SUNANDO ROY – On Banking, Finance and Society

The financial sector has been quick to recognize the transformative potential of cloud computing. Banks, insurance companies, and investment firms are increasingly adopting cloud platforms to drive efficiency, scalability, and innovation. From streamlining digital banking services to enhancing fraud detection with advanced analytics, the cloud is reshaping how financial institutions operate and compete. Yet, with these benefits come new challenges. For auditors, regulators, and executives alike, the key question is not whether to use the cloud, but how to do so securely and responsibly.

Shared Responsibility in the Cloud

At the heart of secure adoption lies the shared responsibility model. Cloud providers such as AWS, Microsoft Azure, and Google Cloud are responsible for the security of the cloud — maintaining the physical infrastructure, data centers, and core systems. Financial institutions, however, remain responsible for security in the cloud — governing how applications are deployed, data is managed, and users are controlled.

Many high-profile breaches, such as the 2019 Capital One incident, occurred not because providers failed, but due to customer-side misconfigurations and weak access controls. This makes governance, monitoring, and risk management critical audit priorities.

Key Risks in Cloud Adoption

Financial institutions face a unique set of risks when moving workloads to the cloud.

• Misconfiguration: A single oversight in a firewall rule or storage bucket can expose millions of records.

• Unauthorized Access: Weak identity and access management (IAM) can enable hackers or insiders to compromise sensitive data.

• Data Breaches and Privacy Issues: Institutions must encrypt data at rest and in transit while complying with GDPR, PCI DSS, GLBA, and local data residency laws.

• Insecure APIs: APIs power modern financial platforms but can become attack vectors if not secured.

• DoS Attacks and Ransomware: Disruption of critical banking services remains a major operational risk.

• Third-Party Risk and Vendor Lock-In: Dependence on one cloud provider can create compliance and resilience challenges.

For auditors, the task is to verify that these risks are embedded in the institution’s enterprise risk management framework, tested, and continuously monitored.

AWS as an Example : Shared Responsibility Across Service Models

AWS clarifies security obligations through its shared responsibility model, which shifts depending on whether the institution uses IaaS, PaaS, or SaaS.

For financial institutions, this means the deeper the service (IaaS), the greater the operational responsibility. In SaaS, responsibility shifts toward governance, access, and compliance. For this, AWS provides a range of native tools to help customers meet their side of the model:

• IAM: Fine-grained access controls to enforce least privilege.

• GuardDuty: Intelligent threat detection for unusual account activity.

• Security Hub: Centralized view of compliance and security findings.

• Macie: Machine learning–based detection of sensitive financial or customer data.

• CloudTrail & CloudWatch: Comprehensive logging and monitoring for audit and incident response.

Institutions should not only enable these tools but also integrate them into governance processes, ensuring alerts are acted upon and compliance frameworks are continuously validated.

Regulatory Expectations

Regulators worldwide have sharpened their focus on cloud adoption. Across jurisdictions, the message is consistent: outsourcing services does not mean outsourcing accountability.

• United States (FFIEC & OCC): Expect rigorous third-party risk management, contingency planning, and contractual safeguards.

• European Union (EBA): Requires risk assessments, exit strategies, and regulator access to cloud providers.

• United Kingdom (FCA & PRA): Emphasizes operational resilience and continuity of critical business services.

• Singapore (MAS): Mandates audit rights, data protection clauses, and incident reporting for cloud outsourcing.

• Basel Committee: Calls for robust governance, cross-border risk assessment, and alignment with operational resilience principles.

Auditors must ensure institutions align with these expectations by documenting shared responsibilities, conducting due diligence, and demonstrating resilience testing.

OWASP Top Ten Cloud Security Risks

The OWASP Cloud Security Project provides a practical risk framework highly relevant to the financial sector.

Cloud computing has become the foundation of digital transformation in financial services. The benefits are undeniable — agility, scalability, and innovation — but the risks are equally profound. Misconfigurations, unauthorized access, insecure APIs, and vendor dependencies can quickly undermine customer trust and regulatory standing. Understanding risks can strengthen financial institutions in the age of cloud.