Co esponding au ho : Sai K ishna Gu am.
Copy igh © 2025 Au ho (s) e ain he copy igh o his a icle. This a icle is published unde he e ms o he C ea i e Commons A ibu ion License 4.0.
Da a so e eign y and compliance managemen in mul i-cloud inancial pla o ms
Sai K ishna Gu am *
Visa Inc., USA.
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
Publica ion his o y: Recei ed on 01 Ma ch 2025; e ised on 26 Ap il 2025; accep ed on 29 Ap il 2025
A icle DOI: h ps://doi.o g/10.30574/wja .2025.26.1.1462
Abs ac
The p oli e a ion o mul i-cloud s a egies in inancial ins i u ions p esen s signi ican challenges o da a so e eign y
and egula o y compliance ac oss ju isdic ional bounda ies. As o ganiza ions dis ibu e hei in as uc u e ac oss
mul iple cloud p o ide s, hey ace complex equi emen s o p o ec ing sensi i e inancial da a while adhe ing o
di e se egula o y amewo ks. This a icle examines ou c i ical aspec s o mul i-cloud compliance managemen :
compliance-as-code implemen a ion s a egies, da a p o ec ion, and so e eign y con ols, inancial indus y-speci ic
egula o y managemen , and iden i y go e nance amewo ks. By embedding compliance di ec ly in o deploymen
pipelines, implemen ing obus enc yp ion and da a seg ega ion measu es, na iga ing specialized inancial egula ions,
and es ablishing comp ehensi e iden i y managemen sys ems, inancial ins i u ions can e ec i ely main ain
compliance while le e aging he bene i s o mul i-cloud a chi ec u es. These app oaches enable o ganiza ions o
add ess he inhe en ensions be ween echnological inno a ion and egula o y adhe ence in an inc easingly complex
global landscape.
Keywo ds: Da a So e eign y; Mul i-Cloud Compliance; Compliance-As-Code; Financial Regula ion; Iden i y
Go e nance
1. In oduc ion
Financial ins i u ions wo ldwide ha e emb aced mul i-cloud s a egies a an unp eceden ed a e, undamen ally
ans o ming hei echnological in as uc u e and compliance landscapes. Acco ding o Flexe a's 2024 S a e o he
Cloud Repo , 87% o en e p ise o ganiza ions now ha e a mul i-cloud s a egy, wi h a signi ican po ion o inancial
se ices i ms adop ing his app oach o mi iga e isk and a oid endo lock-in. Financial sec o esponden s epo ed
spending an a e age o 32% o hei IT budge s on cloud se ices, a igu e expec ed o g ow o 39% wi hin he nex 12
mon hs [1]. This dis ibu ed app oach, while o e ing enhanced scalabili y, edundancy, and ope a ional esilience,
c ea es signi ican challenges in main aining da a so e eign y and egula o y compliance ac oss di e en ju isdic ions
and cloud en i onmen s. Da a so e eign y— he p inciple ha da a is subjec o he laws o he coun y whe e i is
s o ed—has become a c i ical conside a ion as inancial ins i u ions expand globally.
The complexi y o managing sensi i e da a ac oss mul i-cloud en i onmen s ca ies subs an ial inancial implica ions.
IBM's 2024 Cos o a Da a B each Repo e eals ha o ganiza ions using hyb id cloud en i onmen s expe ience an
a e age da a b each cos o $4.39 million, while hose wi h public cloud en i onmen s ace cos s o $4.90 million pe
inciden . Fu he mo e, o ganiza ions wi h high le els o compliance ailu es expe ienced b each cos s ha we e $2.31
million highe han hose wi h low compliance ailu es, unde sco ing he inancial impe a i e o obus compliance
managemen [2]. Wi h inancial da a being pa icula ly sensi i e and hea ily egula ed, o ganiza ions mus na iga e
complex egula o y amewo ks, including GDPR, PCI-DSS, and CCPA, while deli e ing seamless se ices o cus ome s.
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4023
The challenges a e u he compounded by he inc easing complexi y o mul i-cloud a chi ec u e. Flexe a's esea ch
indica es ha 93% o o ganiza ions s uggle wi h mul i-cloud cos managemen , while 89% ace signi ican secu i y
challenges in hese en i onmen s. Addi ionally, 87% o en e p ises epo di icul ies wi h go e nance and compliance
ac oss mul iple cloud pla o ms [1]. Fo inancial ins i u ions speci ically, no es ha he a e age ime o iden i y and
con ain a da a b each in he inancial sec o is 230 days, wi h egula o y ines and penal ies accoun ing o 12.8% o
o al b each cos s [2].
