Cloud – what is it not good for?
Cloud: what’s stopping you?
Across the financial services sector, the question is now less about where cloud technology is being used, and more about where it isn’t used. Where do financial institutions draw the line when it comes to deciding whether to keep a process or IT-related service in-house or outsource it to specialists such as Amazon Web Services, SAP and many others?
A good starting point is to recognise that there is no single definition of cloud, nor is there a unifying set of criteria that banks and other financial institutions use when making their decision. For some firms cost may be the driving factor, but for others there are perceived benefits that must be weighed against the concerns that hold them back, including data protection and customer security.
“The motives that drive different institutions to cloud differ,” said Alastair Brown, head of e-channels, Global Transaction Banking at RBS. “Tier One institutions are very much focused on reducing costs, getting to market faster, whereas the Tier Two and Three banks want to roll out services like trade finance that they wouldn’t be able to do alone. But if controls on security are breached, you might find the costs far outweigh the benefits.”
The pressure to cut costs is undoubtedly a significant factor when it comes to the rise of cloud servicing in financial services. One of the key challenges for global Tier One financial institutions ever since the financial crisis has been how to juggle increasing demands from consumers and regulators against decreased resources and shrinking margins.
Ostensibly, cloud providers can make business processes more efficient, enabling the bank to do more with less and reducing the immense cost of in-house IT. For example, Commonwealth Bank of Australia has said that through a partnership with Amazon Web Services, it reduced expenditure on maintenance and infrastructure from 75% of total outgoings to just 25%.
According to Glen Robinson, solutions architect at Amazon Web Services, CBA saved “tens of millions of dollars” using the cloud system and reduced the time needed to deploy a new server from eight weeks to a few minutes.
Other AWS customers include Bankinter in Spain, which was able to reduce the time needed for risk analysis from 23 hours to less than one hour. “The main advantage comes from the greater agility,” said Robinson. “It opens up opportunities for new businesses. Areas such as mobile and big data are pushing these tier ones hard towards using our services.”
In July 2013, De Nederlandsche Bank, the Dutch central bank, approved AWS to provide cloud services related to credit and risk calculations. Meanwhile, Dutch asset management firm Robeco Direct, which also offers savings accounts and mortgages for retail customers, recently moved its entire retail banking platform to the cloud. (Robeco was acquired by Japanese investment bank Orix in 2013.)
In South Africa, Nedbank and Capitec Bank send encrypted data to the AWS cloud platform, where the data interacts with mobile applications built by vendor Entersekt so that customers can authenticate individual transactions on their mobile phones. These include online card purchases, wire transfers and ATM cash withdrawals. The purpose of the system is to help the banks to cope with high demand at peak times, such as payday at the end of the month, or holidays such as Christmas. AWS also operates a global marketplace where customers can buy and run software. There are 1,300 listings, including offerings such as Cloud Prime which integrates with payments on Swift.
Storm clouds
Inevitably there are both real and perceived disadvantages to the cloud. These include concerns over the possible reputation damage a large bank might suffer if its security is breached, a feared loss of competitive edge from proprietary technology, and loss of direct control over IT.
“I don’t think cloud is particularly useful or beneficial for storing data,” said Brown at RBS. “The cost of storage has gone down and our requirements are predictable and constant. You have to ask yourself, what can cloud offer to offset the risk of consumer protection failures and the damage that could do to your organisation? If something goes wrong, the reputational damage to your brand would far outweigh any possible benefits. It’s just not worth it.”
Sometimes, cloud might not be the answer to every problem. For some people it has become virtually synonymous with outsourcing, which brings its own set of challenges and problems, especially for firms that have decided to embrace it as a philosophy.
“We’ve had meetings on big bank IT projects where not a single person in the room is actually from the bank, because they’ve outsourced everything,” said Ian Webster, managing director for Europe at Axioma, a company that builds products for portfolio managers. “That’s not a good thing – you can go too far with outsourcing, and you end up with a bunch of contractors. My experience tells me that it’s probably best not to outsource all your IT – it is such an important part of every business decision, you could be throwing away a real competitive advantage.”
Financial institutions continue to debate the best balance to strike between keeping IT in-house and dishing it out to specialist providers. In some ways, it is an echo of the wider cost challenge that has forced businesses around the world to rethink their models by outsourcing previously core parts of the business, such as outsourcing execution itself in favour of concentrating on research, a decision that was taken by Norwegian broker Christiania in November 2012. But Webster warns that banks that think they can cut their IT budgets while maintaining the same business model as before are “crazy”.
“A lot of financial institutions are simply outsourcing their problems rather than tackling them head on,” he said. “The financial crisis should have taught us that banking is about strong infrastructure, strong risk management and innovation. What actually happens is that front office systems versus middle and back office systems have been built differently, so companies end up arguing internally about data rather than thinking about whether they are taking appropriate risks in the first place.”
A better approach, he suggests, would be to break up the IT department and integrate its staff into smaller teams throughout the business. “Having a trader in the front office who thinks he can delegate the risk to somebody else in the mid or back office is not the right way to go about things,” said Webster. “The risk is inherent in the investment. It would be better to have a proper dialogue between the risk control officers and the portfolio managers making decisions about risk, but at the moment all too often that doesn’t happen.”
