How banking’s big-tech partners could be subjected to regulatory oversight

Dur­ing the 1950s, lengthy pow­er cuts weren’t unusu­al in the UK, but peo­ple were able to shrug them off because most homes and ser­vices hadn’t come to rely on elec­tric­i­ty. If the grid were to fail com­plete­ly tomor­row, it would bring down the nation’s tele­coms sys­tems and force most of us to buy bot­tled drink­ing water – if we could find the cash to pay for it and shops still open to sell it – in a mat­ter of days, accord­ing to the Ener­gy Research Part­ner­ship.

But elec­tric­i­ty is not the only crit­i­cal ser­vice. Sev­en decades ago, banks could have func­tioned by can­dle­light. Today, they rely on cloud com­put­ing. Providers of cloud ser­vices have become what the gov­ern­ment calls crit­i­cal third par­ties, which “could affect finan­cial sta­bil­i­ty and cause harm to con­sumers if they fail or are dis­rupt­ed”. The finan­cial ser­vices and mar­kets (FSM) bill, which has had its sec­ond read­ing in the Com­mons, aims to grant the industry’s reg­u­la­tors over­sight of those crit­i­cal third par­ties. 

Mon­i­ca Sas­so is chief tech­nol­o­gist for the EMEA finan­cial ser­vices indus­try at Red Hat, a sub­sidiary of IBM. She observes that the sec­tor has made dra­mat­ic changes to the hard­ware and soft­ware it uses in recent years, includ­ing the wide­spread adop­tion of pub­lic cloud ser­vices. 

“In many places this move has evolved, rather than being part of a strate­gic plan. Mean­while, fin­tech firms have been able to scale up quick­ly because they haven’t need­ed to main­tain hard­ware or decide where the soft­ware is run,” Sas­so says. “But at what point does the hard­ware – that is, the servers in the cloud – become part of their busi­ness process­es?”

Getting the oversight right

There are good rea­sons for banks to enter the cloud. It can reduce their costs, increase their resilience and give them access to the lat­est tech­no­log­i­cal inno­va­tions. But most pub­lic cloud ser­vices are pro­vid­ed by a small num­ber of so-called hyper­scalers – par­tic­u­lar­ly Ama­zon Web Ser­vices (AWS), Google Cloud and Microsoft Azure – which gives rise to con­cen­tra­tion risk. 

What mea­sures, then, could reg­u­la­tors have in mind to man­age that risk? 

Simon Crown is a part­ner spe­cial­is­ing in finan­cial reg­u­la­tion at mag­ic-cir­cle law firm Clif­ford Chance. With the FSM bill at com­mit­tee stage in the Com­mons, he believes “it’s unlike­ly that the Trea­sury will tie its own hands, or allow reg­u­la­tors to do so, by giv­ing the term ‘crit­i­cal third par­ty’ a nar­row and tight­ly word­ed def­i­n­i­tion”. 

Crown expects the Finan­cial Con­duct Author­i­ty (FCA) and the Bank of England’s Pru­den­tial Reg­u­la­tion Author­i­ty (PRA) to issue guid­ance in light of respons­es to Oper­a­tional Resilience: crit­i­cal third par­ties to the UK finan­cial sec­tor, the dis­cus­sion paper they pub­lished joint­ly in July. 

“That may give more colour to the quan­ti­ta­tive cri­te­ria that will be con­sid­ered,” he says.

Sas­so hopes that this process will stim­u­late “a con­ver­sa­tion about what ‘state of the art’ means – for exam­ple, when it comes to secu­ri­ty and the soft­ware sup­ply chain”. 

Her con­cern is that, below the con­tain­er plat­form lay­er where the appli­ca­tions are man­aged, there are sev­er­al pieces of soft­ware and hard­ware that banks can lose con­trol of when out­sourc­ing. “That comes with ben­e­fits and chal­lenges,” she says. “It’s a bit of a dance to get the over­sight right.” 

A modern regulatory framework

It’s not that banks aren’t extreme­ly care­ful when out­sourc­ing such crit­i­cal infra­struc­ture, stress­es Nitesh Palana, direc­tor of risk and com­pli­ance at Thought Machine, a provider of core bank­ing soft­ware.

“They don’t just flip over to us. There’s a whole process that they go through,” he says, adding that this can take months to com­plete. 

