Every seasoned banker can recite the first commandment of risk management almost by reflex: never concentrate your exposure in a single counterparty. Diversify. Spread. Hedge. It is a principle so deeply embedded in the culture of prudential finance that it underpins capital adequacy frameworks, credit portfolio construction, and the very stress-testing regimes that regulators demand institutions run each year. Yet a glaring and largely unremarked contradiction has taken root at the heart of the global banking sector — one that financial commentator Chris Skinner, writing on The Finanser, has crystallised into a single uncomfortable question: why are banks doing exactly the opposite when it comes to technology?
The question is deceptively simple, but its implications are profound. While the financial industry has spent decades constructing elaborate frameworks to prevent overdependence on any single borrower, trading counterparty, or funding source, it has simultaneously allowed its operational backbone — the technology stack that processes payments, stores customer data, runs credit decisions, and connects institutions to the global financial system — to consolidate around a vanishingly small number of vendors. The irony is sharp enough to cut: institutions that would never permit a single name to represent more than a defined percentage of their loan book have handed the keys to their core infrastructure to a handful of cloud providers, core banking platform vendors, and software-as-a-service suppliers.
A Systemic Contradiction at the Heart of Prudential Finance
To appreciate the scale of this contradiction, consider what concentration risk actually means in the financial context. Regulators at the European Central Bank, the Bank for International Settlements, and the European Banking Authority have long required institutions to demonstrate that no single exposure, whether to a sovereign, a corporate, or a financial counterparty, can bring the institution to its knees. The logic is straightforward: systemic resilience depends on distributing risk so broadly that no single point of failure can cascade into broader collapse. This is not merely good practice — it is regulatory mandate.
Yet when institutions select their cloud infrastructure, they overwhelmingly gravitate toward the same two or three hyperscale providers. When they modernise their core banking systems, they migrate toward platforms whose market penetration is so dominant that an outage at a single vendor can simultaneously impair hundreds of financial institutions across dozens of jurisdictions. The 2024 global IT outage triggered by a faulty software update at a single cybersecurity vendor — which grounded airlines, disrupted hospitals, and caused visible disruptions at banks and payment processors worldwide — was perhaps the starkest demonstration of this vulnerability that the industry has yet witnessed. And yet, the structural conditions that made that outage so damaging remain largely unchanged.
Why Banks Tolerate in Technology What They Forbid in Finance
The reasons for this asymmetry are partly cultural and partly structural. Technology procurement has historically sat outside the purview of chief risk officers, treated as an operational matter rather than a risk management imperative. The sophistication required to evaluate vendor concentration in cloud architecture or application programming interface dependencies is different in character from credit risk modelling, and many institutions have been slow to build the cross-disciplinary expertise needed to bridge the two domains.
There is also a powerful gravitational pull toward consolidation in enterprise technology markets. Network effects, switching costs, and the genuine productivity advantages of standardised platforms create strong economic incentives for institutions to converge on the same solutions. A bank that runs its operations on a dominant cloud platform, uses a leading core banking vendor, and relies on widely adopted payment infrastructure benefits from deep talent pools, robust vendor support, and interoperability with counterparties. Diversifying for the sake of resilience can feel like paying an expensive premium for a risk that feels abstract — right up until the moment it materialises.
Regulatory Pressure Is Building, But Slowly
Supervisors are beginning to catch up. The European Union's Digital Operational Resilience Act, known as DORA, which came into force in January 2025, requires financial institutions to identify, assess, and manage information and communication technology concentration risk explicitly — including at the third-party provider level. Similar frameworks are emerging in the United Kingdom and across Asia-Pacific jurisdictions. For the first time, regulators are treating technology vendor dependency as a category of systemic risk comparable in seriousness to credit or liquidity concentration.
But regulation alone cannot resolve a problem that is as much about institutional culture as it is about compliance checklists. As Skinner's observation suggests, the deeper issue is a failure of imagination — an inability or unwillingness to apply the same intellectual rigour to technology risk that bankers apply almost instinctively to financial risk. The banking sector's risk management culture was forged in the fires of financial crises, from the savings and loan collapses of the 1980s to the global financial crisis of 2008. It may take a comparably severe and visibly technology-driven systemic event to generate the same cultural transformation in how institutions approach their operational dependencies.
What This Means for the Industry
The banking sector stands at an inflection point. The relentless drive toward digital transformation, cloud migration, and artificial-intelligence-powered services is deepening, not reducing, the sector's dependence on a small number of critical technology providers. Chief risk officers, boards, and supervisors must urgently extend their concentration risk frameworks to encompass technology vendor exposure with the same rigour applied to financial counterparties. Mapping single points of failure in the technology stack, stress-testing for vendor outages, and demanding genuine exit strategies from dominant suppliers are not optional extras — they are the logical extension of principles that bankers have understood for generations. Putting all your eggs in one basket is dangerous whether that basket is a loan book or a cloud platform. The industry has known this for years. It is long past time to act accordingly.
Written by the editorial team — independent journalism powered by Codego Press.