CBA’s Core Banking Move to AWS Sparks APRA Cloud Risk Warning
Commonwealth Bank’s full migration of its core banking platform to Amazon Web Services marks a major milestone in Australian banking technology — but regulators are warning of new risks as the sector concentrates critical systems with a few global providers.
As CBA pushes for faster innovation and AI-driven banking through a cloud-native architecture, the Australian Prudential Regulation Authority is urging financial institutions to strengthen continuity, recovery, and governance plans to manage growing concentration and technology risks.
Commonwealth Bank of Australia (CBA) has completed the full migration of its core banking systems—including deposits, loans, and transaction processing—to Amazon Web Services (AWS), marking one of the most significant cloud transformations in global banking. The project replaces legacy mainframes with a distributed, cloud-native architecture, enhancing performance, resiliency, and scalability.
CIO Gavin Munroe said the move enables CBA to operate with “greater agility and innovation velocity,” allowing product releases in weeks rather than months. Balance checks now process in under a second, and the shift aligns CBA’s AI and analytics systems—already running on AWS through Snowflake—with live transactional data, boosting real-time insight and automation capabilities.
While the transformation positions CBA at the forefront of digital banking, it also highlights growing systemic risk as Australian banks increasingly depend on a handful of global cloud providers. The Australian Prudential Regulation Authority (APRA) has issued a warning about technology concentration risk, emphasizing the need for strong continuity and recovery plans.
APRA executive board member Suzanne Smith said an industry-wide audit is under way to map cloud dependencies under the new CPS 230 prudential standard. The regulator is urging banks to test failure scenarios, strengthen AI governance, and ensure resilience if a major provider such as AWS or Microsoft Azure were to experience disruption.
CBA and Macquarie Bank now operate their core platforms entirely within AWS, while other major banks use multi-cloud models combining AWS, Azure, and Google Cloud. APRA cautions that while cloud infrastructure delivers speed and flexibility, it also increases interdependence, creating potential single points of failure.
Despite a brief post-migration outage unrelated to AWS, CBA says its cloud-first approach is essential for the next era of AI-driven banking. However, regulators maintain that the sector’s rapid shift to the cloud must be matched by robust risk management, encryption, and operational resilience to safeguard Australia’s financial system.