical resources.
Cloud resilience also needs to be distinguished from provider independence. Deploying applications across multiple availability zones or geographic regions can protect against certain infrastructure failures, but those arrangements may remain dependent on the same provider’s control systems, operational processes and underlying technologies. A bank can therefore achieve substantial resilience against localised outages while retaining exposure to failures affecting the provider more broadly.
Multi-cloud strategies can reduce some forms of concentration, although they introduce additional complexity, cost and operational requirements. Maintaining applications across different providers is not necessarily practical for every banking workload, particularly when services depend on proprietary technologies or require specialised engineering expertise. The objective should therefore be to understand where concentration creates unacceptable exposure and develop proportionate alternatives rather than assuming that every application must operate identically across several cloud environments.
The Next Dependency May Be Artificial Intelligence
The expansion of artificial intelligence into banking introduces a new form of third-party dependence that could prove more difficult to manage than conventional software outsourcing. Banks are beginning to integrate external AI models, cloud-based inference services, data platforms and agent-development frameworks into activities ranging from customer service and document processing to software engineering, compliance support and operational decision-making. While these technologies can be adopted relatively quickly, their integration into banking workflows may create dependencies that become increasingly difficult to reverse as models are customised, employees adapt their processes and automated systems gain access to additional applications.
Unlike traditional software, where an application performs relatively defined functions, AI systems can influence how information is interpreted and how decisions are generated. A bank that builds customer service automation around a particular model provider may develop prompts, evaluation procedures, retrieval systems, monitoring controls and workflow integrations specifically suited to that provider’s capabilities. Moving to another model may therefore require more than replacing an API endpoint, particularly where changes in model behaviour affect accuracy, compliance controls or customer outcomes.
The risk becomes more significant as AI agents move beyond generating information and begin executing tasks across banking systems. An institution may depend on one provider for the underlying model, another for cloud infrastructure and several others for data access, identity management and workflow orchestration. Even if each supplier is individually well managed, the bank must understand how their services interact and whether the failure of one component could interrupt a wider operational process.
There is also a commercial dimension. Providers can change pricing structures, discontinue model versions, modify product capabilities or alter the terms under which particular services are available. These changes do not necessarily create an immediate operational crisis, but they can force banks to undertake expensive redevelopment or revalidation work when systems have been designed around a specific technology.
For banks, the challenge is to retain sufficient control over the architecture, data and evaluation processes supporting AI applications. Model portability, independent testing, clear ownership of business rules and the ability to substitute components may become increasingly important as AI moves from experimentation into critical banking operations.
Regulators Are Beginning to Look Beyond Individual Banks
The regulatory response to technology concentration is becoming more explicit because traditional outsourcing supervision does not fully address the risks created when multiple financial institutions depend on the same external infrastructure.
The European Union’s Digital Operational Resilience Act (DORA) represents an important development in this area. In November 2025, the European Supervisory Authorities published their first list of designated critical ICT third-party service providers, following an assessment that considered their systemic importance, the financial functions they support and the substitutability of their services. The framework recognises that some technology providers are sufficiently important to financial-sector operations that oversight cannot rely exclusively on individual banks supervising their own supplier relationships.
The Financial Stability Board has taken a similarly broad approach through its toolkit for enhancing third-party risk management and oversight. Published in December 2023, the toolkit addresses how financial institutions can identify critical services, manage third-party risks throughout the relationship and help authorities understand potentially systemic dependencies across the financial sector. Its significance lies in recognising that a provider relationship may be manageable from the perspective of an individual institution while still contributing to a concentration of risk across multiple institutions.
The Basel Committee’s operational resilience principles also emphasise the importance of mapping critical operations and their dependencies, maintaining appropriate contingency arrangements and assessing whether important third-party services can realistically be substituted. These expectations reinforce the distinction between conventional vendor oversight and understanding how an institution would continue delivering essential services during a severe disruption.
The direction of regulation suggests that technology providers supporting critical financial services will face greater expectations around transparency, resilience, incident management and cooperation with supervisory authorities. For banks, it also means that the selection of technology partners is becoming a matter of long-term operational strategy rather than simply procurement efficiency.
Technology Providers May Gain More Commercial Power as Switching Becomes Harder
A less discussed consequence of technology dependence is its potential effect on the commercial relationship between banks and their suppliers. Financial institutions are traditionally substantial technology buyers, with procurement teams, legal departments and risk specialists responsible for negotiating complex agreements. However, their bargaining position can weaken when a provider becomes deeply embedded in essential operations and replacing it would require considerable expenditure or operational disruption.
This dependence can influence renewal negotiations, product roadmaps and the ability to adopt competing technologies. A bank may be dissatisfied with pricing or service performance but conclude that switching would create greater short-term risk than continuing the relationship. Over time, the commercial value of a technology provider can therefore derive not only from the quality of its products but also from the difficulty customers face in moving away.
