New rules are needed to deal with the operational risks of banks that rely on outsourced “cloud” computing from Amazon, Google, Microsoft and others to provide services to customers, the Bank of England said on Friday.
“Regulated companies will continue to have primary responsibility for managing risks arising from their outsourcing and dependencies on third parties,” the BoE’s Financial Policy Committee said in a statement.
“However, additional policy measures are likely to be required, some of which will require legislative changes to mitigate the risks to financial stability that arise from the concentration in the provision of some third-party services.”
Measures should include the ability to label some third parties as “critical”, which means that they would have to meet “resilience” standards that would be tested on a regular basis.
The BoE and the Financial Conduct Authority are to publish a discussion paper on the subject next year, it said. The measures are similar to those of an EU law that is now in the approval process.
“These tests and sector exercises by critical third parties could potentially be carried out in collaboration with foreign financial regulators and other relevant UK authorities,” the BoE said.
The BoE had already expressed caution with regard to the cloud and is now examining the banks for their “exit strategy” or how quickly they could switch to an alternative cloud provider or an internal backup in the event of a cloud failure in order to avoid disruptions. said the advisors KPMG.
This has already led banks to think more carefully about the business case for the cloud for some services and whether they would get the green light from regulators.
“Trying to replicate this service locally or in another cloud actually doubles your costs,” said Mark Corns, director of technology consulting at KPMG.
Banks that moved to the cloud early will need to “upgrade” resilience requirements, Corns said.
“What we’re seeing is a much more cautious approach to what’s going to the cloud. Now we have this clearer guidance from regulators on what challenges banks to figure out what and how to get the benefit, ”Corns said.
(Reporting by Huw Jones, adaptation by Louise Heavens)
The most important insurance news in your inbox every working day.
Get the insurance industry’s trusted newsletter