For banking regulators, the tech giants are now too big to fail

LONDON, Aug 20 (Reuters) – More than a decade after the financial crisis, regulators were once again scared that some companies at the heart of the financial system are too big to fail. But they are not banks.

This time it is the tech giants, including Google (GOOGL.O), Amazon (AMZN.O) and Microsoft (MSFT.O), that are hosting a growing mass of banking, insurance and market operations in their vast cloud internet platforms that keep watchmen awake. at night.

Central bank sources told Reuters that the speed and scale with which financial institutions move critical operations such as payment systems and online banking in the cloud constituted a gradual shift in potential risks.

“We are only at the beginning of the paradigm shift, so we need to make sure we have a proper solution for the purposes,” said a financial regulator from a Group of Seven country, who declined to be appointed.

It is the latest sign of how financial regulators are joining their data and competition counterparts to examine more closely the global influence of big technologies.

Banks and technology companies claim that greater use of cloud computing is a winner, as it results in faster and cheaper services that are more resistant to hackers and disruptions.

But regulatory sources say they fear a problem in a cloud company could reduce key services in several banks and countries, leaving customers unable to make payments or access services and undermine confidence in the financial system.

The U.S. Treasury, the European Union, the Bank of England and the Bank of France are among those stepping up their control over cloud technology to mitigate the risks that banks depend on a small group of companies. and technology companies that are “closed” or overly dependent, in a cloud provider.

“We are very vigilant that things will go wrong,” said Simon McNamara, managing director of British bank NatWest (NWG.L). “If ten organizations are unprepared and connected to a disappearing provider, we will all have a problem.”

FAST STEP

The EU proposed in September to regulate “critical” external services for the financial industry, such as the cloud, to bolster existing recommendations on blockchain banking authority outsourcing dating back to 2017.

Meanwhile, the Bank of England’s Financial Policy Committee (FPC) wants to better understand the agreements between banks and cloud operators and the Bank of France told creditors last month that they should have a written contract that clearly defines the controls on subcontracted activities.

“The FPC believes that additional policy measures are needed to mitigate the risks of financial stability in this area,” he said in July. Read more

The European Central Bank, which regulates the largest lenders in the eurozone, said on Wednesday that banking spending on cloud computing increased by more than 50% in 2019 from 2018 onwards.

And that’s just the beginning. According to data from technology research firm IDC shared with Reuters, spending on cloud services by banks worldwide is projected to double to $ 85 billion in 2025, from $ 32.1 billion in 2020, to to $ 20 billion by 2020.

An IDC survey of 50 major banks worldwide identified only six major cloud service providers: IBM (IBM.N), Microsoft, Google, Amazon, Alibaba (9988.HK) and Oracle (ORCL.N).

Amazon Web Services (AWS), the largest cloud provider according to Synergy Group, recorded sales of $ 28.3 billion in the six months to June, 35% more than the previous year and higher than its annual revenue of 25,700 million dollars in 2018.

While all industries have increased spending in the cloud, analysts told Reuters that financial services companies had advanced faster since the pandemic following an explosion in demand for online banking and banking systems. emergency loans.

“Banks are still very diligent, but they have achieved a higher level of comfort with the model and are moving at a fairly fast pace,” said Jason Malo, chief analyst at Gartner Consultants.

NO MORE SECRET

Regulators are concerned that cloud failures will bring down banking systems and prevent people from accessing their money, but they say they have little visibility over cloud providers.

Last month, the Bank of England said that big tech companies could dictate terms and conditions to financial companies and did not always provide enough information so their customers could control the risks, and that the “secret” had to end. .

He is also concerned that banks are not distributing enough risk among cloud providers.

Google told Reuters that less than a fifth of financial firms used multiple clouds in case one failed, according to a recent survey, although 88% of those who did not spread the risk still planned to do so. in a year. Read more

Central bank sources said part of the solution could be a form of mechanism that provides security over the recovery capacity of cloud providers to banks to mitigate the sector’s aggregate exposure to a cloud service, with the banking regulator has the general point of view.

“Regardless of the division of control responsibilities between the cloud service provider and the bank, the bank is ultimately responsible for the effectiveness of the control environment,” the U.S. Federal Reserve said in a draft of guide issued to lenders last month.

FINRA, which regulates Wall Street brokers, released a report on Monday ahead of possible changes to the rules to ensure the use of the cloud does not harm the market or investors.

Being able to easily switch cloud providers when needed is, however, an easier task to say than to do and could introduce disruptions to business, according to the FINRA report.

“THE BUCK FOR US”

Banks and technology companies reject the suggestion that greater adoption of the cloud makes financial system infrastructure inherently riskier.

Adrian Poole, UK and Ireland director of financial services at Google Cloud, said the cloud may be more effective at strengthening a bank’s security capabilities than building it at home.

British digital lender Zopa said it had moved 80% of its transactions to the cloud and was working to mitigate the risks. Zopa CEO Jaidev Janardana said the company also deliberately relied on the experience of technology companies.

“Cloud providers invest a lot of resources in security on a scale that few individual companies could manage,” he said.

Google’s Poole said the company was open to working more closely with financial regulators.

“We may one day see regulators extracting data on demand from regulated banks with cloud-enabled application (API) programming interfaces, rather than waiting for banks to transmit data to them periodically,” he said. .

NatWest’s McNamara said the bank was working closely with companies and technology regulators to mitigate the risks and had established alternative services in case things went wrong.

“The dollar stops with us,” McNamara said. “We don’t put all the eggs in one basket.”

One problem, however, is that not all banks have a full understanding of the risks to resistance that a wholesale shift in the cloud could entail, said Jost Hoppermann, chief analyst at Forrester, particularly smaller lenders.

“Some banks don’t have the necessary knowledge,” he said. “They think doing that will get rid of all their problems, and certainly that’s not true.”

Reports by Iain Withers and Huw Jones; Additional reports by Michelle Price in Washington and Francesco Canepa in Frankfurt; Editing by Rachel Armstrong and David Clarke

Our standards: the principles of trust of Thomson Reuters.