A single European bank haggling with Amazon or Microsoft has almost no leverage. A few hundred of them haggling together might. That, stripped to its essence, is the recommendation Dutch regulators handed their government on Friday, in a report warning that Europe's reliance on American technology is deepening rather than easing.
The proposals came from a group of Dutch watchdogs that includes De Nederlandsche Bank, the country's central bank, and its data protection authority.
Their central suggestion is blunt: banks and finance firms should combine their buying power so they are not picked off one by one in negotiations with US tech giants, according to Bloomberg, which reported the document.
The warning underneath it is that digital dependencies on overseas companies “continue to grow” among the institutions the regulators supervise, despite years of European rhetoric about strategic autonomy. That gap between the policy ambition and the day-to-day procurement reality runs through the whole report.
The concern is not confined to cloud storage. The watchdogs group cloud and artificial intelligence together as critical services where Europe has quietly handed control to a handful of foreign firms, the same anxiety driving Brussels' tech sovereignty package and its curbs on US providers handling sensitive data.
The numbers explain the alarm. Amazon Web Services, Microsoft Azure and Google Cloud together account for more than 70% of the European cloud market, while the continent's own providers hold around 15%, a share that has barely shifted in years.
For a bank, that concentration is not just a commercial matter but a legal one. Europe's cloud dependency is a political risk as much as a technical one, sharpened by the US Cloud Act, which can compel American companies to hand data to US authorities regardless of where it is physically stored.
Pooling demand is meant to change the arithmetic. If banks negotiate as a bloc, the thinking goes, they can press for better prices, stronger data guarantees and genuine exit options, rather than signing whatever contract a hyperscaler puts in front of them alone.
There is a certain irony in where the advice originates. De Nederlandsche Bank has itself been moving essential cloud services off AWS, and earlier this year chose Schwarz Digits, the IT arm of the German group behind the discount chain Lidl, as its European alternative. The regulator is, in effect, recommending a path it has already started walking.
The Dutch intervention slots into a wider European scramble. The Netherlands recently blocked a US firm from buying the cloud host behind its national digital-identity system, its first such veto, while Brussels has been assembling rules that would push public bodies to measure and reduce their reliance on non-EU suppliers.
The obstacle is that credible alternatives remain thin on the ground. European cloud hosts such as OVHcloud, Hetzner and Scaleway offer a real escape route, but they trail the American incumbents on scale, managed-services depth and the breadth of tooling that large banks have built their systems around.
That is the tension the report does not resolve. Pooled buying power can improve the terms of dependence, but it cannot conjure a European provider capable of running a continent's banking infrastructure overnight.
Whether the banks act on the advice is a separate question. Coordinating procurement across rival institutions in different countries is hard, and the commercial pull of the incumbents, whose performance is rarely the complaint, remains strong.
For now, the document is a recommendation rather than a rule, addressed to a government rather than the banks directly. But it captures a mood that has hardened across Europe over the past year: the discomfort of running critical financial systems on infrastructure that is owned, and legally reachable, an ocean away.