This dis ibu ed echnological landscape equi es sophis ica ed app oaches o compliance managemen . The Flexe a
epo highligh s ha 78% o en e p ises now employ dedica ed cloud cen e s o excellence o cloud eams o manage
hei mul i-cloud s a egy, wi h 71% implemen ing au oma ed policies o en o ce compliance and go e nance
equi emen s [1]. Simila ly, IBM ound ha o ganiza ions wi h ully deployed secu i y AI and au oma ion expe ienced
b each cos s ha we e $1.76 million lowe han hose wi hou such echnologies, sugges ing he alue o au oma ed
compliance ools in mul i-cloud en i onmen s [2]. This a icle explo es key s a egies o managing compliance in mul i-
cloud inancial pla o ms and p esen s e ec i e app oaches o na iga ing his complex egula o y e ain.
2. Mul i-cloud compliance ecosys em amewo k
Based on he comp ehensi e a icle on da a so e eign y and compliance in mul i-cloud inancial pla o ms, I' e
de eloped a concep ual amewo k ha isually maps he compliance ecosys em. This amewo k o ganizes he a ious
componen s discussed in he a icle in o i e in e connec ed laye s ha inancial ins i u ions mus add ess when
managing compliance ac oss mul i-cloud en i onmen s.
2.1. F amewo k O e iew
The amewo k is s uc u ed as a laye ed model wi h bidi ec ional ela ionships be ween componen s, illus a ing how
di e en aspec s o compliance managemen in e ac ac oss he mul i-cloud landscape:
2.1.1. S a egic Laye : P o ides execu i e o e sigh and go e nance s uc u es
• Execu i e-Le el Compliance O e sigh
• Cloud Go e nance Models
• Compliance Responsibili y Ma ices
2.1.2. Tac ical Laye : Implemen s compliance h ough au oma ion and code
• Compliance-as-Code Implemen a ion
• Au oma ed Compliance Ve i ica ion
• In as uc u e-as-Code Templa es
• Policy-as-Code F amewo ks
• Con inuous Compliance Moni o ing
2.1.3. Da a P o ec ion Laye : Secu es sensi i e inancial da a
• Cloud-Na i e Enc yp ion
• Tokeniza ion & Anonymiza ion
• Geog aphic Da a Seg ega ion
• Da a Classi ica ion F amewo ks
• Da a T ans e Impac Assessmen s
2.1.4. Iden i y Managemen Laye : Con ols access ac oss cloud bounda ies
• Fede a ed Iden i y Managemen
• Role-Based Access Con ol
• Mul i-Fac o Au hen ica ion
• P i ileged Access Managemen
2.1.5. Regula o y Laye : Add esses inancial indus y compliance equi emen s
• Indus y-Speci ic Regula ions
• Cen al Bank Guidelines
• Financial Da a T ansmission Con ols
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4024
• Consolida ed Regula o y Repo ing
• Reco d Re en ion Requi emen s
• C oss-Bo de Compliance Requi emen s
2.2. Key F amewo k Rela ionships
The in e connec ions be ween laye s ep esen c ucial in eg a ion poin s:
• The S a egic Laye connec s wi h all o he laye s, showing how go e nance models in luence implemen a ion
decisions
• Compliance-as-Code (Tac ical Laye ) di ec ly suppo s Da a P o ec ion and Iden i y Managemen
• Regula o y equi emen s in o m all o he laye s, pa icula ly a ec ing da a p o ec ion s a egies
• Compliance Responsibili y Ma ices se e as a cen al connec o de ining accoun abili y ac oss all domains
This amewo k helps inancial ins i u ions isualize he complex in e play be ween go e nance, implemen a ion,
p o ec ion mechanisms, iden i y con ols, and egula o y equi emen s in mul i-cloud en i onmen s. I can be used as
a planning ool o ensu e comp ehensi e co e age o compliance conce ns and o iden i y a eas equi ing addi ional
in es men o a en ion.
Figu e 1 Mul i-Cloud Compliance Ecosys em F amewo k
3. Compliance-as-Code Implemen a ion S a egies
Financial ins i u ions can add ess mul i-cloud compliance challenges by embedding compliance di ec ly in o hei
deploymen pipelines. Acco ding o IBM's Financial Se ices Indus y T ends epo , inancial ins i u ions a e
expe iencing an a e age o 83% mo e egula o y changes annually han i e yea s ago, wi h compliance cos s
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4025
consuming be ween 15-20% o ope a ional budge s [3]. This o e whelming compliance bu den has d i en
o ganiza ions o seek au oma ed solu ions. IBM's analysis e eals ha inancial ins i u ions implemen ing compliance-
as-code p inciples expe ience a 41% educ ion in compliance- ela ed inciden s and lowe hei compliance
managemen cos s by an a e age o 30% compa ed o ins i u ions using adi ional manual p ocesses.
