Mixture
There are severe FSA compliance issues in terms of storing data - he'll have to be able to prove due diligence over proof of data security, and theres no way he can prove that with Office 365 as M$ won't specify where the data is stored - or make sufficient commitment to its security.
Similarly I've recently been looking at off-site backup for a similar customer and realised its a no-no, except for one backup provider who the FSA approved monitoring association have vetted.
As a fallout from the same requirements, I've had to to carry out complete hard drive encryption on their laptops, desktops, servers and backup drives. Thats the complete drives - not just the active partitions.
Going back to the supposed problem behind this - that mortgage sourcing database, I'd like to know more about which one it is, and what the problems are. A couple of years ago I had the unwanted honour of being one of the first to install some of those on Win7 machines, and there was a lot wrong with the M$ runtime installers - I had to get the company to remote in on each machine, one by one. I wonder if this is an echo?