Exit and Concentration Risk
The regulatory concern that an institution cannot leave a critical provider, and that too much of the sector depends on the same few providers.
Financial regulators, and increasingly others, ask two questions that make cloud strategy a board-level topic rather than an engineering one.
Exit: if this provider fails, exits the market, is sanctioned, or becomes commercially impossible, can you continue to operate, and how long would it take? The requirement is usually a documented and tested exit plan, not an assertion. Testing is where most plans fail, because an exit plan that has never been exercised is an essay.
Concentration: if a large share of the sector runs on the same provider and it fails, the systemic effect exceeds any individual firm's risk assessment — so the regulator's concern is not fully addressed by any one firm's controls.
The architectural responses vary in cost by orders of magnitude, and the honest conversation is about which is being bought. Portability through open interfaces — containers, open table formats, standard protocols — is cheap and covers a real portion of the risk. Multi-region within one provider addresses regional failure and not provider failure. Active-active multi-cloud addresses it fully at very high cost and permanent complexity, and forces every design to the lowest common denominator.
The position most institutions land on defensibly: portable architecture, documented and periodically rehearsed exit, data held in formats and locations that can be moved, and concentration accepted explicitly at board level with the reasoning recorded rather than assumed.