A comprehensive guide to cloud adoption in Europe’s banking sector

Data location is a critical part of conversations of banks have with cloud service providers, who are obliged to report information on outsourcing arrangements to national supervisors. The EBA made clear in its guideline requirements that locations (i.e. countries or regions) for data storage and for service performance must be reported. Consequently, such information must be provided to banks by cloud service providers. In the EBF Cloud Banking Forum, banks and cloud service providers engaged with EU authorities and institutions and discuss practical guidance on how reporting can include data location.

Banks are operating within the given set of requirements and considering the steps of cloud migration thoroughly, and dialogue between banks, national supervisors and cloud service providers is ongoing. Because of these legal considerations and the time required to manage cloud adoption, progress is not as fast as the technological possibilities allow.

Cloud-wise

As banks are mindful of their responsibilities, cloud services are selected consciously and core functions kept on-premises. Migration is a step-by-step journey, where banks start from a traditional IT system, adding only selected public cloud services. Later in the process, further capacities are built, using private cloud as well as third-party specialist services, leveraging cloud as an IT commodity (‘managed cloud’) rather than a business solution on its own. This landscape can then later be transformed by increasing the share of service applications in all categories: Public, private and managed.

Embracing this hybrid cloud reality might someday lead to cloud-based IT solutions for a bank that are comparable to on-premise architecture. But it is up to individual banks to run through the cloud migration process according to their business model, identify their own needs and adopt a risk-based approach in line with regulatory obligations.

By operating in a hybrid cloud environment, banks can utilise cloud solutions by multiple cloud service providers, forming a multi-cloud approach. Different cloud solutions address the specific needs of a bank. Use cases are versatile and range from office software, including email service solutions; document storage and HR management systems; IT processes with high-compute capacity, and multi-cloud service platforms for marketing.

Changing the core

It is difficult to think of a bank with a sophisticated core banking system not looking at ways to support it by cloud services.

A big advantage that cloud affords is specialisation. When cloud is deployed for non-core capabilities – like infrastructure management – banks can dedicate top talent to business challenges and development instead. And it is unlikely that such capabilities will outright exclude critical functions.

The 2019 EBA Guidelines on outsourcing provide definitions for critical or important functions. Under the guidelines’ approach, the outsourcing of those critical functions is permitted but triggers advanced regulatory requirements (e.g. more in-depth reporting to national supervisors). European banks must carefully consider the supervisory framework and make a thorough assessment of the critical part of the process before application migration.

Security

Looking at past and recent data breaches, one must carefully assess the actual reason for the vulnerability in question.  A closer inspection reveals that breaches were not necessarily caused by the hasty migration of services to the cloud. In the case of Capital One, the exploited weakness was traced back to a firewall misconfiguration within a web application. While cyber security efforts should certainly dedicate significant attention to such configurations, this implies no systemic vulnerability in the cloud per se. Indeed, the opposite is true. In terms of security measures, cloud service providers offer increasingly sophisticated security offerings that other, particularly smaller enterprises may not be able to deliver at the same level and scale.

Cloud service providers have made cloud security part of their core business, dedicating extensive resources and personnel to security challenges. European banks are aware of the merit such services and expertise can bring in addition to their own security capabilities. Due diligence when selecting cloud services is a permanent step European banks’ cloud strategies, reflecting not only regulatory obligations but their dedication to cyber security.

What recent data breaches do highlight is the importance of incident reporting. In Europe, banks find themselves confronted with several different Incident Reporting Requirements (e.g. NIS Directive, GDPR, eIDAS, PSD2, ECB). The landscape is fragmented, introducing different taxonomies, timelines and lack of clarity on communication channels between public bodies and authorities such as Europol. Additional regulatory burden for banks is the wrong way to remedy this situation. The EBF rather calls for the establishment of a central reporting hub in each Member State, which we explored further in a recently published position paper.

Don’t miss Julian’s presentations at this year’s Tech Week Frankfurt, 13-14 November, Messe Frankfurt. Register for your free ticket today.