Finextra reports today that The US government has ordered Anthropic to cut foreign nationals off from its two most powerful models, Fable 5 and Mythos 5, reinforcing European concerns about reliance on US-imported technology.
From my perspective, the Anthropic shutdown did not create Europe’s sovereignty problem. It simply ended the remaining illusion that critical digital capabilities supplied from another jurisdiction can always be treated as neutral infrastructure.For European banks, my view is straightforward.
This is not a reason for panic-driven cloud repatriation, nor for anti-American theatre, but it is absolutely a reason to redesign your architecture, contracts, governance and payment strategy around reversibility, control and evidence.
The event that killed the polite discussions
The shutdown was not really an AI story, or was it?
When U.S. authorities ordered Anthropic to suspend access to its most advanced models for foreign nationals, Anthropic disabled those services for non-U.S. users, and the European Commission itself said the episode was another illustration of why Europe needs stronger technological sovereignty. This tells every regulated industry in Europe that remote access to a strategically important capability can be constrained by someone else’s government, with very little warning, for reasons that may have nothing to do with your institution, your regulator, or your customers.
For banking, that should land with a thud.
Because many European banks have built their digital futures on a stack that is physically in Europe, contractually dressed in European language, and operationally still dependent on a small number of mostly U.S.-controlled providers. DORA’s designation of 19 “critical” ICT providers, including AWS, Google Cloud and Microsoft, was already the regulatory acknowledgement that concentration risk had become systemic. The Anthropic episode adds a more uncomfortable layer indicating that concentration risk is now also a geopolitical access risk.
This is where I think too much of the debate still goes wrong.
People talk about sovereignty as if it were mainly a location question. It is not. You can host a workload in Frankfurt, wrap it in “EU-only” procurement language, and still be exposed through the control plane, support model, legal structure, identity layer, key management assumptions, software dependencies, or provider-side kill switch.
That is the uncomfortable truth.
Data residency is not sovereignty.
It is geography.
The sovereignty turn in Europe
The sequence of events now looks less like isolated headlines and more like a pattern. Europe has been tightening operational resilience rules, moving payment sovereignty and the Digital Euro up the agenda, signalling public procurement preferences for European cloud, and now responding to an explicit demonstration of foreign dependency risk in frontier AI. At the same time, banks themselves are hedging into euro-native payment and tokenisation options, as shown by more European banks recently move into the Qivalis consortium.
I think the timeline is interesting because it shows two things happening at once.
First, Europe is moving from abstract “strategic autonomy” language into procurement, payments, supervision and infrastructure policy. Second, the market is not waiting for Brussels to finish writing legislation. Banks, cloud providers, AI firms and domestic challengers are all repositioning already.
And if they are not, I really do recommend they do.
There is also maybe an additional interesting nuance in all this. Europe is not, in practice, building a pure “European-only” digital stack overnight. The Commission’s own cloud contract went to European providers under its Cloud Sovereignty Framework, but one winning consortium included S3NS, Google Cloud’s joint venture in France. Does that mean that sovereign procurement in Europe is currently being designed as controlled dependency and layered compromise?
The same mixed logic is visible in payments. The ECB’s Piero Cipollone has argued that the digital euro should provide the retail payments backbone Europe lacks and help the euro area become more self-sufficient, especially as dollar-linked stablecoins gain ground. Yet the private sector is also moving. Nordea says its Qivalis participation is about strengthening European financial autonomy. Qivalis itself presents a fully regulated, euro stablecoin intended for payments, settlement and tokenised assets, backed 1:1 by euros and high-quality liquid assets. Is this Europe hedging through both public money and private money rails at the same time?
Who wants what and why
The European Commission and EU institutions want resilience, bargaining power and industrial capacity. The June 2026 technology package is explicitly about cutting dependence on foreign tech, especially in cloud, AI and semiconductors, while public procurement signals and external digital partnerships are being used to shape demand as well as supply.
Central banks and financial regulators want continuity of key services, reduced concentration risk and stronger European payment autonomy. That is why DORA now gives EU supervisors direct oversight of critical ICT providers serving finance, and why the ECB keeps pressing the strategic case for the digital euro. The message from supervisors has been consistent that Europe’s financial system is too dependent on a handful of non-European providers for too many important functions.
