Today’s financial sector runs on information technology. Nearly all processes, from customer contact to risk management, are supported by external IT service providers such as cloud companies and AI developers. This reliance has grown rapidly as outsourcing is often more cost-effective than in-house development.

“An outage at a major provider could immediately impact a large part of the financial system,” warns Melanie Lohuis of DNB. Beyond technical concerns, the dependency also carries geopolitical risks. “Most major tech companies are non-European, which means their home countries could potentially use that dependency as political leverage.”

The concentration of IT services with a few global providers also raises financial concerns. According to Hans Brits, this can lead to vendor lock-in, where switching providers becomes technically and financially unfeasible. “Once you’re deeply integrated, you lose negotiating power. The supplier can raise prices or change terms without much resistance.”

The supply chain adds another layer of complexity, with subcontractors and secondary vendors introducing hidden vulnerabilities. A disruption or cyber incident at any point in the chain can have far-reaching effects. For consumers, this could mean being unable to access bank accounts or process payments during outages.

To mitigate risks, institutions are implementing exit strategies, continuity plans, and adopting containerization — storing applications and data in portable environments that can be moved between providers. Some cloud companies now offer sovereign cloud solutions governed by European law, but DNB stresses that such measures do not eliminate dependency.

The report calls for strategic autonomy and greater European collaboration. Strengthening Europe’s own tech sector is crucial to reducing reliance on non-European players. “Addressing structural causes requires investment, innovation, and a unified approach at the EU level,” the authors note.

he new Digital Operational Resilience Act (DORA) marks progress by mandating risk management, supplier oversight, and continuity planning. However, DNB and AFM warn that regulatory compliance alone will not solve the issue. They advocate for stronger cooperation among EU regulators and even propose the creation of a European cloud supervisory authority.

“Digital dependency is a cross-border challenge,” Lohuis and Brits conclude. “Only through joint investment and innovation can the financial sector become more resilient in an increasingly digital world.”