Cloud computing

A host of benefits have continued to entice banks to adopt cloud-based technology, but as with any large-scale transformation it is not always straightforward. Marie Kemplay reports.

It has been a decade since banks first began utilising cloud-based technology. But, in some respects it remains early days. Although many investment banks now use the technology in some form, adoption has often been cautious and incremental.  

Many banks continue to use the cloud largely for testing and development, and have few processes in a live environment. Another area of consideration has been public versus private cloud – public cloud being infrastructure provisioned for use by multiple organisations, versus private cloud for just one. The latter being an option many banks initially pursued due to data security and other considerations, but it can be less flexible.

However, this may be about to change. Many banks are planning to increase the sophistication of their cloud-based set-ups. Tara Winters, capital markets head of global managed services at financial technology and outsourced services provider, FIS, says: “Banks have tended to be more cautious in moving to the cloud than other industries, due to regulatory challenges, technology debt and complex environments. However, we’re continuing to see an increase in cloud adoption in investment banking.”

Multiple benefits

The expected benefits of cloud technology for investment banks are well established. Its fundamental basis is changing IT infrastructure from something provided in-house, to a utility purchased on demand, provided over the internet. There are different types, the three most common being infrastructure-as-a-service, platform-as-a-service and software-as-a service.

Manifold benefits are put forward, such as reduced costs, increased agility, elasticity and scalability of resources, improved efficiency and increased resilience.

“There are a number of benefits,” says Bernd Leukert, chief technology, data and innovation officer at Deutsche Bank, which in December 2020 announced a strategic partnership with Google Cloud to co-innovate and accelerate the bank’s cloud transition. “With cloud, the capacity of our systems can easily be scaled up or down depending on our needs at any given time. Internal maintenance demands are lower. The technology is consistently being updated, which removes the problem of legacy systems developing. It also improves productivity and speed to market.”

HSBC has adopted a “multi-cloud approach” – engaging with a number of cloud providers. Stephen Bayly, chief information officer, markets and securities services, describes the maturity of the bank’s cloud adoption as “past the proof of concept and early adoption stage, and into a more industrialised adoption phase”, although he says the bank still has much further to go.

He also identified capacity management as a key benefit, particularly during significant changes in demand, like during the market volatility of March 2020. “The demands on some of our systems at that time rapidly increased substantially, and if you have a fixed capacity on-premises model then it is very difficult to react to that,” says Mr Bayly. “Whereas in a cloud environment it can be scaled up seamlessly, and also easily return back to normal volumes.”

He also describes more novel benefits such as “greater transparency as to the carbon footprint of our technology. We’re able to track the energy usage and carbon emissions of our processes at a very granular level. This enables us to make informed decisions about our workload placement strategy.”

One of the real benefits of the cloud is that if you make the most of its flexibility, you can have substantial savings

Christophe Boulangé, BNP Paribas

BNP Paribas, which has what it calls a “dedicated cloud” with IBM, where it has “public technology in the private environment” that it began using from July 2021 following a three-year development period (and it is currently in the process of migrating legacy systems) says it has already been able to achieve 50% cost savings in specific areas. Christophe Boulangé, cloud director at BNP Paribas, says: “One of the real benefits of the cloud is that if you make the most of its flexibility, you can have substantial savings. There are quick wins, such as stopping the system running at night or weekends, but if you make more substantive efforts to change your behaviour and really optimise it, you can have much bigger results.”

It is clear that cost reduction is possible via cloud use although Graeme Hughes, who heads Accenture’s capital markets cloud team, says there is good awareness that it isn’t a “panacea”. “Use case by use case, there are opportunities to reduce costs,” he says, but believes banks are mostly looking for “innovation and agility. It’s about speeding up innovation, using value-added services, reducing pressure on in-house IT and putting technology in the hands of business line technologists as quickly as possible.”

The people effect

The pandemic also seems to have had some effect in accelerating adoption. US regulatory body Financial Industry Regulatory Authority (Finra) published a paper in August 2021 examining levels of cloud adoption in the US securities industry. Haimera Workie, senior director at Finra’s office of financial innovation, says: “I think it did accelerate the process. For those that had already begun the journey it made clear what some of the benefits are. For instance, systems capacity being able to cope with everyone working remotely. Those in a cloud environment found migration to additional capacity fairly seamless.”

