Modern banking resilience faces cloud and AI risks

A webinar hosted with Escode and moderated by Jane Cooper will examine gaps in financial firms’ operational resilience as banks increase use of cloud services, rely on third-party software and adopt AI.

The online session will bring together industry experts to explain how cloud and software dependency raises operational risk. Panelists will outline how hidden vendor dependencies and supplier failures can interrupt services, what regulators are asking firms and suppliers to do, and practical measures such as stressed exit strategies and software escrow to preserve continuity.

Regulatory approaches differ by jurisdiction. Some frameworks require firms to secure digital supply chains and to map and manage concentration risk. Other authorities have issued guidance aimed at technology suppliers, leaving firms to reflect those requirements in contracts and oversight. Several jurisdictions do not require firms to assess supplier concentration.

Those variations shape firm practices. Where rules mandate supply-chain management, firms are more likely to maintain inventories of critical suppliers and run resilience tests. Guidance aimed at suppliers can increase vendor accountability but may leave gaps in how firms integrate that guidance into operational plans. Jurisdictions without concentration rules can have areas where many firms depend on a small number of vendors.

Panelists will focus on operational controls. Stressed exit strategies are documented plans for transferring services or data, restoring operations and keeping customer access if a supplier fails. Software escrow arrangements place a supplier’s source code or other critical assets with a neutral third party and release them under defined triggers to maintain access to key systems.

Speakers will address AI-related third-party risk. Models and platforms supplied externally can create opaque dependencies and new failure modes that affect decision-making, compliance and continuity. The panel will examine techniques for continuous monitoring of vendor behaviour, model performance and data handling to identify issues before they lead to outages or regulatory breaches.

The discussion will also cover future technologies such as quantum computing. While quantum is not an immediate operational concern for most firms, potential threats to current encryption standards mean some resilience plans need cryptographic agility and long-term migration strategies so data and transactions remain protected as computing capabilities change.

Other topics expected in the session include supplier mapping and concentration testing, contractual rights for termination and transition, routine resilience testing that incorporates third-party failures, and governance processes that connect technology resilience to enterprise risk management.

The webinar will review global regulatory approaches and the operational practices firms are using in a cloud-first banking environment.