Banking Cloud Migration

Executive Summary 

The global banking sector stands at an inflection point. Digital transformation imperatives, evolving regulatory mandates, customer experience expectations, and the emergence of Agentic AI are compelling financial institutions - banks, NBFCs, insurance companies, and payment networks- to fundamentally rethink their technology infrastructure. 

Cloud adoption in banking is no longer a question of 'if' but 'how' and 'at what pace.' This white paper, authored by Saints & Masters provides a comprehensive, practitioner-level guide for banking CIOs, CTOs, CDOs, and technology leaders navigating cloud migration decisions. 

We cover the full spectrum: from hyperscaler selection (AWS, Azure, GCP) to hybrid and sovereign cloud models; from workload classification and cost modelling to RBI and central bank compliance; from risk management frameworks to a ready-to-use RFP template. The Saints & Masters Shipping Cloud Model is introduced as a structured, sovereignty-aware approach to banking cloud adoption. 

Key Insight 

Banks that adopt a risk-calibrated, compliance-first cloud strategy , rather than a lift-and-shift approach - consistently achieve 30–45% infrastructure cost reduction, 60% faster time-to-market for new products, and materially improved operational resilience within 24–36 months of migration. 

1. Why Cloud for Banking - The Strategic Case 

Banking infrastructure has historically been characterised by on-premise mainframes, proprietary middleware, and decades of technical debt. Cloud offers a structural break from this paradigm, but the transition requires careful orchestration given the sector's systemic importance. 

1.1 Business Drivers 

• Cost optimisation: Move from fixed CapEx to variable OpEx; eliminate underutilised data centre capacity 
• Speed to market: Provision new environments in hours rather than months; enable CI/CD pipelines for faster product launch 
• Scalability: Handle peak loads (month-end, festive seasons, IPO days) without over-provisioning 
• AI and analytics: Access managed AI/ML services, real-time analytics, and data lakes natively on cloud 
• Resilience: Multi-region availability zones offer superior DR and BCP compared to most on-premise setups 
• Talent and ecosystem: Attract cloud-native engineering talent; leverage hyperscaler partner ecosystems 

1.2 Regulatory Tailwinds 

• RBI's 2023 Cloud Framework for Regulated Entities (REs) legitimises and structures cloud adoption 
• Basel III/IV operational risk frameworks incentivise mature BCP and DR — cloud-native by design 
• DPDPA 2023 (India) and GDPR mandate data localisation and privacy controls that modern cloud platforms support natively 
• Emerging central bank sandbox frameworks globally encourage cloud-first fintech and bank collaboration 

1.3 Competitive Pressure 

Neobanks and fintech challengers are entirely cloud-native. Legacy banks risk structural disadvantage in unit economics, feature velocity, and customer experience unless they modernise their infrastructure platforms. 

2. Hyperscaler Landscape - AWS, Azure, and GCP for Banking 

Each of the three major hyperscalers has developed differentiated capabilities, compliance postures, and partner ecosystems relevant to banking. The choice of primary hyperscaler is one of the most consequential architectural decisions a bank will make. 

2.1 Amazon Web Services (AWS) 

AWS is the global market leader and one of the most mature hyperscaler for financial services, with the broadest service catalogue, deepest compliance certifications, and the largest ecosystem of FinTech and banking ISV partners. 

• Key banking services: Amazon Aurora (core banking DB), AWS Lambda (event-driven processing), Amazon Kinesis (real-time data streaming), AWS PrivateLink (secure connectivity), AWS Outposts (on-premise extension) 
• Compliance: PCI-DSS, SOC 1/2/3, ISO 27001, RBI compliant Mumbai region (ap-south-1), Hyderabad region (ap-south-2) 
• Sovereign options: AWS Dedicated Local Zones; AWS GovCloud architecture patterns 
• Key banking clients: Goldman Sachs (AWS for Marcus), HDFC Bank, Axis Bank, Nasdaq 
• Strengths: Widest managed service catalogue; most mature banking ISV integrations; deepest security tooling (GuardDuty, Security Hub, Macie) 
• Considerations: Complex pricing model; can generate bill shock without rigorous FinOps discipline 

2.2 Microsoft Azure 

Azure's strongest differentiator for banking is its deep integration with the Microsoft enterprise ecosystem , Active Directory, Microsoft 365, Teams, Power Platform, and Dynamics , making it the natural choice for banks with significant Microsoft footprints. Azure's OpenAI Service partnership is increasingly relevant for banks exploring Agentic AI. 