A signi ican ans o ma ion is occu ing as o ganiza ions shi om qua e ly compliance e iews o con inuous
e i ica ion. Indus y insigh s om banking compliance specialis s indica e ha inancial ins i u ions implemen ing
au oma ed compliance wo k lows educe hei isk exposu e by as much as 62% while simul aneously accele a ing
hei ime- o-ma ke o new digi al se ices [4]. By in eg a ing compliance equi emen s di ec ly in o he de elopmen
pipeline, o ganiza ions ensu e ha in as uc u e and applica ions comply wi h ele an egula ions be o e
deploymen , d ama ically educing he isk o cos ly emedia ion e o s and po en ial egula o y penal ies ha can
each up o 4% o global e enue o se ious iola ions.
The implemen a ion o au oma ed compliance e i ica ion ools has p o en pa icula ly e ec i e in mul i-cloud
en i onmen s. IBM epo s ha inancial o ganiza ions le e aging cloud p o ide compliance ools such as AWS
A i ac , Mic oso Compliance Manage , and Google Cloud's Compliance Repo s dec ease hei compliance e i ica ion
cos s by app oxima ely $1.2 million annually while educing e i ica ion imelines by 83% [3]. These ools
sys ema ically analyze cloud con igu a ions agains egula o y equi emen s, iden i ying po en ial compliance gaps
be o e hey mani es in p oduc ion en i onmen s. A majo global bank implemen ed au oma ed e i ica ion ac oss hei
cloud esou ces, esul ing in a 67% inc ease in iden i ied compliance isks ha would ha e o he wise gone unde ec ed
un il egula o y examina ion.
Figu e 2 Mul i-Cloud Da a So e eign y Con ols
In as uc u e-as-Code (IaC) empla es ha e become ounda ional elemen s o compliance-as-code s a egies.
Acco ding o banking indus y compliance expe s, inancial ins i u ions ha implemen p e-app o ed, complian IaC
empla es achie e 76% highe consis ency in hei egula o y adhe ence ac oss all deploymen en i onmen s [4]. These
empla es codi y egula o y equi emen s di ec ly in o in as uc u e de ini ions, ensu ing consis en compliance
ac oss mul i-cloud deploymen s. This app oach enables inancial ins i u ions o main ain compliance despi e he apid
inc ease in egula o y complexi y, whe e he a e age global bank mus now adhe e o mo e han 120,000 pages o
egula ions ha change app oxima ely 200 imes daily.
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4026
Policy-as-code amewo ks ep esen ano he c i ical elemen o mode n compliance s a egies. IBM's esea ch shows
ha o ganiza ions implemen ing policy-as-code solu ions educe hei audi p epa a ion ime by 59% and dec ease he
cos o compliance ailu es by an a e age o $2.3 million annually [3]. These amewo ks enable o ganiza ions o exp ess
complex egula o y equi emen s as execu able code ha can au oma ically alida e esou ces h oughou he
deploymen li ecycle. Financial ins i u ions using policy au oma ion ools epo 87% ewe egula o y indings du ing
examina ions compa ed o hose using manual compliance e i ica ion p ocesses.
Con inuous compliance moni o ing comple es he compliance-as-code ecosys em by p o iding eal- ime isibili y in o
egula o y adhe ence. Banking compliance specialis s no e ha o ganiza ions implemen ing con inuous moni o ing can
educe hei mean- ime- o- emedia e compliance issues om weeks o hou s while simul aneously educing he isk o
egula o y penal ies by up o 73% [4]. This d ama ic imp o emen in de ec ion and emedia ion capabili y enables
inancial ins i u ions o ope a e wi h con idence in highly egula ed en i onmen s whe e he cos o non-compliance
has eached eco d le els. IBM's analysis indica es ha inancial ins i u ions now ace an a e age cos o $15 million pe
egula o y compliance ailu e, c ea ing a compelling business case o in es ing in au oma ed compliance solu ions [3].
4. Da a P o ec ion and So e eign y Con ols
P o ec ing sensi i e inancial da a ac oss mul i-cloud en i onmen s equi es obus secu i y measu es and da a
so e eign y con ols. Acco ding o McKinsey's 2023 Global Banking Annual Re iew, he banking sec o is expe iencing
a signi ican ansi ion wi h echnology and a i icial in elligence, d i ing e iciency gains o 15-25% in ope a ions and
subs an ial alue c ea ion ac oss he inancial se ices landscape [5]. This ansi ion is occu ing in an en i onmen
whe e egula o y compliance has become inc easingly challenging, wi h banks acing unp eceden ed sc u iny o e hei
da a p o ec ion p ac ices. The e iew highligh s how inancial ins i u ions ha implemen comp ehensi e da a
p o ec ion and so e eign y con ols can main ain hei posi ion among he op-pe o ming ins i u ions ha achie e
e u ns on equi y o 14-15% e en amid ma ke unce ain ies.
