Percentile’s CTO, Chris Miller, discusses why he believes Cloud is no longer a “dirty word” in Capital Markets and Banking.

Banking is one of the last big industries to embrace cloud computing. Even just a couple of years ago “cloud” was often considered a dirty word in banking, chiefly due to security and regulatory concerns. Today the landscape has changed dramatically with the majority of banks now well on their way to adopting cloud technologies. But why now, what issues still exist, and what can we expect this year and beyond?

What is driving banks to cloud computing?

Increasing data and compute requirements, driven by regulations like Fundamental Review of the Trading Book (FRTB), have the potential to make purely on-premises solutions prohibitively expensive compared to a fully elastic “pay only for what you use” approach. Cost savings aside, elastic compute allows computations that traditionally have been run as overnight batch jobs to be completed in a fraction of the time. For both regulatory and competitive reasons this is increasingly being seen as a requirement rather than a nice to have. It is now not uncommon to see a bank throwing more cloud compute at a single computation, on demand, than the bank’s total static capacity across their own data centres.

On the security front, banks are coming to terms with the fears that they had about cloud security. It is becoming clear that cloud providers take security extremely seriously and are willing to work closely with banks to address any concerns they may have. That’s not to say care isn’t required; if you can shoot yourself in the foot by getting security wrong in-house, getting it wrong in the cloud can blow off a whole limb. However increasingly sophisticated support from cloud providers for access controls, encryption, private keys, alerts, auditing and other security related features can equal or exceed the banks’ internal capabilities. Particularly when it comes to operational agility, internal provision finds it hard to compete with cloud-based services.

From a regulatory perspective, there is still further clarity needed around the level of disclosure required by banks around their use of cloud services regarding security, business continuity and data protection. Though challenging, with regulators, banks and cloud providers all working towards solutions this isn’t seen as an insurmountable problem.

Challenges and benefits of moving to the cloud

Cost savings by moving to cloud services can be high but the reality is nuanced, with the biggest savings often requiring significant work and investment to achieve. A “lift and shift” of existing applications on to cloud servers is a typical first step but it is not usually a very cost effective one due to the high levels of CPU, disk and network capacity sitting idle yet still having to be paid for. Making optimal use of provisioned resources by elastically scaling servers up and down on demand isn’t always easy to achieve with legacy applications however. Cloud solutions such as serverless functions can provide further cost and scalability benefits yet may require even bigger architectural changes.

The improved operational agility and flexibility that cloud services provides has obvious benefits with respect to rapid prototyping and research, but also requires care to prevent costs spiraling upwards. It is all too easy for test servers to be started and forgotten to be stopped or other services signed up for that are subsequently underutilised or forgotten. Several firms we’ve spoken to have been bitten by this and have had to keep a close eye on cost allocations and usage of their cloud services to ensure costs stay under control.

A side benefit of migrating to the cloud concerns data quality. While the cloud doesn’t provide any sort of silver bullet here, having large quantities of data available in the cloud can make it easier to move around and process, and therefore identify and correct and problems that might not have been visible otherwise.

The technologies available via cloud services are growing at an incredible pace. We find that the best way to keep abreast of this is to experiment with the services and attend the many industry showcases on the topic.

Takeaways from the recent 2018 AWS Summit and the PRMIA Banks Moving to the Cloud event

AWS currently have around a third of the overall cloud market share. It was clear from attending the 2018 AWS Summit in May that the event was very broadly targeted, with little coverage specific to the capital markets space. However, AWS is working closely with banks all the same on very large compute capabilities. A recent proof of concept launched an extraordinary 1.3 million vCPU grid via AWS, demonstrating the extreme scale that banks can achieve with the cloud.

A recent event held by PRMIA (The Professional Risk Managers’ International Association) in conjunction with Google showed that Google are serious about becoming the cloud provider of choice for capital market firms. Senior staff from Nomura, HSBC and SMBCE shared their insights into their cloud journeys so far, prompting a lively Q&A session and discussion afterwards. It was clear from this event that there was close to a consensus that cloud was considered the way forward, albeit with notes of caution regarding the care and speed with which to make the transition.

One point made was that data cannot be moved into the cloud until the legal and compliance implications are fully understood, and understanding data laws across multiple jurisdictions was seen as a huge challenge. There was also some evidence of disconnect present between the cloud providers and the banks that still needs to be worked through. For example, automated replication of data across geographic locations is considered a reliability feature by cloud providers yet can be hugely problematic for a bank from a legal perspective. It was also made clear that despite cloud providers having certifications and assurances about their the suitability of their services, banks still must do their own due diligence to verify their claims and satisfy themselves that all legal obligations are met.

Another theme that emerged from this event was that managing people is one of the most difficult aspects in the migration to the cloud. Some employees are overly enthusiastic and need to have their enthusiasm tempered while others are very resistant to change and raise a lot of objections. The challenge is to find the middle ground and move at a safe and sustainable pace. Fostering the enthusiasm where it is sensible to do so is important, as is allowing for and addressing objections as early as possible. Sometimes the objections are legitimate and identify issues that may have been overlooked otherwise.

A note of caution on cloud computing for banks

One aspect of the move to the cloud that we at Percentile don’t think is being talked about enough is the risks associated with being locked in to a particular cloud provider. Some of the more advanced cloud features require use of provider-specific services and APIs, and it is easy to become dependent on them across a bank’s entire infrastructure. Care is required to avoid a situation where it becomes very difficult, time consuming and expensive to switch provider should the bank-provider relationship sour or there is a need to deploy to another provider for cost, feature or disaster recovery reasons.

From our conversations with banks there generally seems to be a lot of effort put in to choosing the right cloud provider but far less thought put in to mitigating any lock-in. This seems like an even bigger issue in the long run than the costs and consequences of being tied to a specific vendor product; a situation I’m sure many are familiar with. It will be interesting to see how this plays out over the next few years.

The final word

Fundamentally, the momentum is moving towards the cloud – i.e. public cloud, be that AWS, Google Cloud, Azure or one of many other providers. Any problems, real and perceived, are being overcome. Anyone still thinking that on-premises is the way to go has some serious catching up to do and the banks that migrate completely to the cloud sooner, including scalable cloud-friendly architectures, will gain a competitive edge.