• Key banking services: Azure SQL Managed Instance, Azure Synapse Analytics, Azure API Management, Azure Confidential Computing, Azure OpenAI Service 
• Compliance: RBI-compliant India West/South regions; ISO 27001, PCI-DSS, SOC 1/2; Azure Government for sovereign workloads 
• Sovereign options: Azure Sovereign Cloud; Microsoft Cloud for Financial Services (MCFS) 
• Key banking clients: Deutsche Bank, ICICI Bank, Kotak Mahindra Bank, Standard Chartered 
• Strengths: Enterprise identity integration; Microsoft Fabric for analytics; strong hybrid story via Azure Arc; Copilot/OpenAI for banking AI use cases 
• Considerations: Some advanced services lag AWS in maturity; licensing bundling complexity 

2.3 Google Cloud Platform (GCP) 

GCP's competitive advantages in banking lie in data analytics (BigQuery), AI/ML (Vertex AI, Gemini models), and anti-money laundering solutions (Financial Services AI). GCP is also the most aggressively priced hyperscaler for analytics workloads. 

• Key banking services: BigQuery (real-time analytics), AlloyDB (PostgreSQL-compatible), Vertex AI (ML pipelines), Cloud Spanner (globally distributed OLTP), AML AI (anti-money laundering) 
• Compliance: RBI-compliant Mumbai region (asia-south1); PCI-DSS, SOC 1/2/3, ISO 27001 
• Sovereign options: Google Distributed Cloud (GDC) for on-premise sovereign deployments 
• Key banking clients: HSBC, Deutsche Bank (data analytics layer), Yes Bank, Axis Bank 
• Strengths: Best-in-class analytics (BigQuery); superior AI/ML (Gemini, Vertex); strongest anti-fraud and AML AI tooling; competitive pricing for data workloads 
• Considerations: Smaller banking ISV ecosystem vs AWS/Azure; less mature enterprise identity story 

2.4 Hyperscaler Comparison Matrix

3. Banking Applications That Benefit from Cloud Adoption 

Not all banking workloads benefit equally from cloud migration. A nuanced classification ensures that migration sequencing maximises value while managing risk. 

3.1 High-Value Cloud Candidates 

3.1.1 Digital Channels and Customer Interfaces 

• Mobile and internet banking applications (seasonal traffic spikes, autoscaling essential) 
• Customer portals, chatbots, and Agentic AI concierge interfaces 
• API gateway and open banking / account aggregation platforms 

3.1.2 Data, Analytics, and AI 

• Enterprise data warehouses and data lakes (BigQuery, Redshift, Synapse) 
• Real-time fraud detection and scoring engines 
• AML transaction monitoring and suspicious activity reporting 
• Credit risk modelling, scorecards, and ML-based underwriting 
• Regulatory reporting (Basel III, IFRS 9, IndAS 109) 

3.1.3 Middleware, Integration, and APIs 

• API management platforms (APIM, AWS API Gateway, Apigee) 
• ESB / message brokers and event-driven integration layers 
• Payment hub middleware (SWIFT, RTGS, NEFT, UPI connectors) 

3.1.4 DevOps, Testing, and Non-Production 

• All development, UAT, and staging environments - immediate cloud migration candidate 
• CI/CD pipelines and automated testing infrastructure 
• Security scanning and vulnerability management toolchains 

3.1.5 Collaboration and Productivity 

• Microsoft 365 / Google Workspace (already SaaS-cloud by default) 
• Internal portals, HR systems, ERP (SAP on Azure/AWS) 

3.2 Complex / Phased Migration Candidates 

• Core Banking System (CBS): Temenos, Finacle, Flexcube - typically Phase 2 or 3 due to data criticality, downtime sensitivity, and regulatory scrutiny 
• Treasury Management Systems: Complex real-time pricing and risk calculation - requires careful latency management on cloud 
• Trade Finance Platforms: Complex workflow engines with legacy integration - containerisation recommended before cloud lift 
• ATM Switch and Card Processing: PCI-DSS scope expands on cloud; requires dedicated compliance architecture 

3.3 Typical Migration Sequence 

4. Typical Migration Lead Times 

Migration timelines in banking are materially longer than in other industries, driven by regulatory approvals, legacy system complexity, data migration requirements, and change management. The following benchmarks are based on global banking cloud migrations.

4.1 Key Lead Time Drivers 

• Regulatory approval cycle: RBI / NHB / IRDAI review and NOC processes for material outsourcing (typically 60–120 days per submission) 
• CBS complexity: Core banking data model migration, parallel run period, and cutover planning alone can take 12–18 months for large banks 
• Network and connectivity: ExpressRoute / Direct Connect provisioning with ISPs typically 60–90 days 
• Security and penetration testing: Mandatory VAPT, DR drills, and BCP validation before go-live 
• Data migration: Masking, classification, tokenisation, and migration of historical data - often the longest single activity 
• Vendor and ISV readiness: Core banking vendors may impose their own timelines for cloud-certified releases 

5. Cloud Risk Management for Banking 

Risk management in banking cloud migrations must be systematically addressed across eight dimensions. Each dimension requires explicit treatment in the cloud strategy, with risk owners, controls, and residual risk acceptance documented. 

5.1 The Eight Risk Dimensions 

5.1.1 Concentration Risk 

Regulatory concern: Over-dependence on a single cloud provider creates systemic risk. RBI's circular on IT Outsourcing mandates that banks assess and manage concentration risk. 

