Credit Union Core Banking Cloud Decision
Riverton Credit Union, with 180,000 members and ¥2.1 trillion in assets, is deciding whether to move its core banking system to a public cloud. The regulator requires customer data to remain in-country and demands 99.95% availability with audited recovery. The current on-premises contract ends in 18 months. Option A is a private-cloud refresh in the existing data center: ¥1.8 billion over five years, 99.9% design availability, and staff already know the platform. Option B is a public cloud in-country region: ¥1.4 billion over five years, 99.99% advertised availability, but the core vendor's software is not yet certified for that cloud and certification is expected in 12 months. The board wants lower cost but is risk-averse. The IT team has 12 months of cloud skills training planned. A regulator has asked for a exit plan.
1. What decision criteria beyond five-year cost should the board use? Rank them and explain.
Read the worked answer
Rank: (1) regulatory compliance and data residency, because a public cloud that cannot satisfy the regulator is disqualified regardless of cost; (2) availability and audited recovery evidence, since 99.95% is a regulatory expectation and advertised 99.99% is not proof; (3) vendor certification timing against the 18-month contract end; (4) exit and data portability, because the regulator asked for an exit plan; (5) skills and operational readiness, given 12 months of training; (6) five-year cost. Cost matters but cannot outrank a compliance failure or an uncertified core. The board should treat Option B's ¥0.4 billion saving as conditional, not banked.
2. Assess Option B's certification risk against the 18-month deadline. What conditions would make it acceptable?
Read the worked answer
Option B is tight: certification expected in 12 months leaves only six months for migration, testing, and audit before the contract ends. If certification slips by even a quarter, there is no room and the credit union may be forced into an expensive extension. Acceptable conditions: a contractual certification milestone with penalties or termination rights; evidence of certification scope covering the core modules used; a pilot with measured availability and recovery; a funded fallback to extend Option A; data portability and exit clauses; and regulator review of the exit plan before signing. Without those, the schedule risk is too high for a risk-averse board.
3. Recommend a path and state two triggers that would force a switch to Option A.
Read the worked answer
Proceed with Option B only as a conditional path, with Option A extension negotiated in parallel as a fallback. Triggers to switch: certification is not achieved or contractually committed by month 9, leaving insufficient migration time; or the pilot cannot demonstrate 99.95% availability and audited recovery; or the regulator rejects the exit plan or data-residency evidence. A cost overrun above a defined threshold, such as 10% of the ¥1.4 billion, should also trigger review. This gives the board the lower-cost option without betting the core banking service on an unverified certification date.