What sovereign cloud means for UK bank customer data

On 14 October 2026, Starling Bank announced that it is building a transactional foundation model — an artificial intelligence system trained to identify patterns in transaction data — with support from NVIDIA, trained on UK infrastructure operated by the British cloud provider Civo. Starling said the model was trained on more than 15 billion transactions, which it described as anonymised. It intends to put the model into production in early 2027, starting with fraud detection and later feeding into Starling Assistant, its customer-facing AI feature.

For Starling's UK customers, and for anyone trying to work out what "sovereign cloud" actually buys them, the announcement is a useful test case. It is relevant to customers because the bank has used transaction data to build the model and intends to deploy it first for fraud detection. And it matters now because banks' dependence on a small number of cloud suppliers has become a competition and resilience question in the UK, not just a procurement one.

One thing to be clear about at the outset: the announcement describes a specific AI project. It does not establish that Starling has migrated its entire banking platform, or all customer data, to UK-only infrastructure.

Four different things people mean by "sovereign cloud"

What follows is this explainer's analytical framework rather than a statutory definition or a certification standard: four questions that marketing language tends to collapse into one.

A UK postcode for a data centre answers the first question only. The Information Commissioner's Office (opens in a new tab) (ICO), the UK's data protection regulator, is explicit that whether an organisation is making a restricted transfer — a transfer of personal information caught by the international transfer rules in the UK General Data Protection Regulation (UK GDPR), the UK's main data protection law — depends on the legal entities and arrangements involved, not on server geography alone. Contracting with a UK cloud entity does not by itself create a restricted transfer to that entity. But any overseas sub-processing underneath it still has to be considered.

The ICO also addresses the operational-control question directly. Making personal information held in the UK remotely accessible to a separate organisation overseas can itself amount to a restricted transfer. Overseas employees within the same legal entity are treated differently from a separate organisation, and the ICO sets out a three-step test for working out which situation applies. A restricted transfer is not the same thing as an unlawful one; it simply means the international transfer rules are engaged and a transfer mechanism is needed.

What Starling has announced, and what it has not

Starling describes the infrastructure as UK-owned and UK-headquartered, and says this means the project's data sits within UK jurisdiction only. That statement is verifiably made by the company. Its exclusive-jurisdiction conclusion is not independently established, and this is where attribution matters: substantiating it would require sight of the contracting entities, the access arrangements and an applicable-law analysis. None of those were available for review.

Several other points material to a customer remain undisclosed in the announcement reviewed here:

• The contracting entities, sub-processors, administrator locations, support access arrangements, telemetry flows and backup locations.
• NVIDIA's contractual role. The announcement does not establish whether NVIDIA acts as a data processor or whether it can access training data. Its involvement proves neither foreign access nor the absence of it.
• The lawful basis for using transaction data in model development, and whether customers can object or opt out. An optional customer-facing AI feature is not the same as optional participation in training a model.
• Any project cost, capacity, encryption key custody, model-weight access or data retention arrangements.

The reviewed evidence also does not establish any regulatory approval or sovereign-cloud certification for this arrangement, and none should be inferred from the announcement.

"Anonymised" is doing a lot of work

Starling described the 15 billion transactions as anonymised. The underlying collection period was not specified.

Under ICO guidance (opens in a new tab), stripping out identifiers does not necessarily make transaction data anonymous. Effective anonymisation requires that people cease to be identifiable. Information that has merely been pseudonymised (opens in a new tab) — where identifiers are replaced but the link can be restored — remains personal data in the hands of an organisation that also holds the additional identifying information. The ICO notes that its pseudonymisation guidance is under review following the Data (Use and Access) Act.

Whether this particular dataset meets the UK legal threshold for anonymous data is a technical question that a published assessment would settle. The announcement reviewed here does not disclose the anonymisation method used or whether re-identification testing was carried out, so nothing in it settles the question, and nothing here certifies it either way.

Why banks depend on cloud suppliers at all

The Competition and Markets Authority (opens in a new tab) (CMA) published the final decision in its cloud services market investigation on 31 July 2025. It identified concentration, together with commercial and technical barriers to switching suppliers or using more than one, as harms to competition. For 2024, the CMA reported that Microsoft and Amazon Web Services each held a 30–40% share of infrastructure-as-a-service supply — the raw computing, storage and networking capacity that customers build their own systems on top of — in the geographic market it defined as the UK plus the European Economic Area (EEA).

The scope of those figures matters. They are whole-market figures for the UK and EEA combined, not UK banking market shares, and not a measurement of any individual bank's supplier concentration. The broader point stands: adding a supplier does not automatically produce interchangeable failover, and the CMA identified barriers to using more than one supplier as well as to switching.

What UK regulators actually expect

The Financial Conduct Authority (opens in a new tab) (FCA) permits firms to use the cloud where they comply with its rules, and says firms cannot delegate their responsibility for outsourcing and third-party arrangements. A supplier's nationality does not substitute for risk management, and it does not move accountability away from the bank.

The Prudential Regulation Authority (PRA) goes further, in a direction that cuts against the intuitive reading of "sovereign". Its supervisory statement SS2/21 on outsourcing and third-party risk management — the current version published on 15 November 2024 and effective from 31 December 2024 — recognises resilience benefits from geographically dispersed cloud locations, and warns that restrictive data localisation can adversely affect resilience, innovation and costs. It expects a risk-based approach to data location. Any suggestion that UK regulators generally require domestic-only hosting conflicts directly with paragraph 7.7 of that statement. SS2/21 implements European Banking Authority outsourcing and information and communications technology (ICT) guideline expectations in the UK supervisory context. A revised version published in March 2026 takes effect on 18 March 2027; it is not in force yet.

For material outsourcing, the PRA expects maintained and tested business continuity plans, and documented exit strategies covering both stressed and planned departures. That expectation exists because a UK supplier can fail or suffer an outage just as a foreign one can. Hosting nationality is not a resilience control.

Separately, the FCA's operational resilience rules took effect on 31 March 2022, and in-scope firms including banks had until 31 March 2025 to ensure their important business services could operate within impact tolerances — the maximum tolerable level of disruption to such a service. That implementation deadline has passed. Disruption to payment or account services is precisely the harm those rules are designed to limit, and no cloud arrangement, domestic or otherwise, removes the risk of it.

What a customer can reasonably conclude

Not that all their banking information stays in the UK. Starling's general privacy notice (opens in a new tab) says it uses UK and EEA servers where possible, with some supplier processing and some payment-related flows taking place outside those areas. That is bank-wide context rather than evidence about this model's architecture, and the two documents cover different scopes rather than contradicting one another. But read together, they prevent a blanket UK-only inference.

What a customer can conclude is narrower: that Starling has announced a training project on UK infrastructure, that the company has made a jurisdictional assurance about it, and that no verified measurement yet establishes improved privacy, fraud detection performance or uptime as a result. Intended benefits are not achieved benefits.

Three things are worth watching. Whether the model reaches production in early 2027 as intended. Whether Starling publishes the technical detail — data flow map, anonymisation assessment, sub-processor list, lawful basis — that would allow the sovereignty claim to be tested. And the revised SS2/21 taking effect on 18 March 2027, which will set the supervisory baseline for arrangements like this one. The official detail on international transfers and anonymisation sits with the ICO; the outsourcing and resilience expectations sit with the PRA and the FCA.