• Mitigation: Multi-cloud architecture for critical systems; documented exit and portability strategy; annual concentration risk assessment 
• Saints & Masters recommendation: Primary hyperscaler for operational workloads + secondary hyperscaler for DR and non-core workloads 

5.1.2 Data Security and Privacy Risk 

• Encryption in transit and at rest: AES-256 mandatory; customer-managed encryption keys (CMEK/BYOK) for sensitive data 
• Data classification: All data must be classified (Public / Internal / Confidential / Restricted) before cloud migration 
• DPDPA 2023 compliance: Personal data of Indian citizens must be processed per DPDPA obligations; DPO appointment and data flow mapping required 
• Tokenisation: Card data (PAN) and Aadhaar-linked data must be tokenised before cloud storage 

5.1.3 Operational and Availability Risk 

• SLA requirements: Core banking requires 99.99% availability; cloud SLAs (typically 99.95%) must be supplemented with architectural redundancy 
• Multi-AZ deployment: All production workloads must span minimum two Availability Zones within the same region 
• DR RTO/RPO: Define per-system RTO and RPO; validate through quarterly DR drills; document in BCP 

5.1.4 Regulatory and Compliance Risk 

• Material Outsourcing: Cloud hosting of customer data and critical applications constitutes material outsourcing under RBI guidelines; prior approval required 
• Right to Audit: Contracts must include RBI's right to audit the cloud provider and bank's cloud environment 
• Data Localisation: Customer financial data must reside in India (RBI mandate); configure geo-restriction policies 

5.1.5 Vendor Lock-in Risk 

• Use cloud-agnostic services where feasible (Kubernetes over EKS/AKS/GKE; PostgreSQL over proprietary databases) 
• Maintain data portability: Documented data egress procedures; tested annually 
• Contractual protections: Minimum 6-month exit clause; data return SLA in cloud contracts 

5.1.6 Change and Transformation Risk 

• Cloud migration impacts operating model, org structure, and skill sets - treat as a transformation programme, not an IT project 
• Change management: Executive sponsorship at Board / MD level; dedicated cloud CoE team 
• Skills: Reskilling programme for IT staff; cloud certification targets; hyperscaler-funded training 

5.1.7 Third-Party and Supply Chain Risk 

• Cloud providers and their sub-processors must be assessed under the bank's Third-Party Risk Management (TPRM) framework 
• ISV and SaaS vendors running on cloud must provide SOC 2 Type II reports; annual re-assessment 

5.1.8 Financial / Cost Risk 

• Cloud cost overruns are one of the top failure modes in banking cloud programmes 
• Implement FinOps practice from Day 1: cost allocation tags, budget alerts, rightsizing reviews, reserved instance planning 
• Cloud cost variance of >15% vs budget triggers a mandatory review in governance framework 

6. Important Aspects to Address During Migration 

6.1 Cloud Landing Zone Design 

Before migrating any workload, establish a well-architected cloud landing zone - the foundational infrastructure scaffold that enables secure, governed, scalable cloud operations. 

• Account/Subscription structure: Separate accounts for production, non-production, sandbox, and security - enforced via AWS Control Tower / Azure Management Groups / GCP Resource Manager 
• Identity and Access Management: Federate cloud IAM with corporate Active Directory; implement least-privilege access; MFA mandatory for all privileged users 
• Network design: Hub-spoke VPC/VNet architecture; private subnets for all production workloads; ExpressRoute / Direct Connect for corporate connectivity; no public internet exposure for core systems 
• Security baseline: Cloud Security Posture Management (CSPM); Security Information and Event Management (SIEM) integration; centralised logging to immutable store 
• Tagging taxonomy: Enforce mandatory tags (cost centre, application, environment, data classification, owner) on all cloud resources 

6.2 Data Migration Strategy 

• Discover and classify: Complete inventory of all data assets; assign data classification; identify personal and sensitive data 
• Masking and anonymisation: Mask PII in non-production environments; no production data in dev/test 
• Replication strategy: Choose between live replication (AWS DMS, Azure Database Migration Service) vs offline bulk transfer (AWS Snowball) based on volume and downtime tolerance 
• Validation: Automated data integrity checks - row counts, checksums, business rule validation - at every stage 
• Cutover planning: Define blackout windows; rollback triggers; hypercare period post-cutover 

6.3 Application Migration Patterns (6 Rs) 

• Rehost (Lift & Shift): Move as-is to cloud VMs - fastest, least cloud-native benefit. Suitable for legacy apps with no refactoring budget 
• Replatform (Lift & Reshape): Minor optimisations - move to managed databases, containerise apps - without full rearchitecture 
• Refactor / Re-architect: Redesign for cloud-native services (microservices, serverless, managed caching). Highest value, highest effort 
• Repurchase: Replace with cloud-native SaaS (e.g., move on-premise CRM to Salesforce) 
• Retire: Decommission applications that are redundant or unused (typically 10–20% of estate) 
• Retain: Keep on-premise - applicable for mainframe workloads, ultra-low-latency systems, or where regulatory constraints preclude cloud.
  
