For banking regulators, tech giants are now too big to fail
London – More than a decade after the financial crisis, regulators fear again that some companies at the heart of the financial system are too big to fail. But these are not banks.
This time around, it’s tech giants like Google, Amazon, and Microsoft, who host a growing mass of banking, insurance, and market operations on their vast cloud internet platforms, that keep the watchdogs awake at night.
Central bank sources said the speed and extent with which financial institutions are moving critical operations such as payment systems and online banking to the cloud represented a dramatic change in potential risk.
“We are only at the beginning of the paradigm shift, so we need to make sure we have an appropriate solution,” said a financial regulator from a country in the Group of Seven who refused to be named.
It’s the latest sign of how financial regulators, along with their data and competition peers, are scrutinizing the global clout of big tech.
Banks and tech companies say that greater use of cloud computing is a win-win as it leads to faster, cheaper services that are more resilient to hackers and outages.
However, regulators fear that a cloud company breakdown could bring vital services to a standstill in multiple banks and countries, leaving customers unable to make payments or accessing services and undermining confidence in the financial system.
The U.S. Treasury Department, the European Union, the Bank of England and the Bank of France are among those stepping up their review of cloud technology to mitigate the risks of banks that rely on a small group of tech firms and company is “locked in” or overly dependent. with a cloud provider.
“We are very vigilant that things will fail,” said Simon McNamara, chief administrative officer of UK bank NatWest. “If 10 organizations are unprepared and connected to one vendor that is disappearing, then we all have a problem.”
The EU proposed in September regulating “critical” external services to the financial industry, such as the cloud, to reinforce existing 2017 recommendations on outsourcing banking supervision of the bloc.
The Bank of England’s Financial Policy Committee (FPC), meanwhile, wants better insight into agreements between banks and cloud operators, and the Bank of France told lenders last month that they must have a written contract that controls outsourced Activities clearly defined.
“The FPC believes that additional policy measures are needed to mitigate the risks to financial stability in this area,” it said in July.
The European Central Bank, which regulates the largest lenders in the euro area, said on Wednesday that banks’ spending on cloud computing increased by more than 50% in 2019 compared to 2018.
And that is just the beginning. According to data from technology research firm IDC, according to Reuters, bank spending on cloud services around the world will more than double from $ 32.1 billion in 2020 to $ 85 billion in 2025.
An IDC survey of 50 major banks around the world identified only six major cloud service providers: IBM, Microsoft, Google, Amazon, Alibaba and Oracle.
Amazon Web Services (AWS) – the largest cloud provider according to the Synergy Group – achieved sales of $ 28.3 billion in the six months to June.
While all industries have increased cloud spending, analysts said financial services companies have moved faster since the pandemic following explosive demand for online banking and emergency loan programs.
“Banks are still very busy, but they are more comfortable with the model and are moving at a pretty fast pace,” said Jason Malo, director analyst at consulting firm Gartner.
No more secrecy
Regulators fear cloud outages would cause banking systems to fall over and prevent people from accessing their money, but say they have little insight into cloud providers.
Last month, the Bank of England said that big tech companies could dictate terms to finance companies and not always provide enough information to their customers to monitor risk – and that “secrecy” needs to end.
There is also concern that banks may not adequately spread their risk across cloud providers.
Google told Reuters that, according to a recent survey, less than a fifth of financial firms were using multiple clouds if one were to fail, although 88% of those who didn’t share their risk planned to do so within a year.
Central bank sources said that part of the solution could be some type of mechanism that validates cloud providers’ resilience to banks in order to mitigate the sector’s aggregate risk to a cloud service – with banking regulator in charge.
“Regardless of the division of control tasks between the cloud service provider and the bank, the bank is ultimately responsible for the effectiveness of the control environment,” said the US Federal Reserve in a draft guideline that was issued to lenders last month.
FINRA, which regulates Wall Street brokers, released a report on Monday ahead of possible rule changes to ensure that cloud usage is not harming the market or investors.
However, hassle-free cloud provider switching when needed is a task that is easier said than done and could lead to business disruption, the FINRA report said.
“With us the money stops”
Banks and tech companies dispute the assumption that the rise in the adoption of the cloud makes the financial system’s infrastructure inherently riskier.
Adrian Poole, director of financial services in the UK and Ireland at Google Cloud, said the cloud can strengthen a bank’s security functions more effectively than building them in-house.
UK digital lender Zopa said it has moved 80% of its transactions to the cloud and is working to mitigate risk. Zopa boss Jaidev Janardana said the company is also consciously relying on the expertise of technology companies.
“Cloud providers invest a lot of resources in security on a scale that few individual companies can handle,” he said.
Google’s Poole said the company is open to working more closely with financial regulators.
“Someday, we could watch regulators pull data from regulated banks using cloud-enabled application programming interfaces (APIs) on demand instead of waiting for banks to submit data to them on a regular basis,” he said.
NatWest’s McNamara said the bank is working closely with tech companies and regulators to mitigate risk and has set up alternative services in case things go wrong.
“The money stops with us,” said McNamara. “We don’t put all our eggs in one basket.”
One problem, however, is that not all banks fully understand the resilience risks that could come with a major move to the cloud, said Jost Hoppermann, principal analyst at Forrester, especially the smaller lenders.
“Some banks do not have the necessary know-how,” he said. “They think that will make all their problems go away, and that is certainly not true.”
In a time of misinformation and too much information, Quality journalism is more important than ever.
By subscribing you can help us get the story right.