The case
The increasing use of cloud services by banks and securities firms offers significant operational benefits but at the same time also heightens dependency on external providers and concentration risks. FINMA’s Risk Monitor 2025 (17 November 2025) highlights growing reliance on a small number of central ICT and SaaS providers, emphasizing the need to strengthen operational resilience.
Source: mme.ch
The commentary
Supervised institutions must identify, assess, manage and continuously monitor the operational, ICT as well as outsourcing risks associated with cloud usage. Before engaging a cloud provider firms are required to conduct thorough due diligence and ensure full compliance with financial market, technical, contractual and data protection requirements. Cloud contracts must be appropriately reviewed and supplemented to address regulatory, security and data protection safeguards.