  6.4 Security During Migration 
• Treat the migration pipeline itself as an attack surface: encrypt migration streams; dedicated migration accounts with time-bound access 
• Vulnerability scanning: Scan all migrated workloads before go-live; no migration sign-off without clean VAPT report 
• Zero-trust adoption: Implement network segmentation, micro-segmentation, and east-west traffic inspection in cloud 
• Key management: HSM-backed key management (AWS KMS / Azure Key Vault / GCP Secret Manager); hardware security modules for certificate management 

6.5 Testing and Validation 

• Functional testing: Full functional regression; integration testing with all dependent systems 
• Performance testing: Load testing at 150% of peak production volume; latency benchmarking 
• DR and BCP testing: Simulate AZ failure, region failure, and provider outage scenarios 
• Security testing: Mandatory VAPT (network + application) before production go-live; red team exercise for critical systems 
• User acceptance testing: Business user sign-off per defined UAT criteria; no forced cutover 

7. Measuring and Planning for Cloud Cost 

Cost management is consistently cited as the number-one challenge in banking cloud programmes. Cloud costs, if unmanaged, grow faster than on-premise costs - particularly in data-intensive banking environments. A robust FinOps practice is non-negotiable. 

7.1 Cloud Cost Categories in Banking 

7.2 FinOps Framework for Banking 

7.2.1 Inform Phase 

• Tag everything: Cost allocation tags on every resource, enforced at account level 
• Cost visibility: Cloud-native cost dashboards (AWS Cost Explorer, Azure Cost Management, GCP Cost Tools) plus third-party tools (CloudHealth, Apptio) 
• Unit economics: Measure cost per customer account, cost per transaction, cost per GB of data processed 

7.2.2 Optimise Phase 

• Rightsizing: Monthly rightsizing reviews using compute utilisation data; target average CPU utilisation of 40 - 60% 
• Reserved capacity: Commit 60 - 70% of baseline compute to 1-year or 3-year reserved instances; savings of 30 -60% vs on-demand 
• Spot / preemptible: Use spot instances for non-critical batch workloads (analytics, ML training, testing) - 60 -90% discount 
• Storage lifecycle: Implement automated lifecycle policies - move infrequently accessed data to cheaper tiers (S3 Glacier, Azure Cool, GCP Nearline) 
• Idle resource elimination: Weekly automated scans for stopped instances, unattached disks, orphaned snapshots - typical saving 10-15% of bill 

7.2.3 Operate Phase 

• Budget alerts: Hard budget limits per team/project; 80% and 100% threshold alerts 
• Anomaly detection: AI-based spend anomaly alerts (AWS Cost Anomaly Detection, Azure Cost Alerts) 
• Chargeback: Allocate cloud costs back to business units based on consumption; creates accountability 
• Monthly FinOps review: Cloud cost review as standing agenda item in technology governance forum 

7.3 TCO Modelling for Banking Cloud Migration 

A rigorous TCO (Total Cost of Ownership) model must be built before migration, comparing on-premise costs (including depreciation, power, cooling, space, staff, and refresh cycles) against cloud costs (including hyperscaler bill, migration costs, managed services, and training). 

Saints & Masters Benchmark 

In our experience across banking engagements, a well-executed cloud migration with rigorous FinOps delivers 30 to 45% TCO reduction over 3 years, net of migration and transformation costs. The break-even point is typically 18 to 24 months post-migration. 

8. Managed Services in Banking Cloud 

Managed services are the cornerstone of cloud value realisation in banking. By offloading infrastructure operations to hyperscaler-native or partner-managed services, banks free engineering capacity for innovation rather than undifferentiated heavy lifting. 

8.1 Key Managed Service Categories 

8.1.1 Managed Database Services 

• AWS: Amazon RDS, Aurora, DynamoDB, ElastiCache (Redis), DocumentDB 
• Azure: Azure SQL MI, Cosmos DB, Azure Cache for Redis, Azure Database for PostgreSQL 
• GCP: Cloud Spanner, AlloyDB, Memorystore, Firestore 
• Banking use cases: Core banking transaction ledger (Aurora/AlloyDB), fraud feature store (Redis), customer 360 (Cosmos DB/Firestore) 

8.1.2 Managed Security Services 

• SIEM: Microsoft Sentinel, AWS Security Hub + OpenSearch, Chronicle (GCP) 
• DDoS protection: AWS Shield Advanced, Azure DDoS Protection, Cloud Armor 
• WAF: AWS WAF, Azure WAF, Google Cloud Armor- mandatory for all customer-facing banking applications 
• Identity: Azure AD / Entra ID, AWS IAM Identity Center, GCP Identity Platform 

8.1.3 Managed Integration Services 

• API Management: AWS API Gateway, Azure APIM, Apigee (GCP) 
• Messaging: Amazon SQS/SNS/MSK, Azure Service Bus/Event Hub, Google Pub/Sub 
• ETL / Data integration: AWS Glue, Azure Data Factory, Dataflow (GCP) 

