What cloud computing is and why financial institutions use it

A definition that is widely used

The United States National Institute of Standards and Technology, NIST, published a short definition in 2011 that is still widely referred to. It describes cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources, such as networks, servers, storage, applications and services, that can be rapidly provisioned and released with minimal management effort or service provider interaction. NIST lists five essential characteristics:

• On-demand self-service: the customer can obtain computing capacity, such as server time and storage, by itself as needed, without human interaction with the provider.
• Broad network access: the capabilities are reached over the network through standard mechanisms, from phones, tablets, laptops and workstations.
• Resource pooling: the provider's resources serve many customers at once, assigned and reassigned according to demand. The customer generally has no control or knowledge over the exact location of the resources, but may be able to specify location at a higher level, such as a country or a data centre.
• Rapid elasticity: capacity can be added and released quickly, in some cases automatically, in line with demand.
• Measured service: use is metered, so it can be monitored, controlled and reported to both the provider and the customer.

The point about location matters for financial institutions. Lesson 4 of this course returns to where data sits and who can reach it.

Three service models and four deployment models

NIST distinguishes three service models by how much the customer controls. In software as a service, the customer uses the provider's applications and does not manage the infrastructure, operating systems or even the application's capabilities, apart from limited user settings. In platform as a service, the customer deploys its own applications on the provider's platform and controls those applications, but not the servers, operating systems or storage beneath them. In infrastructure as a service, the customer obtains processing, storage and networks, and controls the operating systems and applications it runs on them, but not the underlying cloud infrastructure.

NIST also names four deployment models. A private cloud is for the exclusive use of one organisation, and may be run by that organisation or a third party, on or off its premises. A community cloud is for the exclusive use of a group of organisations with shared concerns. A public cloud is open to the general public and sits on the provider's premises. A hybrid cloud combines two or more of these, bound together so that data and applications can move between them.

Why financial institutions move to the cloud

The Financial Stability Board, in its 2019 report on third-party dependencies in cloud services, notes that cloud services may lower the barriers to entry and reduce costs in financial services, and that providers' economies of scale may result in lower costs to clients. It also points to resilience: large providers can offer redundancy, geographic diversity, the removal of single points of failure and advanced incident response, and the report describes these features as far beyond what most financial institutions can achieve using in-house IT. It adds a caveat: moving to the public cloud does not, on its own, make an institution more resilient, and it cites survey evidence that misconfiguration of cloud infrastructure has led to security and compliance incidents.

Paying for capacity: cost = peak capacity × days × price per unit-day. Paying for use: cost = the sum of each day's use × price per unit-day.

Example, with illustrative numbers: a lender's application system needs 100 units of computing capacity on 5 busy days a month and 30 units on the other 25 days. Owning enough for the peak means paying for 100 units every day, that is 3,000 unit-days a month. Paying for use means 500 unit-days on the busy days and 750 on the others, 1,250 in all. Even if each unit-day in the cloud costs one and a half times as much, the bill is 1,875 against 3,000. The example leaves out the cost of moving systems and of overseeing the provider, which lessons 3 and 5 take up.

What does not move: responsibility

The Financial Stability Board is explicit that the use of cloud services does not reduce the responsibility of financial institutions: they remain responsible for complying with all relevant legal requirements, and the associated risks and liabilities remain with them. The Basel Committee's 2025 principles for the sound management of third-party risk start from the same place. Principle 1 says the board of directors has ultimate responsibility for the oversight of the bank's third-party risks, and the principles add that where an arrangement involves shared responsibility between the bank and the provider, that does not take away the board's ultimate responsibility.

Lesson 2 of this course looks at how control is divided between the institution and the provider in each service model, and lesson 3 at how supervisors treat cloud as a form of outsourcing.

Many institutions, few providers

The Financial Stability Board observes that a small number of providers dominate the market for public cloud services, and that financial institutions rely to a large extent on the same small subset of them. It notes that institutions and authorities may not know how widely these providers are used in common, and that the failure of a key third-party provider could in theory trigger financial instability. A 2023 paper by the Financial Stability Institute of the Bank for International Settlements reports that three providers dominate the global cloud market, with almost two-thirds of it, and that the critical workloads financial institutions have moved to the cloud appear to have increased significantly, although they remain at a relatively low level.

Each institution sees only its own contracts; the concentration is visible only across the system. Lesson 5 of this course covers what institutions and supervisors do about it. How each market in the region treats outsourcing and technology risk differs, and the rules pages set out what applies in each.