---
title: "Hybrid and Multi-Cloud"
url: "https://mahouse.world/glossary/hybrid-and-multi-cloud"
type: "glossary term"
author: "Ihor Vlasov"
reviewed: "2026-09-30"
published: "2026-09-25"
---

# Hybrid and Multi-Cloud

Hybrid cloud combines an organisation's own infrastructure or private cloud with one or more public clouds, run as a connected whole; multi-cloud means using public cloud services from two or more providers. Financial firms adopt one or both to limit dependence on a single provider, meet data-location rules and keep a credible exit route open.

**Also known as:** Hybrid cloud, Multi-cloud, Multicloud, Hybrid multi-cloud

## Key facts

- **Definitions:** NIST (SP 800-145, 2011) describes hybrid cloud as two or more distinct cloud infrastructures bound together by technology that allows data and applications to move between them; ISO/IEC 22123-1 defines multi-cloud as using public cloud services from two or more providers
- **Regulation:** DORA requires EU financial firms to weigh concentration risk before contracting a provider that is not easily substitutable, and to hold tested exit strategies for services supporting critical or important functions; firms may set out a multi-vendor strategy explaining their mix of providers
- **Switching:** under the EU Data Act, cloud providers may charge only reduced, cost-based switching fees until 12 January 2027 and none after it; contracts must let customers start a switch on no more than two months' notice, with a transition of up to 30 days
- **Typical patterns:** core ledger on premises or in a private cloud with digital channels in public cloud; a warm standby for critical services with a second provider; different providers for different workloads such as AI training, analytics and payments
- **Trade-off:** resilience and bargaining power against duplicated engineering, security tooling and skills, and the loss of each provider's proprietary services

## How hybrid and multi-cloud works in practice

Few financial firms run one application live across two providers; the cost is high and the benefit narrower than it looks. More common is a division of work — the core ledger and card processing on premises or in a private cloud the firm controls, customer-facing apps and analytics in a public cloud, AI workloads wherever the accelerators are — plus a standby arrangement for critical services in a second environment. The design question is which services must survive the loss of a provider, how fast, and at what cost.

Every step towards portability costs something: containers and infrastructure-as-code instead of the provider's managed services, a second set of security controls, engineers trained on two platforms, and data egress fees. Every step away from it deepens lock-in, which supervisors now treat as a risk to be managed rather than a commercial choice. When a major AWS outage on 20 October 2025 took down platforms including Coinbase, customers with no second environment could only wait.

For a buyer, cloud architecture is a line in the technology diligence and sometimes in the price. A target built entirely on one provider's proprietary services may need expensive re-platforming to meet the acquirer's resilience standards; a hybrid estate with its own data centres brings capital expenditure and staff that a cloud-native acquirer will want to retire.

## Example

A digital lender with €2bn of loans runs everything on one public cloud at €3.1m a year. Its supervisor flags concentration risk: there is no tested exit, and the loan-servicing platform depends on the provider's proprietary database. Full active–active multi-cloud is costed at €2.4m a year extra plus €4m of re-engineering. The lender chooses a narrower plan: move the servicing database to an open-source engine on containers for €1.3m, keep a warm standby with a second provider that holds replicated data and can take over servicing within four hours for €700k a year, and leave marketing and analytics on one cloud. An exit test in month nine moves servicing to the standby in 3 hours 20 minutes. The cloud bill rises by 23%, and the finding is closed.

## Common mistakes

- Calling two providers for unrelated workloads resilience, when neither could take over from the other.
- Building on proprietary managed services and discovering the exit cost only when a supervisor asks for the plan.
- Replicating applications but not data, identity or DNS, so the standby cannot run.
- Leaving egress fees and duplicated staff out of the business case.
- Treating on-premises as automatically safer; it concentrates the risk in the firm's own operations.

## Related terms

- [Failover](https://mahouse.world/glossary/failover.md)
- [Compute](https://mahouse.world/glossary/compute.md)
- [Switching Costs](https://mahouse.world/glossary/switching-costs.md)
- [MLOps](https://mahouse.world/glossary/mlops.md)
- [SOC 2 Compliance](https://mahouse.world/glossary/soc-2-compliance.md)
- [API](https://mahouse.world/glossary/api.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-30. https://mahouse.world/authors/ihor-vlasov