> It's not, it's more about sovereignty and control

The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.

If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"