Lecture series
Cloud for financial services: rules and responsibilities
What cloud computing is, why banks and other lenders use it, and who answers for what once they do: how control is shared with the provider, how supervisors treat cloud as outsourcing, what happens to data and to the supervisor's access, and how to plan for concentration and exit. Five lessons, from the definition to resilience.
5 of 5 lessons published. Lesson 1 is free to read.
Listen to this course
Now playing
Press play to start
- 01What cloud computing is and why financial institutions use itBanks and other lenders increasingly run their systems on computing resources owned and operated by someone else. This lesson sets out the standard definition of cloud computing, its service and deployment models, why financial institutions adopt it, and the two things that do not change when they do: who is responsible, and how few providers there are.
- 02Shared responsibility: who controls what in each service modelIn the cloud, a provider runs some of the layers of a system and the financial institution runs the rest. Where the line falls depends on the service model. This lesson shows who controls which layer, what that means for security, why misconfiguration is the institution's risk, and how the split is written down and checked.
- 03Cloud as outsourcing: criticality, due diligence, contracts and the supervisorSupervisors treat a cloud service as one form of reliance on a third party, and apply the same disciplines: decide how critical the service is, check the provider before signing, write the essential rights into the contract, and keep the supervisor informed. This lesson follows those steps using the Basel Committee's 2025 principles and the European Banking Authority's guidelines on outsourcing.
- 04Data in the cloud: protection, location and access by supervisorsA lender's most sensitive asset in the cloud is its data: borrowers' identities, incomes, balances and repayment histories. This lesson takes three questions in turn: how the data are protected when someone else runs the computers, where the data sit and why some countries require them to stay at home, and how the institution and its supervisor can still reach them.
- 05Concentration, resilience and exit: planning for a provider that failsCloud services are run by a small number of large providers, and many financial institutions depend on the same ones. This lesson looks at what that concentration means for one institution and for the financial system, how institutions plan for the failure of a provider, why leaving a provider can be hard, and what a written exit plan should contain.
Quiz and certificate 8 questions; those on lesson 1 are free to try. Read every published lesson and score 80% or more for a certificate of completion.
Take the quizHow a digital lending platform is built →APIs and system integration for lenders →All courses →