Cloud-na i e enc yp ion has become a ounda ional elemen o da a so e eign y s a egies. McKinsey's esea ch e eals
ha op-qua ile banks in es ing in esilien digi al in as uc u e, including obus enc yp ion capabili ies, gene a e
50% highe e u ns han hei pee s [5]. By main aining con ol o enc yp ion keys, hese o ganiza ions es ablish
so e eign con ol o e hei da a ega dless o whe e i physically esides. The banking e iew no es ha inancial
ins i u ions implemen ing comp ehensi e enc yp ion ac oss hei mul i-cloud en i onmen s signi ican ly educe hei
ulne abili y o egula o y penal ies, which ha e g own o unp eceden ed le els, wi h global inancial ins i u ions
paying o e $36 billion in ines o compliance ailu es in ecen yea s.
Tokeniza ion and anonymiza ion echnologies p o ide complemen a y da a p o ec ion capabili ies. As no ed, in In
Coun y’s analysis o da a so e eign y laws o inancial se ices companies, ins i u ions ope a ing in ma ke s like
Indonesia, Russia, and China mus na iga e egula ions ha explici ly equi e ce ain ca ego ies o inancial da a o
emain wi hin na ional bo de s [6]. These echnologies eplace sensi i e da a elemen s wi h non-sensi i e equi alen s
while p ese ing da a u ili y o analy ics and p ocessing. In Coun y epo s ha inancial ins i u ions implemen ing
okeniza ion can e ec i ely add ess compliance equi emen s in ju isdic ions like Aus alia, whe e he Financial Sec o
(Collec ion o Da a) Ac manda es s ic con ol o e iden i iable inancial in o ma ion while s ill main aining unc ional
da a access o business ope a ions.
Geog aphic da a seg ega ion ep esen s ano he c i ical componen o da a so e eign y amewo ks. McKinsey's
banking e iew emphasizes ha geog aphic segmen a ion o da a in as uc u e has become essen ial as egula o y
agmen a ion con inues o inc ease ac oss global ma ke s [5]. By a chi ec ing sys ems o s o e and p ocess da a wi hin
speci ic geog aphic bounda ies, o ganiza ions main ain compliance wi h inc easingly s ingen egional egula ions.
This app oach is pa icula ly c ucial in ma ke s iden i ied by coun y, such as he Uni ed A ab Emi a es, whe e he DIFC
Da a P o ec ion Law imposes equi emen s o local p ocessing o inancial in o ma ion, o in Luxembou g, whe e he
Financial Sec o Law places s ic limi a ions on whe e cus ome inancial da a can be s o ed and p ocessed [6].
Da a classi ica ion amewo ks p o ide he in elligence laye o e ec i e so e eign y con ols. McKinsey's analysis
sugges s ha inancial ins i u ions equipped wi h ad anced da a managemen capabili ies can achie e up o 30% highe
ope a ional e iciency while main aining egula o y compliance [5]. These sys ems enable o ganiza ions o apply
app op ia e con ols based on da a sensi i i y and egula o y equi emen s. This capabili y is inc easingly i al as
ju isdic ions implemen di e gen equi emen s o di e en classes o inancial da a, wi h In Coun y documen ing
how coun ies like Singapo e dis inguish be ween di e en ca ego ies o inancial in o ma ion, wi h a ying le els o
so e eign y equi emen s o each classi ica ion [6].
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4027
Da a ans e impac assessmen s comple e he so e eign y con ol amewo k by p o iding o mal e alua ion
p ocesses. The McKinsey e iew highligh s how leading banks a e adop ing s uc u ed app oaches o isk managemen
ha in eg a e compliance conside a ions h oughou hei ope a ional p ocesses [5]. These assessmen s enable
o ganiza ions o e alua e he compliance implica ions o da a mo emen s be o e hey occu , p e en ing cos ly
iola ions. Acco ding o In Coun y's analysis, assessmen s ha e become essen ial as ju isdic ions inc easingly
implemen no i ica ion equi emen s o c oss-bo de da a ans e s, such as Tu key's Banking Law equi ing p io
no i ica ion o he Banking Regula ion and Supe ision Agency be o e ans e ing ce ain inancial da a ou side he
coun y o Saudi A abia's cloud compu ing egula o y amewo k equi ing impac assessmen s be o e s o ing o
p ocessing inancial in o ma ion in o eign da a cen e s [6].
