Resilience by design: changing the dial on cloud architecture

Concentration risk has always posed a threat to infrastructure. When too much depends on a single provider or critical piece of technology, the system becomes more fragile, less resilient, and the risk of failure rises. And in a sector like payments, on which billions of people depend every day, failure simply isn’t an option.

 

Just as overdependence caused problems during the 2008 financial crisis, it is now creating new vulnerabilities, this time in the form of over-reliance on single cloud providers.

 

Since its inception, cloud computing has proven enormously beneficial for financial services, enhancing agility, scalability and cost efficiency. However, this is not risk-free. The risks stem not from the cloud providers themselves, but from organisations leaving themselves dependent on just a single cloud and the impact of outages.

 

Many industries, such as financial services, healthcare and aviation, rely on clouds for their operations. This means that cloud concentration has quickly become a macro infrastructure issue.

 

In any industry, from payments to healthcare and aviation, cloud concentration can quickly become a macro infrastructure issue.

 

The recent Amazon Web Services outage was a case in point. A significant outage in its US-East-1 Northern Virginia region had far-reaching impacts, affecting financial services, streaming platforms, airlines and more across the US and further afield.  

 

Multi-cloud architecture as standard

The US regulates cloud service providers through a patchwork of sector-specific laws, federal security programs and state-level privacy laws. Certain cloud providers, such as AWS, Microsoft Azure and Google, are deemed systemically important with greater risk management obligations, due to the sheer level of reliance on them. However, this only solves part of the problem.

 

Outages can and do happen. As a result, resilience needs to be engineered, not just regulated. 

 

In practice, this means multi-cloud adoption, hybrid architectures and the use of alternative or backup service models that can provide meaningful defences against an outage. These tools reduce industry reliance on any single point of failure and ensure that their customers can continue to send and receive instant payments, even if one cloud goes down.

 

It’s about having flexibility and the ability to reroute, absorb impact, and continue functioning even under pressure, ensuring systems are ‘always on.’

 

Payments as the hardest hit

The need for resilient architecture is pressing across all industries, but particularly payments. From wages and mortgages to paying for everyday goods, society is dependent on the movement of money – meaning that payments cannot afford to fail.

 

This expectation that money will always move as and when we need it has only intensified across the US, driving a further shift towards instant payment capabilities.

 

As of February 2025, the Real-Time Payments Network (RTP) increased its transaction limit from $1 million to $10 million, and 10 months later, the Federal Reserve Financial Services (FRFS) followed suit and made the same transaction limit changes to the FedNow Service.

 

Moreover, the transition to ISO 20022 has strengthened the foundations for instant payments in the US, embedding richer data into systems such as FedNow, improving reconciliation and supporting interoperability across rails.

 

But with this increased demand for instant, always-on payments in the US, customers expect them to be seamless and are much less willing to accept outages. As a result, banks and fintechs must ensure that resilience is at the core of their payments infrastructure so that they can provide the services their customers have come to expect and remain competitive.

 

Financial services must lead the way

Cloud concentration risk isn’t exclusive to financial services, nor is it just a finance or fintech challenge.

 

From hospitals and energy providers to gaming platforms and stores, almost every major industry now runs on the cloud. This means that when one cloud goes down, the impact ripples across the globe, with patient care, travel, supply chains and consumer services all affected.  

 

The reality is that outages are inevitable. Rather than crossing our fingers that all will run smoothly, industries must be designed for the worst-case scenario. 

 

Here, payments and financial services can play a key role. As one of the most systemically important sectors in the economy, the banking industry can set a precedent by investing in resilient architecture that keeps money moving.

 

This will not only shore up its systems at a critical time when the industry moves towards instant payments but will also provide other industries with the confidence to follow suit.

 

At a pivotal moment in the expansion of cloud computing, resilience now will pay dividends down the line.

 

---

 

Dave Scola, US CEO at Form3

 

Main image courtesy of iStockPhoto.com and tadamichi