Personally, I think the banks want something far less ideological and much more practical. Access to the best technology, acceptable cost, regulatory certainty and room to innovate without creating a giant future hostage situation. That is why banks can simultaneously complain about digital euro implementation costs, rely heavily on hyperscalers, and still join euro stablecoin consortia.
They are not confused.
They are buying optionality.
Big Tech and hyperscalers want Europe to keep buying open global infrastructure rather than redraw the market around origin, control and jurisdiction. Google has warned against Europe “erecting walls”, and trade bodies from Australia, Canada and Japan have argued that the proposed Cloud and AI Development Act risks discrimination, higher costs and reduced choice if eligibility is defined too bluntly by ownership or jurisdiction.
European challengers, domestic cloud firms and sovereign-tech advocates want the opposite. They want procurement preferences, investment, clearer qualification rules and less “sovereignty washing”. Their argument, is that Europe cannot build supply unless it also creates anchored demand. That is a fair point. Europe has spent years talking about digital sovereignty while still buying scale, productivity and AI capability from elsewhere.
Stablecoin issuers and fintechs want to occupy the gap before the digital euro arrives, and perhaps even shape what “programmable euro money” looks like in practice. Qivalis is a very good example. The proposition is not really “replace your debit card at the bakery”. It is much more likely to be treasury mobility, settlement efficiency, tokenised asset workflows and cross-platform programmability inside a regulated perimeter.
What this could mean for European banks
If you ask me, I would say the first risk is operational resilience. If core banking operations, customer channels, fraud tools, analytics, model APIs and recovery procedures all lean on the same small provider set, then an outage, legal order, export control or platform restriction becomes a business continuity event, not a vendor management issue. That is exactly why DORA escalated these providers into direct supervisory scope, and why national supervisors have started speaking more openly about non-European cloud dependency.
The second risk is vendor lock-in, but the old definition is now too narrow. In 2026, lock-in is not only about proprietary storage, functions or replatforming cost. It is also about jurisdiction, privileged access, support escalation, embedded AI services, proprietary model APIs and the fact that capability can be switched off upstream. The Cambridge Centre report cited by Reuters found heavy concentration in AI model use among financial firms as well, which suggests the same dependency pattern is already re-emerging one layer up the stack.
The third risk is that banks may comply formally while remaining strategically exposed. France’s decision to move its Health Data Hub from Microsoft to Scaleway shows how fast “good enough” sovereignty narratives can collapse when governments decide that underlying legal exposure matters more than local hosting. Banking is not healthcare, but it is regulated, systemic and politically sensitive. It would be naïve to assume the same logic cannot travel.
The fourth risk is cost. Sovereignty is not free. The ECB estimates the digital euro alone could cost EU banks €4 billion to €6 billion over four years. Multi-cloud duplication, sovereign enclaves, exit rehearsals, data portability and duplicated security operations all come with real expense. And there is a genuine danger that Europe, if it moves badly, ends up paying more for less capability. The critics of the current sovereignty push are right about that part.
But there are real opportunities too.
The first is negotiating leverage. The moment sovereignty becomes a board topic rather than a policy slogan, banks gain a stronger hand in contracts, architecture decisions and provider oversight. DORA, direct supervision of critical providers and political pressure around strategic autonomy all strengthen the case for tougher exit rights, clearer logging, local operational control, and portability requirements.
The second is innovation with less hostage risk. The best European bank strategy should now be “use cloud and AI in ways that do not make the institution strategically helpless”. That means modular design, model abstraction, key ownership discipline, evidence-rich observability, and carefully choosing where European alternatives are genuinely good enough for sensitive workloads. The Commission’s own sovereign cloud procurement and France’s healthcare move suggest the practical market for these patterns is becoming real, not theoretical.
The third is payment-side optionality. Europe’s push for sovereignty is likely to move faster in payments than in cloud. The digital euro remains politically contested and operationally expensive, but the strategic logic behind it is hardening, not fading. In parallel, bank-led euro stablecoins like Qivalis allow incumbents to experiment with regulated programmable money on their own terms. My reading is that many banks will not be forced to pick one. They will position for both.
