More than a decade after the financial crisis, regulators are once again concerned that some companies at the heart of the financial system are too big to fail. But they are not banks.
This time around, it’s the tech giants like Google, Amazon, and Microsoft hosting a growing mass of banking, insurance, and market operations on their massive cloud internet platforms that keep watchdogs up at night.
Central bank sources told Reuters that the speed and scale with which financial institutions are moving critical activities such as payment systems and online banking to the cloud represented a step change in potential risk.
“We are only at the beginning of the paradigm shift, so we need to make sure we have an appropriate solution,” said a financial regulator from a Group of Seven country, who declined to be named.
It’s the latest sign of how financial regulators are bringing their data and competition counterparts together as they scrutinize Big Tech’s global clout.
Banks and tech companies say increased use of cloud computing is a win-win because it results in faster, cheaper services that are more resistant to hackers and outages.
But regulatory sources say they fear a failure at one cloud company could disrupt key services across multiple banks and countries, leaving customers unable to make payments or access services, and undermine confidence in the financial system. .
The U.S. Treasury Department, the European Union, the Bank of England, and the Bank of France are among those stepping up their research into cloud technology to reduce the risks of banks’ reliance on a small group of technology companies and companies that are “locked in” or overextended. depend on a single cloud provider.
“We are very alert to the fact that things will fail,” said Simon McNamara, Chief Administrative Officer at British bank NatWest. “If 10 organizations are unprepared and connected to one provider that disappears, then we all have a problem.”
The EU proposed in September to regulate “critical” external services to the financial sector, such as the cloud, to strengthen the bloc’s banking authority’s existing outsourcing recommendations dating back to 2017.
The Bank of England’s Financial Policy Committee (FPC), meanwhile, wants more insight into agreements between banks and cloud operators, and the Bank of France told lenders last month that they must have a written contract that clearly defines controls over outsourced activities.
“The FPC believes additional policy measures are needed to mitigate financial stability risks in this area,” it said in July.
The European Central Bank, which regulates the largest lenders in the eurozone, said on Wednesday that banking spending on cloud computing increased by more than 50 percent in 2019 compared to 2018.
And that’s just the beginning. Spending on cloud services by banks worldwide is expected to more than double to $85 billion (about Rs. 6,32,293 crores) in 2025 from $32.1 billion (about Rs. 1,38,799 crores) in 2020, according to data from technology research firm IDC shared with Reuters.
An IDC survey of 50 major banks worldwide identified just six primary cloud service providers: IBM, Microsoft, Google, Amazon, Alibaba and Oracle.
Amazon Web Services (AWS) – the largest cloud provider according to Synergy Group – posted revenue of $28.3 billion (approximately Rs. 2,10,530 crores) in the six months to June, up 35 percent from the previous year. and higher than the annual turnover of $25.7 billion (about Rs 1,91,188 crores) as recent as 2018.
While all sectors have ramped up cloud spending, analysts told Reuters that financial services firms had accelerated since the pandemic following an explosion in demand for online banking and emergency loans.
“Banks are still very diligent, but they’ve gotten a higher level of comfort with the model and moving at a pretty fast pace,” said Jason Malo, director analyst at consultants Gartner.
No more secrecy
Regulators worry that cloud failures would cause banking systems to collapse and people lose access to their money, but say they have little visibility into cloud providers.
Last month, the Bank of England said big tech firms could dictate terms and conditions to financial firms and not always provide enough information to their customers to monitor risk — and that “secret” had to end.
There is also concern that banks may not spread their risk enough across cloud providers.
Google told Reuters that according to a recent survey, less than a fifth of financial companies use multiple clouds in case one fails.
Central bank sources said part of the solution could be some form of mechanism that provides assurance about the resilience of cloud providers to banks to reduce the industry’s overall exposure to one cloud service – with the banking supervisor having the overall vantage point.
“Regardless of the division of audit responsibilities between the cloud service provider and the bank, the bank is ultimately responsible for the effectiveness of the auditing environment,” the US Federal Reserve said in a draft guidance issued to lenders last month.
FINRA, which regulates Wall Street brokerages, released a report Monday ahead of potential rule changes to ensure cloud use doesn’t hurt the market or investors.
However, being able to easily switch cloud providers when needed is an easier said than done task and can lead to disruptions to business, the FINRA report said.
‘The goat stops with us’
Banks and tech firms are challenging the suggestion that greater cloud adoption makes financial system infrastructure inherently more risky.
Adrian Poole, UK and Ireland Financial Services Director for [Google Cloud], said the cloud can be more effective at strengthening a bank’s security capabilities than building it in-house.
British digital lender Zopa said it had moved 80 percent of its transactions to the cloud and was working to reduce risk. Zopa Chief Executive Jaidev Janardana said the company also deliberately leaned on the expertise of tech companies.
“Cloud providers are investing a lot of resources in security at a scale that few individual companies can handle,” he said.
Google’s Poole said the company is open to working more closely with financial regulators.
“Maybe one day we’ll see regulators get data on-demand from regulated banks with cloud-enabled Application Programming Interfaces (APIs), instead of waiting for banks to periodically push data to them,” he said.
NatWest’s McNamara said the bank worked closely with tech companies and regulators to mitigate risk, and had put in place alternative services in case something went wrong.
“The buck stops with us,” McNamara said. “We don’t put all our eggs in one basket.”
One problem, however, is that not all banks have a full understanding of the risks to resilience that could come with a large-scale move to the cloud, said Jost Hoppermann, principal analyst at Forrester, especially the smaller lenders.
“Some banks don’t have the necessary know-how,” he said. “They think doing this will make all their problems go away, and that’s certainly not true.”
© Thomson Reuters 2021