Table 1 Key Financial Regula ions Impac ing Mul i-Cloud Da a So e eign y
Regula o y
F amewo k
Ju isdic ion
Key Da a So e eign y
Requi emen s
Mul i-Cloud Impac
GDPR
Eu opean
Union
• Da a mus be p ocessed
acco ding o six da a
p o ec ion p inciples
Requi es logical sepa a ion o EU ci izen
da a and mechanisms o ack da a
loca ion ac oss clouds
• T ans e o da a ou side he
EEA equi es adequa e
sa egua ds
• Righ o be o go en and
da a po abili y
PCI-DSS
Global
• Ca dholde da a s o age
es ic ions
Paymen in o ma ion may equi e
dedica ed enc yp ed en i onmen s in
each cloud wi h es ic ed access
• Enc yp ion o paymen da a
ac oss open ne wo ks
• Access con ol equi emen s
o ca dholde da a
GLBA
Uni ed S a es
• Financial ins i u ions mus
explain in o ma ion-sha ing
p ac ices
May equi e speci ic con igu a ions o
US cus ome inancial da a ac oss cloud
en i onmen s
• Sa egua ds o p o ec ing
cus ome in o ma ion
• P ohibi ion agains sha ing
accoun in o ma ion
MAS TRM
Singapo e
• Requi es exi plans o cloud
se ices
Singapo ean inancial da a may equi e
speci ic egional s o age wi h enhanced
moni o ing capabili ies
• S ong con ols o sensi i e
da a
• Regula audi and
compliance assessmen
CCPA/CPRA
Cali o nia,
USA
• Consume igh s o access,
dele e, and op -ou o da a
sales
May necessi a e sepa a e da a handling
p ocesses o Cali o nia esiden s ac oss
cloud pla o ms
• De ailed p i acy disclosu es
• Requi emen s o se ice
p o ide con ac s
APRA CPS 234
Aus alia
• Explici boa d app o al o
cloud a angemen s
Requi es clea delinea ion o secu i y
esponsibili ies ac oss mul iple cloud
p o ide s
• In o ma ion secu i y
capabili y ac oss supply
chain
• No i ica ion obliga ions o
ma e ial ou sou cing
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4028
5. Financial indus y-speci ic egula o y managemen
The inancial sec o aces unique egula o y challenges ha demand specialized app oaches in mul i-cloud
en i onmen s. As digi al ans o ma ion accele a es, adi ional egula o y amewo ks designed o he analog age a e
s uggling o keep pace. Acco ding o The Regula o y Re iew, inancial egula ions ha e expanded d ama ically in ecen
decades, wi h he Dodd-F ank Ac alone adding 27,000 new egula o y es ic ions o he U.S. inancial sec o [7]. This
egula o y complexi y is u he ampli ied in mul i-cloud en i onmen s, whe e da a and applica ions span mul iple
ju isdic ions wi h dis inc compliance equi emen s. The expanding egula o y bu den has signi ican inancial
implica ions, wi h communi y banks spending app oxima ely $5.4 billion annually jus o main ain compliance wi h
ede al egula ions—o en equi ing hese ins i u ions o employ one compliance o ice o e e y h ee employees
se ing cus ome s.
Cen al Bank and Financial Regula o Guidelines ha e become inc easingly p esc ip i e ega ding cloud compu ing. In
a speech deli e ed a he Rese e Bank o Aus alia con e ence, he Go e no o S e iges Riksbank no ed ha cen al
banks mus balance hei ole as gua dians o inancial s abili y wi h he need o accommoda e echnological inno a ion
[8]. This egula o y balancing ac has c ea ed a complex landscape o cloud adop ion in inancial se ices. The digi al
ans o ma ion o banking has p omp ed egula o s o de elop new guidelines speci ically add essing echnology isks,
wi h egula ions expanding om hei adi ional ocus on capi al equi emen s o encompass ope a ional esilience,
da a secu i y, and hi d-pa y isk managemen . As inancial ins i u ions ansi ion o mul i-cloud en i onmen s, hey
ace signi ican challenges in in e p e ing and implemen ing hese e ol ing guidelines ac oss di e en ju isdic ions,
each wi h i s own egula o y app oach o eme ging echnologies.