8.1.4 Managed AI Services 

• AWS Bedrock: Foundation model access (Anthropic Claude, Titan, Llama) for banking AI applications 
• Azure OpenAI: GPT-4o and embedding models for copilot, document processing, customer service AI 
• Vertex AI: Gemini models for analytics, AML AI, fraud detection pipelines 

8.2 Managed Services vs Self-Managed: Decision Framework 

9. Preparing a Banking Cloud RFP 

A well-structured RFP is the bank's primary instrument for selecting cloud implementation and managed services partners. An underprepared RFP results in non-comparable vendor responses, protracted evaluation cycles, and downstream delivery risk. 

9.1 RFP Preparation Checklist 

1. Define scope clearly: List workloads in scope, migration phases, in/out-of-scope systems 
2. Establish evaluation criteria: Technical capability, financial stability, regulatory compliance, references, pricing model, innovation roadmap 
3. Include compliance mandates: RBI IT Outsourcing Guidelines, DPDPA 2023, ISO 27001, PCI-DSS as mandatory requirements 
4. Require reference cases: Minimum 2 banking cloud migrations of comparable scale in India 
5. Pricing model clarity: Request itemised pricing - professional services, managed services, tooling, training - separately 
6. SLA requirements: Define SLA requirements upfront (availability, response time, incident resolution) 
7. Exit provisions: Require explicit response on data portability, exit assistance, and transition-out support 
8. Proof of Concept: Mandate a structured PoC for shortlisted vendors; define PoC success criteria 

9.2 Sample RFP — Banking Cloud Migration and Managed Services 

SAMPLE DOCUMENT 

The following is a template RFP. Bank-specific details (marked in [BRACKETS]) must be completed before issuance. This template is aligned with RBI IT Outsourcing Guidelines and DPDPA 2023 requirements. 

INVITATION TO RESPOND 

[BANK NAME] ('the Bank') invites proposals from qualified Cloud Implementation and Managed Services providers for the design, migration, and ongoing management of the Bank's cloud infrastructure in accordance with this Request for Proposal. 

RFP Reference: [BANK]-CLOUD-RFP-YYYY-MM 

Issue Date: [DATE]    Response Deadline: [DATE + 21 days]    Validity: 120 days 

SECTION A: BACKGROUND AND OBJECTIVES 

The Bank operates [X] branches / [Y] digital customers and processes approximately [Z] transactions per day. The Bank's technology estate currently comprises [describe current state — on-premise data centre(s), existing cloud footprint, core banking system]. 

Objectives: Migrate [defined workloads] to cloud within [timeline]; establish a managed cloud operations model; achieve regulatory compliance per RBI cloud framework; realise 30%+ TCO reduction over 3 years. 

SECTION B: SCOPE OF WORK 

• Phase 1 - Cloud Landing Zone and Foundation: Design and deploy cloud landing zone per hyperscaler Well-Architected Framework; connectivity (ExpressRoute / Direct Connect); identity federation; security baseline 
• Phase 2 - Dev/Test and Digital Workload Migration: Migration of all non-production environments; internet banking, mobile banking, and API platform 
• Phase 3 - Data and Analytics Platform: Enterprise data lake; regulatory reporting platform; fraud and AML analytics 
• Phase 4 - Core Systems Migration (if in scope): Detailed planning and execution of CBS migration in coordination with CBS vendor 
• Phase 5 - Managed Services: 24x7 cloud operations, monitoring, patching, incident management, FinOps, and security operations 

SECTION C: MANDATORY COMPLIANCE REQUIREMENTS 

• RBI IT Outsourcing Guidelines (RBI/2023/xx) compliance - Mandatory 
• Data residency: All customer financial data to reside in India-based cloud regions - Mandatory 
• Right to Audit: Cloud environment must be accessible for RBI / Bank audit - Mandatory 
• ISO 27001 certification of the cloud practice - Mandatory 
• PCI-DSS compliance for card data environments - Mandatory 
• DPDPA 2023 Data Processor Agreement - Mandatory 
• SOC 2 Type II report for managed services - Mandatory 

SECTION D: VENDOR QUALIFICATION CRITERIA 

• Minimum 3 years of banking or BFSI cloud implementation experience in India 
• At least 2 completed banking cloud migrations of equivalent scale - provide references 
• Certified partnership at Advanced/Premier level with proposed hyperscaler 
• Dedicated banking/financial services practice with at least [X] certified cloud architects 
• Demonstrated capability in RBI regulatory compliance for cloud 

SECTION E: TECHNICAL EVALUATION CRITERIA 

SECTION F: COMMERCIAL REQUIREMENTS 

• Provide separate pricing for: (a) Professional services - time and material with rate card; (b) Fixed-price milestones for defined deliverables; (c) Managed services - monthly recurring fee with defined service inclusions 
• Provide 3-year TCO model including migration costs, managed services, hyperscaler bill (estimated), and savings vs current state 
• Payment milestones linked to delivery milestones; retain 10% until 90-day post-go-live stability 
• SLA penalties: Availability SLA breach penalties at 10% / 20% / 30% of monthly managed services fee for SLA breaches of >0.5% / 1% / 2% 

