For decades, legacy technology has dominated conversations about banking transformation. Boards have approved billion-dollar modernisation programmes, CIOs have prioritised cloud migration, and technology teams have worked relentlessly to replace ageing infrastructure with faster, more flexible digital platforms. While these initiatives remain important, they risk distracting the industry from a more immediate threat that is developing beneath the surface. As banks consolidate around a relatively small group of cloud providers, software vendors, cybersecurity platforms and AI companies, they are creating a new form of operational risk. The greatest technology challenge facing banks may no longer be the systems they own, but the external technology ecosystem they increasingly depend upon.
From Legacy Risk to Concentration Risk
For years, the assumption has been simple: modern technology reduces risk. Migrating away from ageing infrastructure improves resilience, lowers operating costs and accelerates innovation. In many respects, that assumption has proven correct. Today’s banks are significantly more agile than they were a decade ago, with cloud-native applications, API-driven architectures and digital platforms replacing many of the rigid systems that once constrained innovation.
However, digital transformation has also reshaped the industry’s dependency model. Instead of relying primarily on internally managed technology, banks now depend on an extensive network of third-party providers that deliver everything from cloud infrastructure and payment processing to cybersecurity, identity verification, fraud detection and artificial intelligence capabilities. Many of these providers have become deeply embedded in day-to-day banking operations, often supporting services that customers use every minute of every day.
At the same time, competition within the technology sector has narrowed. Market leaders continue to acquire specialist firms, while banks increasingly standardise on proven platforms to simplify procurement, integration and support. Although this approach delivers operational efficiency, it also means that institutions which appear independent on the surface are often relying on exactly the same technology providers behind the scenes.
This concentration creates a different category of operational exposure. A disruption affecting one strategic vendor can simultaneously impact hundreds of financial institutions, regardless of how well those individual banks have managed their own internal systems. As many institutions are discovering, simplifying internal systems is only part of the challenge. Managing the growing complexity created by interconnected technology providers has become equally important.
A Single Failure Can Become an Industry-Wide Event
Recent years have demonstrated how quickly third-party failures can ripple across industries. Global cloud outages have interrupted online banking services, payment processors have temporarily halted millions of transactions, software supply chain attacks have compromised thousands of downstream organisations, and vulnerabilities discovered in widely used open-source components have forced emergency patching programmes across the financial sector.
These incidents share one common characteristic: the affected organisations often did nothing wrong themselves. Their exposure resulted from their dependence on a shared provider or shared software component rather than weaknesses within their own infrastructure.
This represents a fundamental shift in technology risk. Traditionally, operational failures were largely isolated to individual institutions. Today, a single incident affecting a major cloud platform, identity service, software supplier or cybersecurity vendor has the potential to create simultaneous disruption across an entire banking market.
As banks become more interconnected through shared technology ecosystems, operational resilience becomes less about preventing internal failures and more about understanding external dependencies. The challenge is no longer simply protecting individual systems. It is understanding how concentrated the wider technology landscape has become.
Artificial Intelligence Is Accelerating Vendor Dependency
Artificial intelligence has quickly become the latest priority for financial institutions, with banks investing heavily in customer service automation, fraud detection, software development assistants, document processing and personalised financial advice. Yet much of this innovation is being built on top of the same small group of AI infrastructure providers, foundation models and hyperscale cloud platforms.
Rather than developing proprietary AI capabilities from the ground up, many organisations are integrating commercially available large language models into existing banking workflows. This approach significantly reduces development time and allows banks to deploy sophisticated AI services far more quickly than would otherwise be possible.
The trade-off, however, is growing dependency on external providers whose platforms increasingly underpin critical business functions. If one of these providers experiences a prolonged outage, introduces restrictive commercial changes, becomes subject to new regulatory requirements or suffers a significant cybersecurity incident, the operational impact could extend across hundreds of financial institutions simultaneously.
The concentration risk that previously existed within cloud infrastructure is now beginning to emerge within artificial intelligence itself. As more banks build their future operating models around the same AI ecosystems, technology resilience will increasingly depend on maintaining flexibility rather than simply adopting the latest capabilities. Success will depend not only on deploying AI quickly but also on making technology decisions that preserve long-term resilience.
Operational Resilience Now Requires Strategic Diversity
Cloud adoption has unquestionably improved the reliability of banking technology. Modern cloud platforms offer levels of scalability, redundancy and disaster recovery that traditional on-premise environments could rarely achieve. For most institutions, cloud migration has strengthened operational resilience rather than weakened it.
However, resilience should not be confused with diversification. A bank may operate highly resilient workloads across multiple cloud regions while remaining entirely dependent on a single provider. Redundant infrastructure protects against equipment failures and local outages, but it does not eliminate exposure to provider-wide disruptions, supply chain compromises or strategic changes that affect the entire platform.
The same principle applies across the wider technology landscape. Standardising on a single cybersecurity platform, a single payment processor or a single AI provider may reduce operational complexity, but it can also increase concentration risk. What appears efficient from an IT management perspective may create significant strategic exposure when viewed through the lens of enterprise resilience.
Leading institutions are therefore beginning to rethink resilience beyond traditional disaster recovery. Increasing attention is being given to portability, interoperability and exit planning. Questions that once appeared theoretical are becoming increasingly practical. How easily can critical applications move to another provider? How quickly can AI models be replaced? How dependent are essential customer services on one external technology partner? These considerations are rapidly becoming part of long-term technology strategy rather than contingency planning.
The Boardroom Conversation Is Changing
Regulators around the world have also recognised that concentration risk extends beyond individual institutions. Operational resilience frameworks increasingly require banks to identify critical third-party providers, assess the potential impact of external disruptions and demonstrate that essential banking services can continue during periods of significant technology failure.
For boards, this changes the nature of technology governance. Vendor selection can no longer focus solely on functionality, implementation speed or commercial pricing. Directors are increasingly expected to understand how external dependencies could affect operational continuity, customer confidence and financial stability.
This broader perspective also requires stronger collaboration between procurement teams, technology leaders, cybersecurity specialists and enterprise risk functions. Managing vendor concentration is no longer a procurement exercise. It has become a core component of strategic risk management.
The institutions that perform best over the coming decade are unlikely to be those with the largest technology budgets alone. They will be the banks that combine innovation with flexibility, ensuring that no single provider becomes indispensable to their long-term resilience.
Conclusion
Legacy technology has not disappeared as a banking challenge, but it is becoming increasingly manageable through modernisation programmes that are now well understood across the industry. Vendor concentration, by contrast, is a newer and more complex threat that has emerged as an unintended consequence of digital transformation itself. As banks continue consolidating around a relatively small number of cloud providers, software vendors and AI platforms, operational resilience will depend less on replacing old systems and more on reducing excessive dependence on any single technology ecosystem. The next major disruption in banking may not originate from outdated infrastructure. It may begin with a single supplier that hundreds of institutions unknowingly rely upon.
What it means for the industry
- Banks should assess vendor concentration risk with the same priority as cybersecurity and operational resilience.
- AI adoption strategies should avoid excessive dependence on a single model or infrastructure provider.
- Technology procurement should evaluate portability and exit strategies alongside functionality and cost.
- Boards should receive regular reporting on critical third-party dependencies and systemic technology exposure.
- Regulators are expected to place greater scrutiny on systemically important technology providers supporting the financial sector.
- Long-term competitive advantage will come from balancing innovation with architectural diversity and strategic flexibility.
Image Source: Pexels.com
