Big US banks are slowly embracing cloud services like AWS, Azure, and GCP, after hesitating for years due to regulation, cyberattacks, and old infrastructure
Context & Ripple Effects
Big US banks were the cloud's most stubborn holdouts: Wall Street was still running mainframes as recently as 2020, with pandemic-era demand spikes cited as the force that might finally break the habit per Protocol's reporting on Wall Street's slow cloud shift. AWS has been courting this exact customer base for years, having built services explicitly aimed at legacy enterprises like IBM and Oracle customers back in 2015 when AWS first targeted legacy tech giants' installed base.
What changed by early 2022 is that the hesitation — regulation, cyberattack fear, old infrastructure — started giving way to adoption, and regulators noticed before the migration finished. Within days of this story, UK financial regulators moved to investigate AWS, Microsoft, and Google over banks' growing reliance on their clouds the planned UK probe into cloud concentration in banking, and by 2023 the US was drafting rules for cloud providers' own security practices as concentrated hacking targets.
First-order effects
- Core banking workloads start moving off mainframes onto AWS, Azure, and GCP, finally converting the legacy-enterprise segment AWS has pursued since its mid-2010s push against IBM and Oracle.
- IBM and Oracle lose their most defensible customer class — regulated banks that kept mainframes alive precisely because the cloud seemed too risky.
Second-order effects
- Concentrating bank operations at three providers invites the regulatory countermove already in motion: the UK's investigation into AWS, Microsoft, and Google, and US plans to impose security-practice rules on cloud giants as single points of failure.
- Hyperscalers must meet bank-grade compliance and resilience demands, raising their cost of serving finance but locking in sticky, high-value regulated-industry contracts smaller rivals struggle to qualify for.
Third-order effects
- If the pattern holds, AWS, Microsoft, and Google effectively become financial market infrastructure, pushing regulators toward the kind of systemic oversight historically reserved for the banks themselves.
- The regulatory relationship inverts: authorities that once limited banks' cloud use end up supervising the cloud providers directly, making hyperscaler security practice a matter of financial stability policy.
The trend: Regulated industries are consolidating core systems onto a handful of hyperscalers at the same moment regulators move to treat those providers as critical infrastructure.