However, migrating to the cloud is not without challenges. Speaking on Finra’s podcast, Mr Workie highlighted its research found some examples of broker dealers that had begun cloud adoption but subsequently hit pause and moved back to on-premises. Mr Workie singled out the challenge of ensuring organisational buy-in for business changes as significant in this context.

Indeed, it has become increasingly clear cloud adoption is not just about upgrading technology. “Although this is a technology-based shift, people are the most important part of it,” says Mr Leukert. “It is about adapting our processes and changing the way that people work.”

Bernard Gavgani, chief information officer at BNP Paribas, echoes this and highlights the importance of staff skills. “Cloud is a corporate programme, not just an IT programme, and it is everyone’s responsibility. So, we are training staff, not just in our technology teams but also on the business side, because they also need to understand how it works.”

Multiple market participants highlight the importance of upskilling or recruiting the right talent. “There are very few people that really understand the intricacies of moving from on-premises to a cloud environment,” says Virginie O’ Shea, CEO and founder of capital markets research consultancy Firebrand Research. “So that’s been a real challenge for a lot of large banks where they’ve been looking for the right staff, or needed to bring in consultants.”

Mr Leukert volunteers that “the biggest challenge has been the upskilling of staff to make sure they have the right skills and competencies to make the most of the technology’s potential”.

Although these are not insubstantial hurdles, a virtuous circle, where staff motivation is increased and new recruits are attracted, can be created in overcoming them. “There are significant cultural benefits,” says Mr Leukert, citing increased staff engagement and collaboration between teams. He also believes the bank’s partnership with a big name like Google has been a real positive in attracting and retaining talent.

HSBC’s Mr Bayly says: “A surprise benefit has been how moving to the cloud has supported a greater sense of ownership for our teams using the technology. The data and analytics that is available from the cloud providers, about how we use the platform, which processes consume the most processing capacity or cost the most, enables them to make informed decisions, and to make changes to their own systems and processes.”

Strategic approach

As with many technological changes, due to the costs involved, time constraints and business teams understandably often focused on achieving specific outcomes, gaining an appreciation of the importance of a more strategic approach is something that may come later.

Howard Boville, senior vice-president and head of cloud platform at IBM, and former chief technology officer at Bank of America, believes that we are “coming to end of chapter one, where a whole range of financial institutions have dabbled with the cloud, but not many have yet been able to derive significant value. To date it’s primarily been dealt with as a technology element, as opposed to there being a consideration about the business value they want it to deliver.”

Instead, he thinks to gain real benefits from this technology a more considered and strategic approach is required. “With chapter two, that’s very much thinking about the business value that you want to derive and thinking about the architecture that you need to achieve it,” he says.

It is not only banks that have come on a journey. Cloud providers too have needed to develop expertise in serving financial services, a market they appear to be dedicating increasing resources to. A notable development including Google Cloud’s recently announced 10-year partnership with CME Group, a major player in derivatives exchanges, “to accelerate CME Group’s move to the cloud and transform how global derivatives markets operate with technology”, involving a $1bn equity investment.

Larry Bortstein, co-founder of Bortstein Legal Group, a global law firm that primarily supports financial services firms in the areas of technology, digital content and privacy, observes that “the providers who have made the decision to serve the financial services industry and have invested heavily are the ones that are winning”.

The providers who have made the decision to serve the financial services industry and have invested heavily are the ones that are winning

Larry Bortstein, Bortstein Legal Group

He adds that “doing business in the financial services requires specialised knowledge. It may require administrative or technical changes to how platforms work and a significant level of investment to reach the required standard.”

Regulatory concerns

The evolving regulatory backdrop has also been a significant consideration for banks. For example, remarks from Andrew Bailey, governor of the Bank of England in July this year, made clear the UK regulator is taking a close interest. The EU, through its planned Digital Operational Resiliency Act, has proposed to introduce some significant requirements. Its proposed EU Data Act also includes plans to legislate for “cloud portability” (the ability to move between cloud providers with minimal disruption).