SECTION G: SUBMISSION REQUIREMENTS 

1. Executive Summary (max 5 pages) 
2. Technical Proposal: Detailed architecture, migration methodology, risk management approach 
3. Compliance Matrix: Response to each mandatory compliance requirement 
4. References: 2 banking references with contact details 
5. Team composition: Key personnel CVs and certification evidence 
6. Commercial Proposal: Priced per Section F; 3-year TCO model in Excel 
7. PoC Proposal: Proposed PoC scope, timeline, and success criteria 

10. High-Cost Workloads and Optimisation Strategies 

Certain banking workloads are disproportionate cloud cost drivers. Identifying and managing these workloads proactively prevents bill shock and maintains the business case for cloud migration. 

10.1 Top High-Cost Banking Workloads

10.2 Cost Guardrails for High-Cost Workloads 

• Dedicated cost centre tags for each high-cost workload with separate budget and weekly alerting 
• Architecture review board sign-off required before deployment of any workload estimated at >₹50L/month cloud cost 
• Quarterly rightsizing review by cloud engineering team; mandatory for any resource >₹10L/month 
• FinOps team access to hyperscaler billing API with real-time dashboards; anomaly alerts within 1 hour of threshold breach 

11. Hybrid Cloud Options for Banking 

Pure public cloud is rarely the correct architecture for a fully regulated bank. A hybrid model - combining public cloud, private cloud, on-premise infrastructure, and co-location - allows banks to balance agility, cost, and regulatory compliance. 

11.1 Hybrid Architecture Patterns 

11.1.1 Public Cloud + On-Premise Core 

The most common banking architecture: digital channels, analytics, and non-sensitive workloads on public cloud; core banking system and sensitive data on-premise or in private data centre. Connected via ExpressRoute / Direct Connect with low-latency, private connectivity. 

11.1.2 Public Cloud + Co-location (Equinix / NxtGen) 

Bank co-locates critical systems in a Tier III/IV data centre (e.g., Equinix Mumbai) for control and compliance, while leveraging public cloud for scalable workloads. Saints & Masters' SnM Cloud is built on Equinix Mumbai infrastructure, providing sovereign co-location with hyperscaler connectivity. 

11.1.3 Outposts / Stack / GDC (Hyperscaler On-Premise) 

AWS Outposts, Azure Stack, and Google Distributed Cloud (GDC) extend hyperscaler infrastructure into the bank's own data centre or co-location facility. This provides cloud APIs and managed services while maintaining physical data control - particularly valuable for ultra-sensitive workloads with data sovereignty requirements. 

11.1.4 Edge Computing for Branches and ATMs 

Lightweight edge nodes at branches and ATM clusters, connected to central cloud hub, provide localised processing for latency-sensitive transactions and offline resilience. 

11.2 Hybrid Connectivity 

• AWS Direct Connect: Dedicated, private 1Gbps–100Gbps connectivity to AWS Mumbai/Hyderabad regions; bypass internet entirely 
• Azure ExpressRoute: Private circuit to Azure India West/South regions; Express Route Global Reach for multi-region 
• GCP Cloud Interconnect: Dedicated/partner interconnect to GCP Mumbai/Delhi regions 
• SD-WAN: Software-defined WAN for branch connectivity into cloud hub; primary and backup circuits 

12. The Saints & Masters Shipping Cloud Model for Banking 

Saints & Masters has developed a proprietary Shipping Cloud Model specifically designed for regulated banking entities. This model provides a structured, sovereignty-aware, compliance-first framework for selecting and executing cloud adoption across four primary configurations. 

What is the Shipping Cloud Model? 

The S&M Shipping Cloud Model treats cloud infrastructure like a fleet of vessels - each hyperscaler or deployment model is a 'ship' with distinct cargo capacity, route capability, and compliance certification. The bank acts as the port authority, directing workloads to the most appropriate vessel based on sensitivity, latency, and regulatory classification. 

