More than a decade after the financial crisis broke out, regulators once again panicked because some companies at the core of the financial system were too large to fail. But they are not banks.
This time, technology giants such as Google, Amazon, and Microsoft have hosted more and more banking, insurance, and market businesses on their huge cloud Internet platforms, which has kept regulators awake at night.
Central bank sources told Reuters that the speed and scale at which financial institutions transfer key services such as payment systems and online banking to the cloud constitute a phased change in potential risks.
“We are just at the beginning of a paradigm shift, so we need to make sure we have a solution that fits the purpose,” said an anonymous financial regulator from the G7 countries.
This is the latest sign of how financial regulators, together with their data and competitive counterparts, are examining the global influence of large technology companies more closely.
Banks and technology companies say that more use of cloud computing is a win-win situation because it can provide faster and cheaper services and is more resistant to hackers and interruptions.
But regulatory sources said they are concerned that a failure of a cloud company may paralyze key services in multiple banks and countries/regions, prevent customers from making payments or access services, and weaken confidence in the financial system.
The U.S. Treasury, the European Union, the Bank of England, and the Bank of France are all stepping up their scrutiny of cloud technology to reduce the risk of banks that rely on a few technology companies and companies being “locked in” or over-reliant on a cloud provider.
“We are very alert to the fact that things will fail,” said Simon McNamara, Chief Administrative Officer of NatWest, the Bank of England. “If 10 organizations are not ready and connected to a disappearing provider, then we will all have problems.”
The EU proposed in September that “critical” external services in the financial industry (such as the cloud) should be regulated to strengthen the EU banking authorities’ existing recommendations on outsourcing dating back to 2017.
The Bank of England’s Financial Policy Committee (FPC) also hopes to have a deeper understanding of the agreement between the bank and the cloud operator. The Bank of France told lenders last month that they must have a written contract that clearly defines the control of outsourcing activities.
“The FPC believes that additional policy measures are needed to mitigate financial stability risks in this area,” it said in July.
The European Central Bank, which oversees the largest banks in the Eurozone, said on Wednesday that bank spending on cloud computing in 2019 has increased by more than 50% compared to 2018.
And this is just the beginning. According to data from the technology research company IDC, global bank spending on cloud services is expected to more than double from USD 32.1 billion (approximately Rs 1,387.99 billion) in 2020 to reach USD 85 billion (approximately Rs 6,322.93 billion) by 2025 ) Share with Reuters.
IDC’s survey of 50 major banks around the world identified only six major cloud service providers: IBM, Microsoft, Google, Amazon, Alibaba, and Oracle.
According to Synergy Group, Amazon Web Services (AWS) is the largest cloud provider with sales of US$28.3 billion (approximately Rs 21,053 crore) in the six months to June, a year-on-year increase of 35%, which is higher than its annual revenue It recently reached USD 25.7 billion (approximately INR 19118.88 billion) in 2018.
Although all industries are increasing cloud spending, analysts told Reuters that after the surge in demand for online banking and emergency loan programs, financial services companies have moved faster since the pandemic.
“Banks are still very diligent, but they are already more satisfied with this model and are moving forward at a fairly fast pace,” said Jason Malo, a lead analyst at consulting firm Gartner.
No longer confidential
Regulators worry that cloud failures will cause the banking system to collapse and prevent people from using their funds, but said they know little about cloud providers.
Last month, the Bank of England stated that large technology companies can impose terms and conditions on financial companies and do not always provide their customers with enough information to monitor risks—”secrecy” must end.
There are also concerns that banks may not fully diversify risks among cloud providers.
Google told Reuters that, according to a recent survey, less than one-fifth of financial companies are using multiple clouds in case of failure, although 88% of companies that do not diversify their risks plan to do so within a year.
Central bank sources said that part of the solution may be some form of mechanism to provide a guarantee for flexibility from cloud providers to banks to reduce the industry’s overall risk to a cloud service-bank regulators have the overall Advantage.
“Regardless of the division of control responsibilities between cloud service providers and banks, banks are ultimately responsible for the effectiveness of the control environment,” the Federal Reserve said in a draft guidance issued to lenders last month.
The US Financial Industry Regulatory Agency (FINRA), which oversees Wall Street brokers, issued a report on Monday ahead of potential rule changes to ensure that the use of the cloud does not harm the market or investors.
However, the FINRA report stated that being able to easily switch cloud providers when needed is a task that is easier said than done, and may cause business disruption.
‘Buck and stop with us’
Banks and technology companies object to the argument that greater adoption of cloud computing makes the financial system infrastructure inherently more risky.
Adrian Poole, Director of Financial Services, UK and Ireland [Google Cloud], Said that the cloud is more effective in strengthening the bank’s security capabilities than building it internally.
UK digital lender Zopa said it has moved 80% of transactions to the cloud and is working to reduce risks. Zopa CEO Jaidev Janardana said the company also deliberately relies on the expertise of technology companies.
“Cloud providers have invested a lot of resources in security, the scale of which cannot be managed by individual companies,” he said.
Google’s Poole said the company is willing to work more closely with financial regulators.
“We may one day see regulators extract data from regulated banks on demand through cloud-enabled application programming interfaces (APIs) instead of waiting for banks to regularly push data to them,” he said.
NatWest’s McNamara said the bank is working closely with technology companies and regulators to reduce risks and has provided alternative services in case of problems.
McNamara said: “Our responsibility ends here.” “We don’t put all our eggs in one basket.”
However, Forrester chief analyst Jost Hoppermann said that one problem is that not all banks are fully aware of the resilience risks that large-scale migration to the cloud may bring, especially smaller banks.
“Some banks don’t have the necessary expertise,” he said. “They think this will solve all their problems, of course this is not true.”
© Thomson Reuters 2021