The cloud question banks can no longer dodge
Here is my view on all this.
Do not rip everything out of U.S. cloud tomorrow. That would be operationally reckless, commercially expensive and in many cases technically absurd.
But equally, do not walk into 2027 with the same dependency profile and tell yourself that “our data is in the EU” solves the problem. It does not.
The serious answer is selective sovereignty by design.
Decide which workloads, data sets, control functions and AI capabilities must remain under demonstrable European control, and architect the rest for portability, evidence and negotiated dependence.
For me this translates into a clear statement:
Keep commodity where the market is strong. Keep control where your licence to operate depends on it.
The most plausible futures and the move banks should make now
I have for some time been thinking about the current geopolitical situation, the continued growth of fundamental uncertainty in regards to our future and now all this.
In discussions with banks I have for some time now advised that they should be sensitive in the selections they make, and ensure they understand the potential risks and future actions that they will face.
At the end of the day, I do not think that the most likely outcome is a hard decoupling.
It will probably be more of a managed dependency.
Europe will keep relying on U.S. cloud and AI, but under tighter supervision, sharper procurement rules, more sovereign wrappers and more anxiety in boardrooms. That is the base case because the economic and capability gap is still real, and even Europe’s own procurement choices already show compromise rather than separation.
A likely future is a sovereign overlay model where sensitive public-sector and regulated workloads will be steered toward environments that meet stricter control criteria, while less sensitive digital workloads remain on global platforms. France’s Health Data Hub decision is an early signal of how this could spread: not universal repatriation, but more assertive ringfencing of specific domains.
And in my view the one that may move fastest, is payments-first sovereignty. The digital euro, Wero-style account-to-account schemes, and bank-led euro stablecoin initiatives all point to the same direction of travel.
Europe wants euro-native rails that are less exposed to foreign platform power and dollar stablecoin creep. Whether all of these succeed is another question. But the strategic urgency behind them is unmistakable.
The tail-risk future is hard rupture. A geopolitically driven sanctions event, export control wave, cybersecurity emergency or transatlantic legal clash could force much faster substitution than boards currently imagine. That is not the most likely scenario, but it is no longer a fantasy scenario either.
Anthropic just proved the mechanism.
So what should a European bank CEO or CIO do in the next 6–12 months?
First, stop treating sovereignty as a policy agenda and start treating it as an architecture and operating model problem. In the first 60–90 days, build a sovereignty heat map of every critical service like cloud provider, subcontractors, model APIs, key custody, admin paths, support escalation, data movement, recovery dependencies and contractual chokepoints. If you cannot explain which external actor can degrade or deny the service, you do not yet understand the risk.
Second, separate the stack. Too many banks still assess “cloud risk” as one blob.
It is not one blob.
Infrastructure dependency, managed database dependency, observability dependency, identity dependency and external model dependency are different risks and need different controls. The Anthropic episode should push every bank to inventory not only hyperscaler lock-in but also AI service lock-in.
Third, renegotiate vendor relationships now, while the balance of power is shifting. Ask for stronger notification rights, deprecation windows for managed AI services, termination assistance, clearer privileged-access evidence, recovery cooperation, portability support and scenario-specific commitments around jurisdictional restrictions. DORA gives you cover to ask much harder questions than many banks have historically asked.
Forth, do not ignore payments strategy. If you are a European bank, the sovereignty discussion is not only about cloud. It is also about who owns the future euro-denominated rails for digital commerce, tokenised assets and 24/7 settlement. You do not need to love the digital euro to recognise that the policy pressure behind it is rising. And you do not need to be a crypto evangelist to recognise why banks like Nordea want a seat at the table of regulated euro stablecoins.
My conclusion is not that Europe can or should fully separate from U.S. cloud and AI in the near term.
It cannot.
And probably should not.
My conclusion is that European banks now need to behave like institutions that have finally understood the difference between outsourcing and dependency.
The former is a sourcing decision.
The latter is a strategic condition.
The Anthropic shock has made that difference impossible to ignore.
Anthropic Is Europe’s Sovereignty Warning Sign
