Key Takeaways
- Banks are slow to move to the cloud, and security is usually the reason — or more specifically, when security is brought in too late.
- That’s why the hybrid cloud model seems to be the default. It gives banks a way to manage cost and avoid putting everything sensitive in one place.
- Regulation (especially in the EU) ultimately determines where sensitive data can move. So when security is not a main part of the equation, those migrations get blocked.
Every day, whether shopping online, investing, or sending money through Venmo, millions of people interact with banking infrastructure they never even see.
That complexity is only magnified when people start recommending new technologies. Fintech hosts know that customers today expect instant payments, real-time fraud protection, and apps that load and transfer instantly.
But what actually goes into guaranteeing a simple transfer is a lot of background work. These transactions involve identity checks, risk analyses, authentication processes, all while money moves across several avenues across the globe within seconds.
Many banks and financial institutions are now realizing how hard these demands are to manage with on-prem infrastructure. It’s also the big reason why so many banks have spent the last decade experimenting with the cloud.
But according to Iwona Rajca, Senior Solutions Architect at data security firm Protegrity, many of those migrations come to a stop because cloud migrations typically come from cost reasons.
“A common blind spot for financial institutions is underestimating how much security groundwork goes into a cloud move,” Rajca told HostingAdvice. That means that security teams are usually brought in to OK a finished plan, not to help design it so it’s compliant.
Rajca added, “We’ve been brought into multimillion-dollar migrations that looked nearly done — until InfoSec stepped in and refused to sign off.”
But it’s not that banks lack security. It’s that security and regulatory standards are hard to meet at scale. And they’re ultimately what defines which infrastructure is even possible.
Hybrid As the Rule, Not the Exception
“Cloud-first” marketing is everywhere. Even people far removed from the tech space have heard of the cloud by now (if they’re not using it already on their smartphones).
But in banking, Rajca said she isn’t aware of any fully cloud-native institutions. Even the ones that use the cloud are still holding onto their on-prem setups.
“I believe that, in many ways, banks approach infrastructure the same way they approach financial risk: they diversify,” she said. “They want to avoid vendor lock-in and hedge against service disruptions.”
It’s a completely valid concern. Take a look at the recent AWS and Cloudflare outages. Multiple banking and financial platforms — Ally, Venmo, PayPal, SoFi — went down, and thousands, if not millions, of customers couldn’t transfer money or receive payments.
It’s moments like that which force the question: Does migrating to the cloud actually improve anything?
“If there are no clear savings or efficiency gains, why move the workload?” Rajca said. “For many institutions, the risk and cost of moving off the mainframe outweigh any theoretical upside, so it continues to outlast each new technology trend.”
Of course, not everything belongs in the cloud. For predictable workloads, on-prem infrastructure is usually cheaper. The cloud makes more sense when demand spikes, as during seasonal shopping or instant transfers.
“The economics are just too hard to ignore,” Rajca said. “The cloud gives you on-demand compute without the massive upfront investment.”
Hybrid is a strategic choice, but in many cases, it’s the only option regulators will allow.
Why Some Data Can’t Move So Easily
Many countries enforce strict data residency rules that limit where financial and personal data can be stored and processed.
Take a look at the EU’s General Data Protection Regulation (GDPR), which restricts personal data from being transferred outside the EU/EEA unless the destination meets very specific privacy protections.
Germany, for example, has its own layer of security in its local banking with BaFin (German regulator) rules. So if a bank moves German customer data to a non-EU cloud region, it could result in a costly violation.
“That new regulatory reality directly shapes a bank’s architectural choices: its hosting strategy, the routing of data flows and, realistically, which workloads can even move to the cloud,” Rajca said.
In what feels painfully obvious, Rajca said that’s why security has to be included from day one.
“You not only avoid late-stage friction, you also create an opportunity to build future resiliency into the platform by design,” she said. That’s where hosting providers can play a bigger role, she added, not just by supplying bank-ready infrastructure, but by asking the hard questions about security much earlier.
