Are the cloud providers too big to fail?

In ditch­ing their out­dat­ed, expen­sive and inef­fi­cient oper­a­tional soft­ware for advanced cloud plat­forms, our tech-addict­ed banks may have swapped one set of sta­bil­i­ty risks for anoth­er. 

Reg­u­la­tors wor­ry that so-called cloud con­cen­tra­tion risk – rely­ing on a tiny group of providers to pro­vide key ser­vices – could trig­ger the next glob­al melt­down if left unad­dressed. 

“If the world’s finan­cial mar­ket infra­struc­ture ulti­mate­ly sits with two or three cloud providers, the risk of one of those going down could eas­i­ly pose a big­ger threat to finan­cial sta­bil­i­ty than the col­laps­es of Lehman Broth­ers or North­ern Rock, if not man­aged cor­rect­ly,” warns Bradley Rice, finan­cial ser­vices part­ner at Ashurst. 

In the past decade, banks have flocked to three main providers: Ama­zon Web Ser­vices (AWS), Microsoft Azure and Google Cloud. These three are behe­moths, with the scale and resources to han­dle the data pro­cess­ing, main­te­nance and secu­ri­ty demands of the glob­al finan­cial sys­tem. 

Accord­ing to research by S&P Glob­al, about 45% of finan­cial ser­vices firms use AWS as their pri­ma­ry provider, with Azure clock­ing a sim­i­lar per­cent­age. Those with more than one cloud provider also employ a sec­ond from the same trio. Azure is used in some shape or form by 79% of finan­cial ser­vices firms.

Inter­na­tion­al and domes­tic reg­u­la­tors think this dom­i­nance is unhealthy. In the UK, the Finan­cial Con­duct Author­i­ty (FCA), the Pru­den­tial Reg­u­la­tion Author­i­ty and the Bank of Eng­land have all warned of cloud con­cen­tra­tion risk. They are meet­ing indus­try rep­re­sen­ta­tives to stress the dan­gers of rely­ing too much on the out­sourc­ing of ser­vices. 

What hap­pens if a cloud provider is tak­en out by a hos­tile force or oth­er­wise fails? There are also com­pe­ti­tion con­cerns: giv­en the amount of respon­si­bil­i­ty and pow­er the trio hold, there are fears that they could hold firms to ran­som. 

“If sig­nif­i­cant num­bers of com­pa­nies in the indus­try are run­ning on one cloud provider, that provider becomes a sys­tem­i­cal­ly impor­tant part of the finan­cial sys­tem by default,” notes Bo Sve­jstrup, exec­u­tive vice-pres­i­dent of COO func­tions and data at Danske Bank. “If that provider has an issue that caus­es ser­vices to become unavail­able for an extend­ed peri­od, this could cre­ate sys­temic prob­lems at nation­al or even region­al lev­els.”

Cloud adop­tion has soared dur­ing the pan­dem­ic. But Covid isn’t entire­ly to blame for the present sit­u­a­tion, accord­ing to the head of resilience at one UK invest­ment bank. Com­ment­ing anony­mous­ly, he says that the City has been shift­ing oper­a­tions into the cloud to save mon­ey for many years.

“This move has tak­en place in iso­la­tion with­out wider design or con­sid­er­a­tion for sys­temic oper­a­tions,” the exec­u­tive says, adding that lit­tle thought has been giv­en to what would hap­pen should a cloud provider pull the plug or suf­fer a wide­spread fail­ure.

“Lit­er­al­ly nobody is doing any­thing. That’s because most big play­ers – Ama­zon, Google, Microsoft and so on – do not care about some UK bank dic­tat­ing that they need to send resilience assur­ance,” he claims.

Giv­en the soft­ware giants’ reluc­tance to sub­mit them­selves to the same foren­sic exam­i­na­tion faced by their finance clients, reg­u­la­tors “will have to row back on some of their expec­ta­tions and dead­lines”, the exec­u­tive says. 

