For bank regulators, platform giants are now ‘too big to fail’

More than a decade after the financial crisis, regulators are once again scared that some companies at the heart of the financial system are too big to fail. But they are not banks.

This time it is the tech giants, including Google, Amazon and Microsoft, that host a growing mass of banking, insurance and marketing operations on their vast cloud internet platforms that keep watchdogs awake at night.

Central bank sources told reporters that the speed and scale at which financial institutions are moving critical operations like payment systems and online banking to the cloud constitute a sea change in potential risks.

“We are just at the beginning of the paradigm shift, therefore we must make sure we have a fit for purpose solution,” said a financial regulator from a G7 country, who declined to be named.

It’s the latest sign of how financial regulators are joining with their data and competition counterparts to take a closer look at the global influence of big tech.

Banks and tech companies say that increased use of cloud computing is win-win, as it results in faster and cheaper services that are more resistant to hackers and disruptions.

But regulatory sources say they fear a failure at a cloud company could bring down key services in multiple banks and countries, leaving customers unable to make payments or access services, and undermine confidence in the financial system.

The US Treasury, the European Union, the Bank of England, and the Bank of France are among those who are intensifying their scrutiny of cloud technology to mitigate the risks of banks that depend on a small group of Tech companies and companies that are “locked in” or overly dependent. on a cloud provider.

“We are very alert to the fact that things will fail,” said Simon McNamara, managing director of British bank NatWest. “If 10 organizations are unprepared and connected to a disappearing provider, then we will all have a problem.”


The EU proposed in September that external services “critical” for the financial industry such as the cloud should be regulated to strengthen the existing recommendations on outsourcing of the bloc’s banking authority dating back to 2017.

Meanwhile, the Bank of England’s Financial Policy Committee (FPC) wants a greater understanding of the agreements between banks and cloud operators and the Bank of France told lenders last month that they must have a written contract. that clearly defines the controls over outsourced activities.

“The FPC is of the opinion that additional policy measures are needed to mitigate financial stability risks in this area,” it said in July.

The European Central Bank, which regulates the largest lenders in the euro zone, said on Wednesday that bank spending on cloud computing increased by more than 50% in 2019 compared to 2018.

And that is just the beginning. Spending on cloud services by banks globally is forecast to more than double to $ 85 billion in 2025 from $ 32.1 billion in 2020, according to data from shared technology research firm IDC. with Reuters.

An IDC survey of 50 major banks globally identified only six top cloud service providers: IBM, Microsoft, Google, Amazon, Alibaba, and Oracle.

Amazon Web Services (AWS), the largest cloud provider according to Synergy Group, posted sales of $ 28.3 billion in the six months through June, 35% more than the previous year and higher than its annual revenue of $ 25.7 billion in 2018.

While all industries have increased spending on the cloud, analysts told Reuters that financial services companies had moved faster since the pandemic after an explosion in demand for online banking and emergency loan schemes.

“Banks are still very diligent, but they have gained a greater level of comfort with the model and are moving at a fairly rapid pace,” said Jason Malo, senior analyst at Gartner Consulting.


Regulators are concerned that cloud failures will bring down banking systems and prevent people from accessing their money, but they say they have little visibility over cloud providers.

Last month, the Bank of England said that big tech companies could impose terms and conditions on financial firms and that they did not always provide enough information for their clients to monitor risks, and that the “secrecy” had to end.

There is also concern that banks are not sufficiently distributing their risk among cloud providers.

Google told reporters at our partner news agency Reuters that less than a fifth of financial firms were using multiple clouds in case one failed, according to a recent survey, although 88% of those that did not distribute their risk yet they planned to do it within a period of time. year.

Central bank sources said that part of the solution may be some kind of mechanism that provides reassurance on the resistance of cloud providers to banks to mitigate the sector’s added exposure to a cloud service, with the banking regulator having the general point of view.

“Regardless of the division of control responsibilities between the cloud service provider and the bank, the bank is ultimately responsible for the effectiveness of the control environment,” the US Federal Reserve said in a draft guidance issued. to lenders last month.

FINRA, which regulates Wall Street brokers, released a report ahead of possible rule changes to ensure that cloud use doesn’t hurt the market or investors.

However, being able to easily switch cloud providers when needed is a more easily said task that could introduce business disruption, according to the FINRA report.


Banks and tech companies question the suggestion that increased cloud adoption is making the financial system’s infrastructure inherently riskier.

Adrian Poole, Head of Financial Services UK and Ireland at Google Cloud, said the cloud can be more effective in bolstering a bank’s security capabilities than building it in-house.

British digital lender Zopa said it had moved 80% of its transactions to the cloud and was working to mitigate risks. Zopa CEO Jaidev Janardana said the company also deliberately relied on the expertise of technology companies.

“Cloud providers invest a lot of resources in security on a scale that few individual companies could manage,” he said.

Google’s Poole said the company was willing to work more closely with financial regulators.

“We may one day see regulators mining data on demand from regulated banks with cloud-enabled application programming interfaces (APIs), rather than waiting for banks to periodically send them data,” he said.

NatWest’s McNamara said the bank was working closely with tech firms and regulators to mitigate risks, and had implemented alternative services in case things went wrong.

“The ball stops with us,” McNamara said. “We don’t put all of our eggs in one basket.”

One problem, however, is that not all banks have a complete understanding of the resilience risks that could arise with a full shift to the cloud, said Jost Hoppermann, principal analyst at Forrester, particularly smaller lenders.

“Some banks don’t have the necessary knowledge,” he said.

“They think doing this will make all their problems go away, and that’s certainly not true.”

The Platform Executive team hopes you enjoyed this article. Machine translation from English to a growing list of languages ​​via Google AI Cloud Translation. Initial reports through our official content partners at Thomson Reuters. Reporting by Iain Withers and Huw Jones. Additional reporting from Michelle Price in Washington and Francesco Canepa in Frankfurt. Edited by Rachel Armstrong and David Clarke.

You can stay on top of the latest developments in the platform economy, find solutions to your key challenges, and gain access to our proprietary databases and troubleshooting toolkit by becoming a member of our growing community. For a limited time, our subscription plans start at just $ 16 per month. What are you waiting for?

Leave a Comment