European banks are reducing reliance on US hyperscale cloud providers as regulatory pressure, geopolitical tensions and data sovereignty concerns drive a shift toward hybrid and sovereign cloud strategies.
European banks are reducing their reliance on US hyperscale cloud providers and moving toward more sovereign, diversified and hybrid cloud strategies, a commentary for Morningstar DBRS says.
The shift is being driven by growing regulatory scrutiny, geopolitical tensions and concerns around data sovereignty and concentration risk.
Arnaud Journois, Senior Vice President, European Financial Institution Ratings, said: “We note that some European banks have begun using domestic cloud providers, adopting hybrid and multi-cloud approaches to increase diversification and re-evaluate their digital provider strategies. By diversifying their cloud strategies and strengthening their reliance on European providers, banks are positioning themselves to meet the more stringent regulatory expectations for data governance while securing greater independence from external political and technological pressures.”
From efficiency to sovereignty
The commentary says for years, US cloud giants offered European financial institutions unmatched scalability, innovation and cost efficiency. But the calculus is shifting.
At the heart of the issue lies a structural conflict between regulatory regimes. On one side is the EU’s strict data protection framework, embodied in the General Data Protection Regulation. On the other is US legislation such as the CLOUD Act, which allows American authorities to access data held by US-based providers – even when that data is stored overseas.
The commentary says this legal mismatch has become increasingly difficult for European banks to ignore. Data sovereignty is no longer a theoretical concern; it is a boardroom priority.
Geopolitics meets infrastructure
The urgency has only intensified in a more fragmented global landscape. As political tensions between the European Union and the United States deepen, banks are beginning to question the long-term reliability of their digital dependencies.
The commentary says recent events have reinforced these concerns. High-profile outages – such as the global disruption linked to CrowdStrike in 2024 – demonstrated how vulnerabilities in widely used systems can cascade across industries. Meanwhile, geopolitical shocks, including infrastructure disruptions in the Middle East in early 2026, have underscored how quickly physical and digital risks can converge.
The commentary says for banks, the message is clear: concentration risk is no longer just an operational issue – it is a systemic one.
Regulators turn up the pressure
European regulators are responding decisively.
The introduction of the Digital Operational Resilience Act (DORA) marked a turning point. The regulation requires financial institutions to demonstrate robust operational resilience and places stricter oversight on critical third-party providers – including cloud companies.
The commentary says Supervisory bodies are also becoming more explicit. The European Central Bank has issued detailed guidance urging banks to reassess outsourcing risks and diversify their cloud strategies. National regulators are going further still. In the Netherlands, the Dutch Central Bank and the Authority for Financial Markets have warned that heavy dependence on a handful of non-European providers could pose a threat to financial stability.
The commentary says the regulatory message is consistent: resilience requires diversification.
The rise of sovereign and hybrid cloud models
Banks are already acting on these signals.
Across Europe, institutions are beginning to shift sensitive workloads toward domestic cloud providers such as OVHcloud, IONOS and Scaleway. At the same time, the commentary says, they are adopting hybrid and multi-cloud architectures that balance flexibility with control.
In practice, this often means:
• Sensitive and regulated data stays within EU-based sovereign clouds
• Critical systems remain on-premises for maximum control
• Less sensitive workloads continue to run on US hyperscale platforms
The commentary says this layered approach allows banks to reduce concentration risk while maintaining access to the advanced capabilities of global providers.
A new digital strategy for a fragmented world
What is emerging is not a wholesale rejection of US cloud providers, but a more nuanced and strategic model – one that reflects the realities of a polarised world.
The commentary says European banks are redesigning their digital infrastructure with resilience and autonomy in mind. In doing so, they are aligning more closely with regulatory expectations while preparing for a future where technological dependencies carry geopolitical weight.
The shift toward sovereign and diversified cloud strategies is still unfolding, the commentary says, but one thing is already clear: in European banking, cloud is no longer just about technology – it is about control.
