Cloud-native core banking

Cloud native describes the architecture of the software, independent of the data center it runs in. Vendors split the core into services for accounts, payments, lending or cards, run them in containers and release a change to one service without redeploying the whole system.

Thought Machine, founded in London in 2014, lets banks define products in code on its Vault Core platform, and Lloyds Banking Group was its first tier 1 client. Tuum sells separate modules for accounts, payments, lending and cards that a bank can combine or run next to an existing core.

DORA requires banks to manage ICT third-party risk, keep a register of their ICT contracts and have exit plans for services that support critical functions. On 18 November 2025 the European Supervisory Authorities published their first list of designated critical ICT third-party providers, which they now oversee directly.

The ECB finalized its guide on outsourcing cloud services on 16 July 2025. The guide is not legally binding, but the supervisory teams of the ECB use it as a benchmark in their assessments. For a cloud core this means the bank shows where its data sits, who can reach it and how it would move the core to another provider.

The same cloud-native approach now reaches securities processing at German banks. dwpbank, which processes securities for about 1,000 German banks, describes its next platform WP3 as modular and cloud native, built from about 400 microservices.

Few banks replace their entire core banking system in a single step. Tuum supports introducing selected modules next to the existing core, so a bank can move one business line first and leave a full replacement for later. The modernization of older core and mainframe systems follows the same pattern of steps.

Banks that want their data and operations under European control also weigh sovereign cloud offers against the large public clouds.

A cloud-hosted core is an existing system that runs on rented infrastructure. A cloud-native core is built from services that the bank or vendor deploys, scales and updates separately on cloud infrastructure.

Yes, DORA allows ICT services from third parties, including public cloud providers, as long as the bank manages the risk, documents the contracts and keeps an exit plan for critical functions.

A core banking system records accounts, balances and postings and applies the product rules for deposits, loans and payments. Every customer channel of the bank reads from it and writes to it.