Other vendors argue that excessive outsourcing would lead to problems in innovation. While a number of cloud companies have emerged in the last year, many have gone bust – suggesting that getting the right balance can be a challenge. According to UK business process management and outsourcing specialist Capita, which runs a private cloud on a pay as you go basis, there is still a place for centralised IT but there needs to be more scope for innovation within businesses. What that means in practice largely comes down to implementation, and especially the choice of private or public cloud, or some mixture of the two.
“The competitive advantage between cloud providers comes in terms of cost, driving innovation on hosting, and financial stability,” said Paul Birken, chief technology officer at Capita. “The hybrid cloud is a good solution. More innovative things can go on there, while less sensitive things can go public.”
Capita launched its private cloud, called Capita Productivity Hub, in December last year as part of Microsoft’s global Cloud OS Network, which lets users select public, private and hybrid cloud solutions. On the hub, users can get access to 2,000 pre-tested cloud applications via a self-service portal, which all broadly aim to help the user tailor, monitor and manage their services.
According to Birken, half of Capita’s business is currently on the private and half on the public cloud. Users fill in a form based on their requirements, after which they are directed to whichever of the two cloud systems best fits the information the user submitted. While in general terms most businesses expect a private cloud to be more expensive than a public cloud, he believes the private cloud is actually cheaper for a big organisation above a certain scale, because to use a public cloud the organisation would have to implement such stringent security that any cost saving would be eaten away in any case.
Where is my data?
One of the biggest problems with cloud is also one of the hardest to resolve: extraterritoriality. Whose rules should apply to a cloud service that may be hosted in one country and available in another? What if the cloud is being used by an international organisation – a large, global Tier One bank such as Citi, for example? For many, the idea that the data stored in the cloud is not safe is a major sticking point.
“One of the core issues is whether or not the data is held in the UK or offshore,” said Birken. “Data sovereignty is an issue, especially with offshore solutions. Data held outside the UK can be hard to control. With us, your data never leaves the UK, and customers feel better about that because they know where the data is.”
Brown at RBS agrees. Pointing to differing rules between North America, Europe and Asia, he suggested that the only way round the problem is to understand exactly where the data is at all times. That way, a bank such as RBS, which operates in 38 countries, can work out how to deal with rules that have a cross-border implication. For example, the US FATCA legislation applies to any bank that interacts with a US taxpayer. But providing the IRS with details of US customers may inadvertently contravene local rules in other countries which demand that customer data is protected and not shared with third parties.
Regulators are also cautious. According to Jane Tweddle, financial services principal at SAP UK & Ireland, the UK’s Prudential Regulation Authority is conservative about cloud and has reservations about where the data is kept, whether it is housed in the UK and whether foreign regulators have access. That uncertainty also affects potential customers.
“For some, that’s going to be a deal-breaker,” she said. “Does the customer accept that the bank doesn’t know where their data is? Commodity shared services, human resources, procurement, corporate relations – that’s where the appetite to use cloud lies. On core banking, data protection and control of data are major issues.”
For Tweddle, providing cloud services to major financial institutions is no longer so much about the arguments for or against any particular cloud model. Instead, it’s about changing culture. Typically, she says, smaller companies are happy about paying on demand for cloud services, but the bigger ones are not, especially once chief risk officers become involved. While the cloud might make the regulatory and compliance burden easier for some firms by providing better platforms for reporting, it remains unclear whether the big banks will actually take that choice.
“Banks can use the cloud to store and analyse big data, and we have the technology to be secure. What’s lagging behind is the culture of conservatism at the big banks.”
There are signs that may be beginning to change. In October, SAP signed a deal with Citi to use a major new cloud platform designed to simplify corporate-to-bank connectivity for some of the world’s largest banks. The cloud-based SAP Financial Services Network is designed to cover corporate transactions such as payments, as well as reconciliation and remittances. Typical payments include corporate payments to suppliers, which are sent to the bank automatically via the FSN. Likewise, reconciliations are handled automatically by the platform, replacing the previous process of manually collecting paper statements.
The advantage to the bank from the SAP FSN platform is to remove the cost barrier associated with managing hundreds of corporate relationships, while for the corporates they can remove the hardware and software requirements of the relationship and automate their payment processes. Using the FSN, both bank and corporate need connect only once, to the SAP system. The project has been in development for over a year and was pilot tested by a group of Tier One institutions, including Bank of America Merrill Lynch, Deutsche Bank, Nordea, RBS, and Standard Chartered.
In the end, much of the challenge for cloud banking platforms today seems to boil down to confidence, and in merging its advantages with other related areas such as big data.
“We are very slow as an industry to understand big data,” said Brown. “But when we have worked out the best way to use the unstructured data, it will almost certainly be unaffordable to run the algorithms without using cloud capabilities. Cloud is part of the future, it provides a competitive advantage, and it is moving from a buzzword to real implementation.