“I hear the same thing – ‘my third par­ties aren’t play­ing ball’ – on indus­try call I go on,” he adds. “It’s not real­is­tic to ask banks to con­sid­er alter­na­tives to their cloud sys­tems, because the cost and scale of doing that is not sen­si­ble.”

Microsoft, Google and AWS are all declin­ing to com­ment on this issue, as is the FCA. The Bank of Eng­land is mak­ing no offi­cial com­ment either, but a Bank exec­u­tive will at least con­firm that it has spo­ken “a fair bit” about the cloud and its respec­tive risks in the past year. 

It con­sid­ers the mat­ter “sig­nif­i­cant” and will con­tin­ue to meet indus­try rep­re­sen­ta­tives, the exec­u­tive says, adding that new poli­cies and laws will be need­ed to mit­i­gate the sta­bil­i­ty risks.

Such leg­is­la­tion will invari­ably try to catch up with new tech­nol­o­gy by adding to oper­a­tional resilience demands, says Jonathan Emmanuel, part­ner at Bird & Bird. But he says firms should con­tin­ue to think in terms of per­ceived risk ver­sus the actu­al risk of retain­ing archa­ic lega­cy sys­tems.

“Reg­u­la­tors are try­ing to ease firms into a new way of think­ing, but it will not be long before we see some major enforce­ment action over an oper­a­tional resilience fail­ure,” Rice adds. “Ulti­mate­ly, I think we will see reg­u­la­tors around the world reg­u­lat­ing crit­i­cal infra­struc­ture providers, like the cloud providers, data providers and oth­er mar­ket infra­struc­ture providers.” 

For banks them­selves, there is no future sce­nario where the cloud becomes less impor­tant or cen­tral to oper­a­tions. 

“Many finan­cial ser­vices organ­i­sa­tions now see them­selves more as tech­nol­o­gy com­pa­nies that hap­pen to oper­ate in a reg­u­lat­ed sec­tor,” Emmanuel says. 

Some have no phys­i­cal pres­ence what­so­ev­er. Their data is spread across geo­gra­phies rather than host­ed on the premis­es, as was the norm a decade ago. Star­ling, one of the most pop­u­lar bank­ing apps, offers a 100% dig­i­tal ser­vice; it is acute­ly aware of con­cen­tra­tion risk.

“From con­cep­tion, Star­ling has deployed its sys­tems and ser­vices across mul­ti­ple clouds which work to back up our data in real time,” says Steve New­son, the bank’s chief tech­nol­o­gy offi­cer. “By doing this, we ensure that we aren’t depen­dent on one sin­gle third-par­ty sup­pli­er and we reduce risk.”

Danske Bank also oper­ates with a mul­ti-cloud strat­e­gy, access­ing var­i­ous ser­vices from dif­fer­ent providers. This ensures the firm isn’t in hock to one sup­pli­er should the rela­tion­ship sour. 

“For any ser­vice provider, we must have an exit strat­e­gy allow­ing us to migrate the ser­vice to anoth­er provider or to an in-house solu­tion at any point,” says Sve­jstrup. This cov­ers the haz­ards of ser­vices being unavail­able for what­ev­er rea­son, includ­ing a con­tract dis­pute between the bank and its cloud oper­a­tor.

The way for­ward is to employ a more rig­or­ous approach to resilience, Sve­jstrup says. The degree of expo­sure to dif­fer­ent providers should be trans­par­ent for both reg­u­la­tor and indus­try, adding trans­paren­cy to some com­plex rela­tion­ships. 

“Every insti­tu­tion needs a clear overview of its expo­sure to cloud providers as well as clear­ly defined and well-test­ed exit plans,” he says.

Indus­tries beyond finan­cial ser­vices should also heed the les­son and avoid becom­ing seduced by a sin­gle big-name cloud provider promis­ing to take care of every­thing. 

“This fun­da­men­tal prac­tice is also good for oth­er sec­tors that pro­vide sys­temic and crit­i­cal func­tions,” Sve­jstrup says. “It reduces the risk of out­ages, insta­bil­i­ty and poor ser­vice qual­i­ty, what­ev­er you pro­vide.”