Financial Da a T ansmission Con ols ep esen ano he c i ical egula o y domain o mul i-cloud en i onmen s. The
Regula o y Re iew highligh s how he g ow h o digi al inance has c ea ed new challenges o secu ing da a
ansmissions ac oss ju isdic ional bounda ies [7]. The inancial sec o now p ocesses unp eceden ed olumes o
sensi i e ansac ion da a h ough cloud pla o ms, aising complex ques ions abou egula o y ju isdic ion and
go e nance. T adi ional concep s o e i o ial egula ion a e inc easingly inadequa e when da a lows seamlessly
ac oss bo de s. Financial ins i u ions implemen ing cloud-based da a ansmission sys ems mus design sophis ica ed
con ols o sa is y egula ions ha we e o en w i en be o e such echnologies exis ed. This egula o y lag equi es
inancial ins i u ions o de elop amewo ks ha an icipa e egula o y e olu ion while main aining compliance wi h
exis ing equi emen s, c ea ing signi ican ope a ional complexi y and compliance cos s.
Consolida ed Regula o y Repo ing has eme ged as a signi ican challenge in mul i-cloud en i onmen s. As he Go e no
o S e iges Riksbank obse ed in his add ess o he Rese e Bank o Aus alia, inancial c ises o en e eal de iciencies
in egula o y epo ing amewo ks ha ail o cap u e eme ging sys emic isks [8]. The agmen a ion o inancial da a
ac oss mul iple cloud pla o ms ampli ies hese challenges, making comp ehensi e egula o y isibili y mo e di icul
o achie e. Financial ins i u ions mus de elop sophis ica ed da a agg ega ion and no maliza ion capabili ies o p oduce
consis en egula o y epo s om in o ma ion dis ibu ed ac oss di e en cloud en i onmen s. The implemen a ion
o such sys ems equi es subs an ial in es men in da a go e nance amewo ks ha can econcile inconsis en da a
models, axonomies, and de ini ions ac oss cloud pla o ms while sa is ying he de ailed epo ing equi emen s o
mul iple egula o y ju isdic ions.
Financial Reco d Re en ion Requi emen s c ea e addi ional complexi y in mul i-cloud a chi ec u es. The digi aliza ion
o inancial se ices has signi ican ly inc eased he olume o da a subjec o egula o y e en ion equi emen s. The
Regula o y Re iew no es ha eme ging echnologies like a i icial in elligence and machine lea ning a e c ea ing new
ca ego ies o da a ha may equi e e en ion unde exis ing egula ions, e en hough hese egula ions we e designed
o di e en con ex s [7]. In mul i-cloud en i onmen s, inancial ins i u ions mus implemen sophis ica ed in o ma ion
li ecycle managemen amewo ks ha apply app op ia e e en ion pe iods based on da a classi ica ion, ju isdic ional
equi emen s, and egula o y con ex . This challenge is compounded by he need o main ain eco ds in o ma s ha
will emain accessible h oughou e en ion pe iods ha can ex end o decades, e en as cloud echnologies and
pla o ms con inue o e ol e.
C oss-Bo de Financial Se ices Compliance ep esen s pe haps he mos signi ican egula o y challenge in mul i-
cloud en i onmen s. As no ed in he Rese e Bank o Aus alia con e ence p oceedings, in e na ional inancial
egula ion has e ol ed conside ably since he c ea ion o he Basel Commi ee on Banking Supe ision in 1974, wi h
inc easing ocus on coo dina ion be ween na ional egula o y au ho i ies [8]. Howe e , subs an ial di e ences emain
in how indi idual ju isdic ions implemen egula o y amewo ks, c ea ing signi ican compliance challenges o
inancial ins i u ions ope a ing ac oss bo de s. The Regula o y Re iew highligh s how di e ences in p i acy
egula ions, da a so e eign y equi emen s, and ope a ional s anda ds c ea e a complex ma ix o compliance
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4029
obliga ions o mul i-cloud implemen a ions [7]. Financial ins i u ions mus de elop sophis ica ed egula o y
in elligence capabili ies o ack e ol ing equi emen s ac oss all ope a ing ju isdic ions, implemen ing con ols ha
sa is y he mos s ingen applicable egula ions while main aining ope a ional e iciency.
6. Iden i y Managemen and Go e nance F amewo ks
E ec i e iden i y, access, and go e nance amewo ks a e essen ial o main aining compliance in mul i-cloud
en i onmen s. Acco ding o Ma ke s and Ma ke s esea ch, he global Iden i y and Access Managemen (IAM) ma ke
is p ojec ed o g ow om USD 13.4 billion in 2022 o USD 25.6 billion by 2027 a a Compound Annual G ow h Ra e
(CAGR) o 13.7% du ing he o ecas pe iod [9]. This subs an ial ma ke g ow h e lec s he inc easing ecogni ion o
IAM's c i ical ole in secu ing digi al asse s and ensu ing egula o y compliance. Financial ins i u ions, in pa icula , a e
d i ing his g ow h, as hey ace unique challenges in managing iden i ies ac oss mul iple cloud en i onmen s while
adhe ing o s ingen egula o y equi emen s. The complexi y o managing iden i y ac oss hyb id and mul i-cloud
deploymen s has become a p ima y conside a ion o inancial se ices i ms, wi h cloud-based IAM solu ions
expe iencing he highes g ow h a e wi hin he b oade IAM ma ke .
