This article is part three of the series Finance in Transition, where we explore how AI, cybersecurity, and cloud technology are shaping the financial ecosystem of the future.
The pace of digitalisation in finance continues to accelerate. Services are migrating from internal data centres to cloud-based environments, while business models are being rebuilt around flexible ecosystems that enable new partners to integrate easily and data to flow freely across industries and borders.
This openness creates fertile ground for innovation — but also introduces new types of risk. Each integration adds dependency, and security incidents can quickly spread throughout an entire network. Open APIs accelerate product development but demand strong policies for authentication, access control, and systematic risk management.
The Cloud – Both Enabler and Risk Vector
For most banks, the cloud has become the engine of innovation and scalability. Yet reliance on external partners and providers introduces a new business-critical risk: every vendor choice and integration affects both security and compliance, sometimes far beyond the organisation’s direct control.
Supervisory authorities such as the Swedish Financial Supervisory Authority, MSB, and international cybersecurity experts stress the importance of mapping the entire supply chain — from SaaS platforms to cloud hosting and API integrations — to avoid chain reactions in the event of vulnerabilities or incidents. Managing cloud and integration risks requires continuous assessment, clearly defined security levels in contracts, and regular audits of data storage and access points.
NIS2: From Technical Detail to Executive Responsibility
The EU’s new NIS2 directive elevates cybersecurity from an IT issue to a board-level responsibility. The financial sector is specifically highlighted, and banks must now demonstrate not only regulatory compliance but also active governance, preparedness, and reporting capability throughout the value chain.
Cloud platforms, partners, and API providers are all included in the scope, making supplier management and shared accountability central to business strategy. In cases of non-compliance, executive leadership can now be held accountable — both legally and commercially.
At the same time, the directive challenges banks to redefine their risk appetite. Which risks are acceptable? Where does dependency become exposure? And how do you build resilience in a world where control and data are increasingly shared with external parties?
Trends and Cases: How Leading Banks Build Strategy in the Cloud
Several international banks report that clear supplier management and ongoing collaboration with cloud providers significantly strengthen resilience. Continuous dialogue and joint cybersecurity planning enable faster incident handling and limit potential damage.
Forward-looking institutions are also embedding cloud resilience directly into their architecture. Designing for recovery from the outset allows for rapid restoration after disruptions, supported by automated incident response and real-time monitoring.
Automation and AI are becoming key components of these strategies. Intelligent tools help organisations manage massive, fast-moving data flows and detect anomalies in real time, ensuring that digital infrastructure can adapt as threats evolve.
Building a Business Fit for the Cloud Era
Succeeding on cloud terms requires structure, alignment, and continuous improvement. Leading banks establish cross-functional teams where IT, legal, and business units collaborate closely to guide platform and cloud initiatives.
Supplier contracts are being updated to include clear requirements for security, reporting, and incident management. Ongoing risk assessments now extend across the entire integration and supply chain.
Boards and executives are also receiving dedicated NIS2 training, recognising that accountability now stretches beyond technology to the heart of business strategy. Automated monitoring and built-in readiness are becoming essential for early detection and rapid response.
Ultimately, digital resilience in the financial sector will be defined not just by technology, but by how effectively organisations unite innovation, structure, and trust within a single, coherent strategy.
This is the third and final part of the Finance in Transition series — three perspectives on technology, security, and the future.
Read article 1 here and article 2 here.