Regulatory concerns about market soundness and stability, and expectations of robust standards in areas such as data security and operational resilience, are accepted as legitimate in relation to cloud adoption. However, market participants are keen that regulators take a balanced approach.  

Tola Gbadebo, interim associate director in Association of Financial Markets in Europe’s (AFME’s) technology and operations division, says: “It is understandable for regulators to have an interest in the resilience of financial institutions. However, financial services firms are calling for a balanced and proportionate approach, because if the sector is too tightly regulated, particularly during this adoption phase, then we could lose some of the benefits cloud can bring.”

Concentration risk

Concentration risk, that is too many firms relying on too few cloud providers, particularly in the event of a provider suffering a major outage, is one such area that has come to the regulatory fore. Microsoft Azure, Amazon Web Services and Google Cloud have collectively become dominant players. 

While accepted as a valid concern, it is not straightforward to address. In time, market share may be split among a broader range of providers, particularly as many banks may ultimately adopt multi-cloud strategies. But this is unlikely to be the case very soon.

Ms Gbadebo says: “At an individual firm level, firms should assess their exposure to concentration risk and take the requisite action they can in order to mitigate that risk. The challenge is, that to a certain extent, regulators have an expectation that firms can look across the sector and have visibility of where the concentration issues are. The regulator itself is better placed to have that holistic view.”

Portability, and the ability to move providers quickly, could be potentially be a mitigant but AFME suggests that at the present time there are challenges around this concept.

Ian Waterworth, a director in AFME’s technology and operations division, says: “The idea of portability is great in principle. But at this stage it would be difficult for a number of reasons. For instance, applications would likely need to be engineered to operate optimally in different cloud providers environments. This would have ongoing further cost implications to realise the benefits of being able to bring up an application in a different cloud provider’s environment in response to an incident. You would need to manage your system in such a way that the secondary version of the application is always completely ready to be used.”

Varying expectations

Another issue that has been raised is there sometimes being a disconnect between regulatory expectations, and what vendors are willing to provide, in areas such as access to data for audit purposes.

This was highlighted in an October 2020 paper published by US securities industry association Sifma, which examined emerging regulatory requirements for financial institutions across the US, EU, UK, and Canada in relation to infrastructure-as-a-service cloud services. Such concerns were also reiterated more recently in Sifma’s response to Finra’s August 2021 paper.

Mr Bortstein, whose firm worked with Sifma on that paper, believes regulators should, as well as focusing on financial institutions, consider cloud providers too. “The core mission of these regulators is the safety and soundness of the financial system as a whole, and that does extend to technology providers and other third parties,” he says. “I think it’s really important for regulators to focus on the entire ecosystem.”

He adds: “It would be good to see regulators educating providers, or at least suggesting to them that if they would like to be providers for the financial services industry, that is different to providing services to consumers or non-regulated industries.”

Neither Mr Bortstein nor the Sifma paper refer to any specific providers in relation to these issues. In general, there is said to be a growing level of engagement between cloud providers and regulators. Adrian Poole, head of financial services UK and Ireland at Google Cloud, says: “We understand that financial regulators need to ensure that technology adoption is done in a manner consistent with safety and soundness principles, and we are entirely aligned with them on that. We’re committed to working with financial services customers and regulators to provide them with controls and assurances on risk management, data locality, transparency, compliance and operational resiliency.”  

Mr Boville says IBM regularly engages with regulators and has built its cloud platform to address regulatory requirements by default.

The likelihood is that as more financial firms engage in this area, and as regulators increase their involvement, if there are any kinks in the relationships between regulators, banks and cloud providers, these will, one way or another, be ironed out.

Overall, despite the challenges there is a strong sense of optimism that the cloud will have a significant and positive impact on the resiliency, agility and flexibility of the financial services industry. But there is still plenty of road to run.

PLEASE ENTER YOUR DETAILS TO WATCH THIS VIDEO

All fields are mandatory

The Banker is a service from the Financial Times. The Financial Times Ltd takes your privacy seriously.

Choose how you want us to contact you.

Invites and Offers from The Banker

Receive exclusive personalised event invitations, carefully curated offers and promotions from The Banker



For more information about how we use your data, please refer to our privacy and cookie policies.

Terms and conditions

Join our community

The Banker on Twitter