12.1 AWS-Led Model 

Best for: Banks with largest workload volumes, strongest preference for managed service breadth, and existing AWS footprint 

• Primary hyperscaler: AWS (ap-south-1 Mumbai, ap-south-2 Hyderabad) 
• Core platform: AWS Control Tower for governance; AWS Security Hub; Amazon Aurora / RDS for databases; AWS Lambda + EKS for compute; Amazon MSK for streaming 
• AI/ML: Amazon Bedrock (Claude, Titan) for Agentic AI; SageMaker for custom ML; Amazon Fraud Detector; Amazon Macie for data classification 
• S&M delivery: Powered by our  dedicated AWS practice - AWS Advanced Partner with banking delivery certifications 
• Managed services: 24x7 AWS-native managed operations via S&M Cloud Operations Centre, Kochi 
• Ideal workloads: Core banking analytics, payment processing, fraud/AML, internet banking, regulatory reporting 
• Compliance posture: PCI-DSS, ISO 27001, SOC 2, RBI Framework-aligned; data residency enforced via AWS region policies 

12.2 Azure-Led Model 

Best for: Banks with significant Microsoft footprint (M365, Teams, Active Directory) or enterprise ERP (SAP on Azure); banks pursuing OpenAI-powered banking AI 

• Primary hyperscaler: Azure (India West - Pune, India South - Chennai) 
• Core platform: Azure Management Groups; Microsoft Sentinel (SIEM); Azure SQL MI / Cosmos DB; AKS; Azure Event Hub 
• AI/ML: Azure OpenAI Service (GPT-4o) for intelligent banking assistant; Azure Machine Learning; Microsoft Fabric for data analytics; Purview for data governance 
• S&M delivery: Powered by our dedicated Microsoft / Azure practice) - Microsoft Solutions Partner for Azure with Financial Services specialisation 
• Microsoft Cloud for Financial Services: Pre-built banking industry cloud components on Azure -customer onboarding, risk management, compliance manager 
• Ideal workloads: Customer service AI (Copilot), document processing, enterprise data governance, hybrid identity, SAP BFSI workloads 
• Compliance posture: Microsoft Cloud for Sovereignty; Azure Policy; DPDPA controls via Microsoft Purview; RBI-aligned data residency 

12.3 GCP-Led Model 

Best for: Banks with strong data analytics focus, AML/fraud transformation programmes, or Gemini AI adoption plans 

• Primary hyperscaler: GCP (asia-south1 Mumbai, asia-south2 Delhi) 
• Core platform: GCP Resource Manager; Security Command Center; AlloyDB / Cloud Spanner; GKE Autopilot; Pub/Sub 
• AI/ML: Vertex AI (Gemini) for analytics and AI; AML AI - Google's native banking AML solution; BigQuery ML for in-database ML; Document AI for KYC processing 
• S&M delivery: S&M GCP practice in active development; strategic GCP partner relationships in place 
• Ideal workloads: Enterprise data warehouse (BigQuery), AML transformation, regulatory analytics, trade surveillance 
• Compliance posture: Google Assured Workloads for regulated data; GCP Sovereign Controls; DPDPA-aligned data processing 

12.4 Hybrid Model 

Best for: Large banks with diverse workload profiles, multi-vendor strategy, or complex data sovereignty requirements 

• Architecture: AWS or Azure as primary hyperscaler for operational workloads; secondary hyperscaler for DR, analytics, or specialised AI; on-premise for mainframe and ultra-sensitive data 
• S&M approach: Hyperscaler-agnostic managed services layer using Kubernetes (EKS/AKS/GKE), Terraform IaC, and unified observability (Datadog / Dynatrace / CloudWatch) 
• Interoperability: SnM Cloud on Equinix Mumbai as the neutral interconnection hub - connects bank to all three hyperscalers with sovereign co-location capability 
• Data fabric: Apache Iceberg / Delta Lake for cloud-agnostic data layer; Airbyte / dbt for cloud-portable ETL 
• Key advantage: No single-hyperscaler concentration risk; best-of-breed service selection; regulatory optionality 

12.5 On-Premise / Sovereign Model 

Best for: Banks with strict RBI data sovereignty requirements, ultra-sensitive workloads, or Phase 0/1 migration status 

• SnM Cloud on Equinix: Saints & Masters operates a sovereign private cloud on Equinix Mumbai infrastructure - Tier III, RBI-compliant, direct hyperscaler peering, managed by S&M Cloud Operations Centre 
• Hyperscaler on-prem extensions: AWS Outposts, Azure Stack Hub, GDC - hyperscaler APIs in bank's own facility 
• Agentic AI Lab, Kochi: For banks exploring local LLM deployment (Sarvam AI, Phi-3, open-source models) with on-premise inference - no data leaving Indian sovereign perimeter 
• Data sovereignty enforcement: All customer data, transaction data, and regulatory data processed and stored within Indian jurisdiction; no cross-border data transfer.
  

12.6 Model Selection Matrix 

13. Compliance Aspects - RBI and Global Central Banks 

Regulatory compliance is the paramount constraint in banking cloud adoption. Non-compliance with RBI or central bank mandates can result in supervisory action, reputational damage, and mandatory rollback of cloud programmes. The following summarises the key compliance requirements. 