Are banks at risk of get­ting tied to a par­tic­u­lar cloud provider? “Mov­ing from one cloud to anoth­er is always a chal­lenge, but there are strate­gies to man­age it,” says Daniel Bland­er, Thought Machine’s direc­tor of secu­ri­ty. “The rea­son we use [appli­ca­tion man­age­ment sys­tem] Kuber­netes is that it’s ubiq­ui­tous across plat­forms. It enables us to run ser­vices in par­al­lel on dif­fer­ent clouds.” 

Kuber­netes is designed to man­age appli­ca­tions that work using small units of soft­ware known as con­tain­ers, which can run on a wide range of hard­ware. The flex­i­ble func­tion­al­i­ty offered by Kuber­netes and con­tain­ers is one rea­son why the forth­com­ing leg­is­la­tion won’t need to apply to pure bank­ing soft­ware providers such as Thought Machine. 

Hard­ware providers, by con­trast, will be cov­ered. Could that be a bur­den? Michael Jef­fer­son, head of UK finan­cial ser­vices pub­lic pol­i­cy at AWS, views the bill more as an oppor­tu­ni­ty for his com­pa­ny to shape the industry’s devel­op­ment. 

“We look for­ward to work­ing with the Bank of Eng­land, PRA and FCA to sup­port a future frame­work that accel­er­ates the dig­i­tal­i­sa­tion and mod­erni­sa­tion of the finan­cial sec­tor,” he wrote in a post on the AWS Blog in July. 

Banking on the cloud

Will the watch­dogs need over­sight of the opaque algo­rithms used by the machine-learn­ing tech that’s becom­ing increas­ing­ly preva­lent in finan­cial ser­vices? 

Daniel Schwarz, a senior asso­ciate with Clif­ford Chance and a legal fel­low at the Cam­bridge Cen­tre for Finance, Tech­nol­o­gy & Reg­u­la­tion, believes it’s “impor­tant that reg­u­la­tors have an under­stand­ing of these algo­rithms, so that they can mon­i­tor risk. This area is becom­ing ever more impor­tant as both the vol­ume and the veloc­i­ty of data increase. It will be sub­ject to greater scruti­ny.”

Sas­so points to anoth­er like­ly top­ic of inter­est for reg­u­la­tors: the use of fin­tech firms by non-bank­ing busi­ness­es to offer their cus­tomers bank­ing as a ser­vice (BaaS).

“The new risk is that a BaaS provider may not have con­trol over who the fin­tech firm is onboard­ing as a cus­tomer, yet it needs to man­age the risk this presents in terms of the anti-mon­ey-laun­der­ing and know-your-cus­tomer require­ments,” she says, adding that this calls for the tra­di­tion­al three lines of defence – front office, com­pli­ance and inter­nal audit – to adopt a more joined-up approach. 

Despite the sector’s wide­spread adop­tion of the cloud, many play­ers are still using at least some lega­cy IT. Banks in the US are fac­ing reg­u­la­to­ry pres­sure to migrate away from old in-house tech­nolo­gies. The FCA stress­es that it is focused on out­comes and doesn’t pre­scribe which hard­ware and soft­ware to use. It’s unlike­ly to need to, giv­en that the Bank of Eng­land not­ed in its response to the 2019 van Stee­nis review of the future of finance that mov­ing to the cloud could cut a bank’s tech infra­struc­ture costs by as much as half. There is only one direc­tion of trav­el – for both banks and their reg­u­la­tors. 

During the 1950s, lengthy power cuts weren’t unusual in the UK, but people were able to shrug them off because most homes and services hadn’t come to rely on electricity. If the grid were to fail completely tomorrow, it would bring down the nation’s telecoms systems and force most of us to buy bottled drinking water – if we could find the cash to pay for it and shops still open to sell it – in a matter of days, according to the Energy Research Partnership.

But electricity is not the only critical service. Seven decades ago, banks could have functioned by candlelight. Today, they rely on cloud computing. Providers of cloud services have become what the government calls critical third parties, which “could affect financial stability and cause harm to consumers if they fail or are disrupted”. The financial services and markets (FSM) bill, which has had its second reading in the Commons, aims to grant the industry’s regulators oversight of those critical third parties. 

Monica Sasso is chief technologist for the EMEA financial services industry at Red Hat, a subsidiary of IBM. She observes that the sector has made dramatic changes to the hardware and software it uses in recent years, including the widespread adoption of public cloud services.