The Dutch Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) published a joint report warning that the financial sector’s growing reliance on a small number of non-European IT suppliers is creating concentration and systemic risks, so disruption at a single provider could affect large parts of the sector. The supervisors call on financial institutions to further strengthen digital resilience and underline the need to work over time towards European digital autonomy. Critical processes are increasingly outsourced to external providers, including cloud service providers, software vendors and suppliers of AI models, and recent geopolitical developments have increased the urgency of this digital dependence. Because many institutions use the same providers and infrastructures, outages and cyber incidents at IT service providers can affect multiple firms simultaneously, making the stability of the financial system partly dependent on the robustness of those suppliers. The report also flags scenarios in which state actors could exploit the dependence as political leverage or in a trade conflict, including sudden stoppages of essential IT services due to sanctions or hybrid attacks combining cyber incidents with physical damage to infrastructure. AFM and DNB note the issue is complex and not solvable in the short term, and urge institutions to prepare for disruptive scenarios by working with IT suppliers, authorities and other firms to develop threat scenarios, share information on concrete threats and attacks, and conduct chain tests. The report also highlights the need for institutions to be able to explain how their choices ensure data sovereignty and security, while longer-term risk reduction requires European-level solutions and the development of viable European alternatives supported by a stronger innovation and investment climate for European technology firms.
Dutch Authority for the Financial Markets 2025-10-20
Dutch Authority for the Financial Markets and Netherlands' De Nederlandsche Bank warn that reliance on a handful of non-European IT providers creates systemic risk
The Dutch Authority for the Financial Markets and De Nederlandsche Bank warn that the financial sector's reliance on a few non-European IT suppliers poses concentration and systemic risks. They urge financial institutions to enhance digital resilience and work towards European digital autonomy. The report highlights the need for collaboration with IT suppliers and authorities to prepare for disruptive scenarios and emphasizes European-level solutions for long-term risk reduction.