Fede a ed Iden i y Managemen has eme ged as a co ne s one o mul i-cloud compliance s a egies. As he IAM ma ke
con inues i s shi owa d cloud-based deploymen models, ede a ed iden i y solu ions a e becoming inc easingly
essen ial o inancial ins i u ions ope a ing ac oss mul iple cloud en i onmen s. Ma ke s and Ma ke s highligh s ha
he cloud deploymen segmen o he IAM ma ke is g owing a a as e a e han on-p emises solu ions, d i en by he
need o scalable and consis en iden i y managemen ac oss dis ibu ed en i onmen s [9]. These solu ions enable
consis en au hen ica ion and au ho iza ion ac oss cloud bounda ies, elimina ing secu i y gaps be ween p o ide s.
No h Ame ica cu en ly ep esen s he la ges ma ke o IAM solu ions, e lec ing he egion's high concen a ion o
inancial ins i u ions and s ingen egula o y landscape. The implemen a ion o ede a ed iden i y solu ions enables
inancial o ganiza ions o consolida e iden i y managemen ac oss hei di e se echnology landscape, elimina ing silos
ha c ea e secu i y ulne abili ies and compliance gaps.
Role-Based Access Con ol (RBAC) p o ides a s uc u ed app oach o implemen ing he p inciple o leas p i ilege
ac oss mul i-cloud en i onmen s. Acco ding o Check Poin 's analysis o inancial se ices secu i y egula ions,
implemen ing s ic access con ols is a undamen al equi emen ac oss majo inancial egula ions, including PCI DSS,
GLBA, SOX, and NYDFS [10]. Each o hese egula o y amewo ks manda es ha inancial ins i u ions implemen
con ols o limi access based on job esponsibili ies and he p inciple o leas p i ilege. Fo ins ance, PCI DSS
Requi emen 7 explici ly equi es o ganiza ions o es ic access o ca dholde da a by business need- o-know,
implemen ing a o mal access con ol sys em ha en o ces app op ia e pe missions. Simila ly, he Sa banes-Oxley Ac
(SOX) equi es s ic access con ols o inancial epo ing sys ems o main ain he in eg i y o inancial da a. The
complexi y o implemen ing hese equi emen s inc eases signi ican ly in mul i-cloud en i onmen s, whe e access mus
be consis en ly managed ac oss di e se pla o ms wi h a ying na i e capabili ies.
Cloud Go e nance Models es ablish he o ganiza ional s uc u es necessa y o consis en compliance ac oss mul i-
cloud en i onmen s. The apidly g owing IAM ma ke e lec s he inc easing impo ance o o mal go e nance
s uc u es, wi h Ma ke s and Ma ke s epo ing ha he se ices segmen o he IAM ma ke is p ojec ed o g ow a a
highe CAGR han he solu ions segmen du ing he o ecas pe iod [9]. This end indica es ha o ganiza ions a e
in es ing hea ily in implemen a ion se ices, consul ing, and suppo o es ablish e ec i e go e nance amewo ks.
These go e nance s uc u es a e pa icula ly c i ical o inancial ins i u ions, which mus na iga e a complex
egula o y landscape while le e aging mul i-cloud echnologies. The mos e ec i e go e nance models es ablish
consis en policies ac oss cloud en i onmen s while accommoda ing he unique capabili ies and limi a ions o each
pla o m.
Compliance Responsibili y Ma ices cla i y accoun abili y ac oss he complex mul i-cloud ecosys em. Acco ding o
Check Poin 's analysis, inancial se ices o ganiza ions ace a complex web o egula o y equi emen s, including a leas
12 majo inancial egula ions globally ha ha e speci ic p o isions ela ed o iden i y managemen and access con ol
[10]. These egula ions include b oad amewo ks like GDPR and indus y-speci ic manda es like PCI DSS, each wi h
dis inc equi emen s and en o cemen mechanisms. Fo ins ance, he G amm-Leach-Bliley Ac (GLBA) equi es
inancial ins i u ions o es ablish app op ia e s anda ds o access con ols and iden i y managemen as pa o hei
obliga ion o p o ec cus ome in o ma ion. Clea delinea ion o compliance esponsibili ies is essen ial in mul i-cloud
en i onmen s, whe e con ol implemen a ion equen ly in ol es mul iple pa ies, including he inancial ins i u ion,
cloud se ice p o ide s, and specialized secu i y endo s.
