Financial institutions face governance and skills gaps in cloud adoption

About 94% of RegTechs surveyed reported cloud adoption hesitation from FIs.

Singapore financial institutions (FIs) face governance, accountability, and skills gaps as they expand their use of cloud-based regulatory technology (RegTech), according to a report by the Singapore FinTech Association (SFA) and KPMG in Singapore.

The report, “Strategic Cloud Adoption in Financial Services: Governing Risk & Scaling RegTech,” examines cloud adoption amongst FIs in Singapore and across Asia-Pacific.

It found that 94% of RegTechs surveyed had encountered hesitation from FIs over cloud adoption, with concerns centred largely on governance and institutional readiness rather than technology.

Cloud is increasingly becoming the foundation for AI, advanced analytics and RegTech, with hybrid and multi-cloud architectures becoming more common.

The report draws on views from FIs, RegTech providers, cloud service providers (CSPs), system integrators (SIs), and the Monetary Authority of Singapore (MAS).

Seventy-seven percent of RegTechs surveyed favour cloud-native deployment, it found.

AI and agentic AI applications require scalable computing, large-scale data processing and rapid model iteration, making them difficult to support through on-premises infrastructure.

Small and mid-sized FIs are moving faster towards cloud adoption, citing scalability, cost efficiency, and deployment speed. Many are also exploring hybrid and multi-cloud models to reduce reliance on a single provider.

RegTech is also shifting from manual processes to automation and AI-assisted decision-making, although most institutions expect to retain human oversight.

MAS said FIs are increasingly using technology and innovation to develop solutions. In 2016, it clarified that it had no objections to FIs using cloud services if they maintained robust governance and risk management.

FIs remain responsible for governance and risk even when cloud and RegTech functions are outsourced, the report said.

CSPs and RegTech providers may manage encryption, key management, and infrastructure security, but accountability for governance, oversight and incidents remains with the FI.

This is consistent with the MAS Technology Risk Management Guidelines and Guidelines on Outsourcing for financial institutions other than banks, which place accountability with the FI, including its board and senior management.

The report recommended a risk-tiered model covering workload classification, responsibilities for infrastructure and data, monitoring, incident response, assurance requirements, and governance from design through to exit.

It also identified gaps in identity and access management, logging, network segmentation, and data governance, as well as shortages of cloud security and AI talent.

SIs said FIs often underestimate data engineering requirements, whilst procurement and security approvals can delay projects. Some teams also lack the skills to operate systems after implementation.

Data residency and cross-border requirements are also influencing cloud architecture. FIs often retain personally identifiable information in-house and use tokenisation, anonymisation and abstraction when data needs to move.

Providers said regional deployment models and advanced encryption can address many data sovereignty concerns, but adoption remains limited as firms remain uncertain about supervisory expectations.

RegTech providers said they often have to complete similar due diligence questionnaires for different clients.

Although certifications including SOC 2 and ISO 27001 are widely used, they are not consistently accepted as sufficient assurance. Testing requirements, particularly for AI-enabled tools, also vary.

The report recommended reusable “adoption kits” containing security packs, deployment blueprints, control mappings, and responsibility matrices.

Around 65% of RegTechs surveyed operate a single core architecture with limited configurability, making common standards potentially useful in reducing client-specific customisation.

The report also recommended standardised RACI models across cloud and RegTech services, clearer contractual responsibilities, dependency mapping, and exit strategies.

Agentic AI is creating additional governance questions, particularly over responsibility when a CSP hosts an AI model without training or governing it, the report noted.

It recommended shared standards for APIs, data models and deployment models, reusable adoption kits, clearer accountability through RACI matrices, capability building in cloud security and AI risk management, recovery, and exit strategies for critical services, and common approaches to AI governance and testing.