Proprietary interfaces, data formats and platform-specific development tools can intensify this problem, although vendor lock-in is not always the result of deliberate restrictions. Banks themselves may create switching barriers by building highly customised processes around a particular product or by failing to maintain the documentation and internal expertise needed to migrate services independently.
This creates an opportunity for technology providers that can demonstrate portability and interoperability as part of their commercial proposition. Open interfaces, accessible data formats, migration support and clear contractual exit arrangements can help reduce customer concerns about long-term dependence, particularly when banks are making investments expected to remain in place for many years.
For smaller banking technology vendors, the shift could create both challenges and opportunities. Large providers may benefit from their scale and established relationships, but specialist suppliers that offer modular solutions and lower switching barriers could appeal to banks seeking to avoid further concentration. The ability to integrate with existing infrastructure without becoming an unavoidable dependency may become an increasingly valuable competitive advantage.
Resilience Requires More Than a Backup Supplier
The obvious response to excessive dependence is diversification, but maintaining several technology providers does not automatically guarantee operational resilience. A bank may have contracts with multiple cloud companies while operating critical applications almost entirely on one platform, or it may use several payment service providers that ultimately depend on the same underlying infrastructure.
True diversification requires understanding whether alternative arrangements can actually support the relevant business service when the primary provider is unavailable. This involves technical compatibility, data availability, operational capacity, regulatory requirements and the ability of employees to activate contingency arrangements under pressure.
In some cases, a backup arrangement may be sufficient to maintain essential functionality without reproducing every capability of the primary platform. A bank could prioritise the continued availability of critical transactions and customer services during a disruption, accepting temporary reductions in less essential functionality. This may be more practical than attempting to duplicate every application across several providers.
The financial implications also need to be considered because maintaining fully independent infrastructure can be expensive. Banks must balance the cost of redundancy against the consequences of disruption, recognising that different services have different levels of criticality and different tolerances for interruption.
This is why operational substitutability should become an explicit consideration when designing banking technology architecture. Rather than treating exit planning as a contractual requirement completed after selecting a vendor, institutions may need to consider replacement options before committing to technologies that will support essential operations for many years.
The Real Competitive Advantage May Be Retaining Control
Banking technology partnerships will remain essential because financial institutions cannot realistically develop and operate every specialised capability internally. External providers offer expertise, infrastructure and innovation that would be difficult and expensive to replicate, while shared technology platforms can improve reliability and accelerate the introduction of new financial services.
The challenge is ensuring that the benefits of outsourcing do not gradually erode a bank’s ability to control its own operations. That control does not necessarily require ownership of the underlying technology, but it does require visibility into dependencies, access to critical data, sufficient internal technical expertise and credible options for maintaining essential services when supplier arrangements change.
Banks that preserve architectural flexibility may be better positioned to adopt new technologies, negotiate commercial arrangements and respond to operational disruptions without undertaking extensive redevelopment. Conversely, institutions that allow critical processes to become inseparable from particular suppliers may find that their ability to innovate becomes constrained by the very partnerships originally intended to accelerate modernisation.
The growing importance of AI makes this distinction particularly relevant because banks are now making technology decisions that could shape their operating models for years. Choices involving model providers, cloud platforms, data infrastructure and agent orchestration may determine not only what capabilities institutions can deploy, but also how easily those capabilities can be modified or replaced.
For banking executives, the strategic question is no longer simply whether an external provider can deliver a service more efficiently than the bank itself. It is whether the institution can retain sufficient independence to manage that service, adapt it and recover from its failure without placing essential operations at unacceptable risk.
As financial services become more dependent on external technology, the ability to change providers without disrupting the bank may become one of the most valuable capabilities a financial institution can preserve.
What this means for the industry
- Third-party risk management must extend beyond supplier assessments. Banks need to understand how external technologies support critical operations and whether those services can realistically be replaced during a disruption.
- Operational substitutability is becoming a strategic requirement. Contractual exit rights are insufficient when migration involves complex dependencies, extensive testing and prolonged implementation timelines.
- Cloud concentration requires a broader perspective. Resilience across multiple regions or availability zones does not necessarily eliminate dependence on a single technology provider.
- AI introduces new forms of vendor lock-in. Model-specific development, workflow integration and automated decision-making can make switching AI providers more complicated than replacing conventional software.
- Technology architecture can influence commercial negotiating power. Banks with portable data, reusable services and well-documented integrations may have greater flexibility when negotiating with suppliers.
- Regulators are paying closer attention to systemic technology dependencies. Frameworks such as DORA and international supervisory guidance are increasing scrutiny of providers supporting critical financial services.
- Technology vendors have an opportunity to compete on portability and resilience. Interoperability, transparent service arrangements and credible migration support could become important differentiators alongside functionality and cost.