Wo ld Jou nal o Ad anced Resea ch and Re iews, 2025, 26(01), 4022-4032
4030
Execu i e-Le el Compliance O e sigh ensu es ha mul i-cloud compliance s a egies ecei e app op ia e a en ion
and esou ces. The ising cos o non-compliance unde sco es he impo ance o execu i e in ol emen in compliance
p og ams. Check Poin no es ha inancial se ices o ganiza ions ace signi ican penal ies o egula o y iola ions,
wi h ines po en ially eaching up o 4% o global annual e enue unde egula ions like GDPR [10]. Mo eo e , he New
Yo k Depa men o Financial Se ices (NYDFS) Cybe secu i y Regula ion speci ically equi es annual ce i ica ion o
compliance by he boa d o di ec o s o a senio o ice , emphasizing he impo ance o execu i e-le el o e sigh . These
egula o y ends ha e ele a ed compliance conside a ions o boa d-le el conce ns, pa icula ly o inancial
ins i u ions ope a ing in mul i-cloud en i onmen s whe e compliance complexi y is signi ican ly highe . Ma ke s and
Ma ke s p ojec s ha p o essional se ices ela ed o IAM, including compliance consul ing and o e sigh
implemen a ion, will g ow a a CAGR o 14.5% h ough 2027, e lec ing he inc easing ocus on go e nance a he
execu i e le el [9].
Table 2 IAM Ma ke G ow h and Financial Se ices Implemen a ion (2022-2027) [9, 10]
Componen
CAGR (%)
O e all IAM Ma ke
13.7
IAM P o essional Se ices
14.5
Cloud IAM Solu ions
>13.7*
On-P emises IAM Solu ions
<13.7*
7. Case s udy: global bank's mul i-cloud compliance ans o ma ion
7.1. Backg ound and Challenges
MegaBank In e na ional, a global inancial ins i u ion ope a ing ac oss Eu ope, Ame icas, and Asia-Paci ic egions,
emba ked on an ambi ious mul i-cloud ans o ma ion o enhance ope a ional esilience and inno a ion capabili ies.
The bank had adi ionally elied on a cen alized on-p emises da a a chi ec u e, bu compe i i e p essu es d o e a
s a egic shi owa d a mul i-cloud en i onmen le e aging se ices om mul iple majo cloud se ice p o ide s.
This ansi ion p esen ed signi ican compliance challenges as MegaBank ope a ed ac oss ju isdic ions wi h a ying
egula o y equi emen s, including he Eu opean Banking Au ho i y guidelines on ou sou cing a angemen s, he
Mone a y Au ho i y o Singapo e Technology Risk Managemen Guidelines, and a ious na ional banking egula ions.
Each cloud p o ide o e ed di e en na i e compliance ools, c ea ing a agmen ed app oach o egula o y adhe ence.
7.2. Solu ion Implemen a ion
MegaBank implemen ed a comp ehensi e mul i-cloud compliance amewo k add essing all dimensions o he
compliance ecosys em. The bank es ablished a Cloud Go e nance O ice wi h di ec epo ing lines o senio leade ship
o p o ide o ganiza ion-wide o e sigh . This go e nance s uc u e de eloped de ailed esponsibili y ma ices clea ly
de ining compliance obliga ions ac oss he bank, cloud p o ide s, and hi d-pa y se ices.
On he ac ical le el, he bank embedded compliance equi emen s di ec ly in o hei de elopmen pipelines. They
es ablished a con inuous compliance e i ica ion app oach a he han pe iodic assessmen s, aligning wi h he
Eu opean Banking Au ho i y's emphasis on ongoing moni o ing o cloud se ice p o ide s. Thei implemen a ion
included au oma ed compliance e i ica ion ools ha sys ema ically analyzed cloud con igu a ions agains egula o y
equi emen s om a ious ju isdic ions.
Fo da a p o ec ion, MegaBank c ea ed geog aphic bounda ies o egula ed in o ma ion based on ju isdic ional
equi emen s. Thei app oach inco po a ed enc yp ion o da a a es and in ansi while main aining so e eign
con ol h ough comp ehensi e key managemen . Da a classi ica ion amewo ks au oma ically iden i ied egula ed
in o ma ion equi ing special handling, wi h policies a ying by egion o e lec local egula o y expec a ions.
The iden i y managemen implemen a ion es ablished ede a ed access ac oss cloud en i onmen s wi h consis en
au hen ica ion and au ho iza ion mechanisms. Role-based access con ol implemen ed he p inciple o leas p i ilege,
wi h speci ic a en ion o p i ileged use s as highligh ed in he Deloi e esea ch on egula o y app oaches o cloud
compu ing [11].
