© Reuters. FILE PHOTO: A Google Cloud logo in front of the headquarters of the Google Cloud Computing Unit in the Moffett Place office complex in Sunnyvale, California, the United States, June 19, 2019. REUTERS / Paresh Dave / File Photo
By Iain Withers and Huw Jones
LONDON (Reuters) – More than a decade after the financial crisis, regulators have renewed fear that some companies at the heart of the financial system are too big to fail. But these are not banks.
This time around, it's tech giants like Google (NASDAQ :), Amazon (NASDAQ :), and Microsoft (NASDAQ 🙂 who host a growing mass of banking, insurance, and market operations on their vast cloud internet platforms that keep watch dogs awake at night.
Central bank sources told Reuters that the speed and extent with which financial institutions are moving critical operations such as payment systems and online banking to the cloud is a big change in potential risk.
"We are only at the beginning of the paradigm shift, so we need to make sure we have a fit-for-purpose solution," said a financial regulator from a country in the Group of Seven who refused to be named.
It's the latest sign of how financial regulators, along with their data and competitive peers, are scrutinizing the global clout of big tech.
Banks and tech companies say that greater use of cloud computing is a win-win as it leads to faster, cheaper services that are more resilient to hackers and outages.
However, regulators fear that a cloud company breakdown could bring vital services to a standstill in multiple banks and countries, leaving customers unable to make payments or accessing services, and undermining confidence in the financial system.
The U.S. Treasury Department, the European Union, the Bank of England, and the Bank of France are among those stepping up their review of cloud technology to mitigate the risks of banks that rely on a small group of tech firms and company is "locked in" or overly dependent. with a cloud provider.
"We are very vigilant that things will fail," said Simon McNamara, chief administrative officer of UK bank NatWest. "If 10 organizations are unprepared and connected to one vendor that is disappearing, then we all have a problem."
The EU proposed in September regulating “critical” external services to the financial industry, such as the cloud, to bolster existing recommendations to outsource banking supervision of the bloc from 2017.
The Bank of England's Financial Policy Committee (FPC), meanwhile, wants better insight into agreements between banks and cloud operators, and the Bank of France told lenders last month that they must have a written contract that controls outsourced Activities clearly defined.
"The FPC believes that additional policy measures are needed to mitigate the risks to financial stability in this area," it said in July.
The European Central Bank, which regulates the largest lenders in the euro area, said on Wednesday that bank spending on cloud computing rose more than 50% in 2019 compared to 2018.
And that is just the beginning. According to data from technology research firm IDC, according to Reuters, global bank spending on cloud services will more than double from $ 32.1 billion in 2020 to $ 85 billion in 2025.
An IDC survey of 50 major banks around the world identified only six major cloud service providers: IBM (NYSE :), Microsoft, Google, Amazon, Alibaba (NYSE 🙂 and Oracle (NYSE :).
Amazon Web Services (AWS) – the largest cloud provider according to the Synergy Group – achieved revenue of $ 28.3 billion in the six months to June, an increase of 35% year-over-year and more than the annual revenue of 25, $ 7 billion in 2018.
While all industries have increased cloud spending, analysts told Reuters that financial services companies have moved faster since the pandemic following explosive demand for online banking and emergency loan programs.
"Banks are still very scrupulous, but they are more comfortable with the model and are moving at a fairly fast pace," said Jason Malo, director analyst at Consultants gardener (NYSE :).
(Graphic: Bank spending on cloud technology will rise sharply Bank spending on cloud technology will rise – https://graphics.reuters.com/BANKS-CLOUD/zjvqkqbnzvx/chart.png)
NO MORE SECRETS
Regulators fear cloud outages would cause banking systems to fall over and prevent people from accessing their money, but say they have little insight into cloud providers.
Last month, the Bank of England said that big tech companies could dictate terms to finance companies and not always provide enough information to their customers to monitor risk – and that "secrecy" must stop.
There is also concern that banks may not adequately spread their risk across cloud providers.
Google told Reuters that, according to a recent survey, less than a fifth of financial firms were using multiple clouds if one were to fail, although 88% of those who did not share their risk planned to do so within a year.
Central bank sources said that part of the solution could be some sort of mechanism that validates cloud providers' resilience to banks to mitigate the sector's overall exposure to a cloud service – with banking regulators having the overall perspective.
"Regardless of the division of control tasks between the cloud service provider and the bank, the bank is ultimately responsible for the effectiveness of the control environment," said the US Federal Reserve in a draft guideline that was issued to lenders last month.
FINRA, which regulates Wall Street brokers, released a report on Monday ahead of possible rule changes to ensure that cloud usage is not harming the market or investors.
However, easily switching cloud providers when needed is a task that is easier said than done and could lead to business disruption, according to the FINRA report.
"With us the money stops"
Banks and tech companies dispute the assumption that the rise in the adoption of the cloud makes the financial system's infrastructure inherently riskier.
Adrian Poole, director of financial services in the UK and Ireland at Google Cloud, said the cloud could strengthen a bank's security functions more effectively than building them in-house.
UK digital lender Zopa said it has moved 80% of its transactions to the cloud and is working to mitigate risk. Zopa Chief Executive Jaidev Janardana said the company is also consciously relying on the expertise of technology companies.
"Cloud providers invest a lot of resources in security on a scale that only a few individual companies could handle," he said.
Google's Poole said the company is open to working more closely with financial regulators.
"One day regulators could pull data from regulated banks using cloud-enabled application programming interfaces (APIs) instead of waiting for banks to submit data to them on a regular basis," he said.
NatWest's McNamara said the bank is working closely with tech companies and regulators to mitigate risk and has put in place alternative services in case things go wrong.
"The money stops with us," said McNamara. "We don't all put our eggs in one basket."
One problem, however, is that not all banks fully understand the resilience risks that could come with a major move to the cloud, said Jost Hoppermann, principal analyst at Forrester, especially the smaller lenders.
"Some banks do not have the necessary know-how," he said. "They think that will make all their problems go away, and that is certainly not true."