EU supervisors: bank customers will pay for cloud reliance outside the Union

A bank can hold strong capital and still depend in its core business on infrastructure run somewhere else. The Italian portal CorCom describes the autumn review of risks in the EU financial system, published on 23 September by the joint committee of supervisors Eba, Eiopa and Esma.

The document lists the most serious weaknesses: technological dependence on companies based outside the Union, changing cyber threats powered by artificial intelligence, and private credit risks. The question is not only which services a bank buys. It is also whether the bank can keep operating when a provider suffers an outage, or when that provider lands in the middle of political decisions taken in another jurisdiction.

Who causes the greatest concern

In the Eba survey on dependence on entities outside the EU and outside the European Economic Area, institutions most often named IT service providers. Roughly 80 percent of respondents called those relationships their main critical dependence. Payment solutions came second, named by about 60 percent of the banks. Supervisors stress that these are the opinions of the institutions surveyed, not a measurement of providers' market share.

Concentration is a separate problem. When many banks use the same infrastructure, an outage at one provider hits all of them at once. That is why supervisors now look beyond the risk of a single bank and examine the technological relationships the whole sector shares. Their recommendations include monitoring those dependencies, resilience testing against crisis scenarios, controls and coordination under the EU's Dora regulation on the operational resilience of the financial sector.

Sovereignty as a product

Regulatory pressure immediately became a sales argument. The French Le Monde Informatique describes the completed merger between Canada's Cohere and Germany's Aleph Alpha. The final agreement was signed on 16 September, and the new entity will operate under the name Cohere with headquarters in Toronto and Berlin. The combined company is valued at around 20 billion dollars, and Cohere shareholders are to hold about 90 percent of the shares. The deal still awaits regulatory approvals, and closing is planned for 2026. Ilhan Scheer, currently co-managing Aleph Alpha, is to become chief operating officer, and Samuel Weinbach head of research.

The newsroom notes a disproportion here. Cohere's recurring revenue rose from about 62 million dollars at the end of 2024 to 240 million in 2025. Aleph Alpha, by contrast, had limited revenue and large losses, and had earlier given up developing top-class models in favour of integration software. Some observers therefore speak of a takeover "disguised" as a merger.

The conclusion for the reader is twofold. For a financial institution, the question "where does the server stand" has stopped being an accounting matter and has become part of risk management. For suppliers pitching an alternative to the American hyperscalers, "sovereignty" is today the strongest sales argument, and at the same time the hardest to sustain, because it requires scale and profit at once.