UK banks rely heavily on major cloud providers, Bank of England and FCA research finds

British financial firms rely heavily on a small number of cloud providers, while many lack tested plans for switching when a critical service fails. The findings also point to limited visibility of third-party AI systems, a practical weak spot as banks expand their use of the technology.

Watch Desk analysis

What happened

A joint Bank of England and Financial Conduct Authority survey found that the three largest cloud providers account for 79 per cent of reported supplier relationships among financial services firms. More than a third of cloud relationships were judged critical to operations and difficult to replace, but only 35 per cent of those had tested switching plans.

The survey also found that third-party providers account for 53 per cent of systems considered highly material to firms’ operations. Just 24 per cent of respondents said they had deep knowledge of their most important third-party AI systems; 81 per cent instead relied on supplier assurances and contractual protections. City AM reported the findings on 27 October.

Why it matters

Cloud dependence and AI oversight are connected, but they are not the same problem. A bank may depend on a small number of providers for critical systems, while also struggling to understand which external AI systems it uses and how those systems behave. Weak switching plans can make disruption harder to manage; limited visibility can make it harder to assess the technology in the first place.

The survey does not establish that a cloud outage will cause a financial crisis. It does show why resilience is more than a contract clause: firms need to know what they rely on and have practised what happens when a provider is unavailable.

Our read

A supplier assurance is useful, but it is not a substitute for knowing what is running inside a business-critical system. The revealing figure is not just how much firms rely on outside providers, but how few say they understand their most important third-party AI systems well.

For financial firms, the practical test is whether they can identify those systems, assess their dependencies and demonstrate a workable fallback. “We have a policy” is a promising start. It is not quite the same as knowing what happens on Monday morning when a provider goes down.

What to watch

• Whether regulators push firms to improve tested plans for switching critical providers.
• Whether banks disclose how they identify and assess third-party AI systems.
• How firms respond to the reported integration and legacy-system barriers to AI adoption.

Discussion spark: Should regulators require banks to demonstrate tested exit plans for critical cloud and AI providers, or is that too prescriptive for fast-changing technology?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.