13.1 Reserve Bank of India (RBI) - India 

13.1.1 RBI Master Direction on IT Outsourcing (Updated 2023) 

• Cloud hosting of customer data and banking applications constitutes 'material outsourcing' 
• Board approval required for material outsourcing decisions 
• Due diligence on cloud provider: Financial stability, security practices, sub-processor management, BCP capability 
• Right to audit: Contracts must include RBI's explicit right to audit the cloud environment and the cloud provider 
• Exit strategy: Documented, tested exit plan from cloud provider; minimum 6-month transition-out provision 
• Incident reporting: Cloud security incidents must be reported to RBI within prescribed timelines (typically 6 hours for critical incidents) 

13.1.2 RBI Cloud Framework for Regulated Entities (2023) 

• Data classification mandated before cloud migration; sensitive customer data requiring enhanced controls 
• Data localisation: Customer financial data must be stored in India; cross-border transfer only for specific exempted categories with approval 
• Encryption: End-to-end encryption of data in transit and at rest; encryption key management under bank's control 
• Access controls: Multi-factor authentication for privileged access; role-based access control; quarterly access reviews 
• Monitoring: Real-time monitoring of cloud environment; integration with bank's SOC 

13.1.3 DPDPA 2023 (Digital Personal Data Protection Act) 

• Banks are Data Fiduciaries; cloud providers are Data Processors - Data Processing Agreement mandatory 
• Customer consent management: Documented, revocable consent for data processing; consent audit trail in cloud 
• Data Principal rights: Right to access, correct, and erase personal data - cloud architecture must support these requests 
• Significant Data Fiduciaries (SDF): Large banks likely classified as SDFs - additional obligations including Data Protection Officer, DPIA, data audit 
• Cross-border transfer: Personal data transfer abroad only to countries notified by GOI; not yet fully implemented but cloud architecture must be ready 

 13.2 Global Central Bank Requirements 

13.3 Compliance Architecture Principles 

• Privacy by design: Data classification and privacy controls built into cloud architecture from Day 1, not retrofitted 
• Compliance as code: Policy controls (data residency, encryption, access) enforced via Infrastructure-as-Code; automated compliance scanning (AWS Config Rules, Azure Policy, GCP Organization Policy) 
• Audit trail: Immutable, tamper-proof audit logs for all cloud activities (CloudTrail, Azure Monitor, Cloud Audit Logs) - retained per regulatory requirement (typically 7–10 years) 
• Third-party attestations: Annual SOC 2 Type II, ISO 27001 re-certification, PCI-DSS QSA assessment - evidence for regulatory submissions 

14. Cloud Adoption Checklist for Banking 

This consolidated checklist serves as a go/no-go gate for each migration phase. All items must be formally signed off by the responsible owner before proceeding to the next phase. 

Phase 0 - Strategy and Governance 

• Board-level approval for cloud strategy and material outsourcing decision 
• Cloud programme structure established: Executive Sponsor, Cloud Programme Director, Cloud CoE team 
• Hyperscaler selection completed with documented evaluation and rationale 
• RBI / regulatory notification submitted (where required for material outsourcing) 
• Cloud partner / SI selected via formal RFP process 
• Data classification exercise completed for all in-scope data assets 
• Cloud risk assessment documented and approved by CRO 
• FinOps framework and governance established; FinOps owner nominated 
• Cloud legal framework: MSA, DPA, SLA, exit provisions reviewed by legal and compliance 

Phase 1 - Foundation (Landing Zone) 

• Cloud landing zone deployed per hyperscaler Well-Architected Framework 
• Account/subscription structure implemented with governance guardrails 
• Identity federation (AD / IAM) live; MFA enforced for all privileged users 
• Network architecture live: VPC/VNet, subnets, NSG/SG, firewall, ExpressRoute/Direct Connect 
• Encryption baseline: KMS configured; BYOK/CMEK for sensitive data stores 
• Logging: CloudTrail/Azure Monitor/Cloud Audit Logs to immutable central store 
• CSPM tool deployed; zero critical findings on CIS Benchmark baseline 
• Tagging policy enforced; initial cost allocation structure active 
• DR design documented; RTO/RPO defined per application 

Phase 2 - First Workload Migration 

• Application dependency mapping completed 
• Migration runbook documented and reviewed 
• Data masking applied to non-production environments 
• VAPT completed; all critical and high findings remediated 
• Performance testing completed at 150% of peak load 
• User acceptance testing signed off by business owners 
• DR drill completed; RTO/RPO validated 
• Incident response runbook documented; SOC integrated with cloud alerts 
• Hypercare plan (30/60/90 day) in place post go-live 
• Business sign-off on production readiness 

Ongoing - Operations and Compliance 

• Monthly FinOps review with cost vs budget variance report 
• Quarterly access review: all privileged cloud access reviewed and recertified 
• Quarterly DR drill: simulated AZ/region failure; RTO/RPO validation 
• Annual VAPT: full penetration test of cloud environment 
• Annual ISO 27001 / SOC 2 / PCI-DSS recertification 
• Annual cloud concentration risk assessment 
• Regulatory submission: Annual cloud outsourcing review report to RBI / regulator 
• Continuous: CSPM scan findings reviewed weekly; critical findings SLA: 24 hours remediation 
• Continuous: Cloud cost anomaly alerts actioned within 4 hours 
• Annual exit strategy test: Validate data portability and transition-out procedures