Debunking FinServ Legal Department Myths About the Cloud

Financial services (FinServ) companies hold enormous volumes of sensitive data. Yet many legal teams still rely on legacy infrastructure due to persistent concerns about the cloud. The five common myths that prevent FinServ legal departments from migrating to the cloud are security, control, cost, migration, and artificial intelligence, writes Relativity’s Adam Rouse.

Although security concerns top the list, the US Department of the Treasury’s 2023 report on cloud adoption in financial services found that public cloud providers generally match or exceed the security capabilities of on-premises systems. The report cites that the cloud has faster patching, stronger monitoring and logging, and geographic redundancy that few institutions could replicate on their own. 

A related myth equates physical proximity to data with genuine control. However, regulators care more about demonstrable audit trails and access records, both of which cloud platforms tend to handle more rigorously than legacy infrastructure, according to Matthew Birnbaum of KPMG.

Cost comparisons often favor on-premises systems only because outlays have already been made, according to another myth. This obscures the labor and time legal teams spend hunting for records across disconnected legacy systems, notes Aaron Vidmar of KPMG. 

Additionally, migration is often seen as too risky, though modern tools have replaced the manual, error-prone processes of the past. FinServ legal departments can pursue a phased approach, starting with lower-stakes systems before tackling sensitive ones.

Then there is the myth about the risks of feeding sensitive financial data into generative AI tools. These worries are legitimate and widespread, with KPMG’s 2026 Banking Technology Survey finding that a large majority of banking executives cite privacy and risk as a top modernization challenge. 

Even so, the same survey found that nearly all these institutions already run generative AI pilots, suggesting the more realistic path forward is choosing vetted platforms with strict contractual limits on data retention and model training rather than avoiding AI altogether.