Sovereign by Design: How a Regional European Bank Rebuilt for DORA
CLIENT PROFILE
The client is a tier-two European banking group serving roughly 2.3 million retail and commercial customers across Germany, Denmark and Sweden, with close to €48 billion in assets under management across consumer deposits, commercial lending, and treasury operations.
CLIENT CHALLENGE
The bank’s non-core estate — analytics, customer engagement platforms, fraud scoring, developer tooling — had migrated to two public hyperscalers over several years, while core banking remained on an ageing on-premises footprint in two leased data-centre halls. The Digital Operational Resilience Act (DORA) and tightening NIS2 transposition required documented, testable exit strategies and verifiable evidence of who held administrative access to production systems — evidence the bank’s hyperscaler contracts could not produce. Encryption keys and audit logs were both provider-managed, leaving “we trust the provider’s attestation” as the only answer under supervisory scrutiny.
At the same time, the bank’s data science function had a GPU-dependent fraud and credit-risk modelling programme stalled for eleven months, because legal would not permit customer data to leave the jurisdiction under any available architecture.
UNITEDLAYER SOLUTION
UnitedLayer deployed UPC Sovereign Cloud as a dedicated, single-tenant private cloud across two German availability zones with an in-region recovery site — engineered around three layers of sovereignty:
1. Data Sovereignty
All data held in-region and governed solely by German and EU law, with no hyperscaler access and no cross-border replication without contracted consent.
Bank-owned encryption keys and a complete, bank-controlled audit trail in place of provider-managed attestation.
2. Operational Sovereignty
Administration restricted to vetted regional personnel under residency-specific access controls.
Business continuity and disaster recovery built in and exercised in-jurisdiction, closing the DORA exit-plan gap the bank’s supervisory college had flagged.
3. AI-Optimized Sovereign Capacity
Dedicated GPU clusters inside the same sovereign perimeter, unblocking the fraud and credit-risk modelling programme without any customer data leaving the jurisdiction.
Native Unified Observability, AIOps and FinOps built directly into the platform, continuously surfacing idle and over-provisioned capacity.
BUSINESS BENEFITS
Reduced infrastructure run-rate by 31% versus the prior hyperscaler estate, through continuous FinOps-driven rightsizing.
Cut mean time to resolution by 63% through AI-driven, in-perimeter operations and remediation.
Brought 1,400+ workloads under documented sovereign control in nine months, giving supervisors a demonstrable DORA exit plan for the first time.
ABOUT UNITEDLAYER
UnitedLayer is a global provider of private and hybrid cloud solutions (single and multi-tenant), managed hosting, and 100+ PaaS. Founded in 2001, the company specializes in high-availability infrastructure designed for mission-critical enterprise and AI workloads, with pre-certified alignment across GDPR, DORA, NIS2, BSI C5 and ISO 27001.
