As the business models of banks and insurers become more cloud-focused, regulators need to adapt too. We surveyed banks and insurers to understand how they use the cloud. The results are helping us to shape our regulatory approach.
Cloud outsourcing, where companies store information and use software via shared virtual data and processing services, rather than relying on local servers, is becoming increasingly popular.
In a report published last year, we committed to considering the benefits and risks of cloud use across financial services firms.
We surveyed the 30 largest banks and 27 largest insurers that we supervise to understand how they use the cloud.
Our survey shows that banks and insurers mainly use cloud outsourcing to run software and access additional processing capacity (Software-as-a-Service or SaaS) or to support IT infrastructure (Infrastructure-as-a-Service or IaaS). The survey indicates that banks use cloud outsourcing more widely than insurers. For both banks and insurers the use of SaaS outweighs the use of IaaS (Chart A).
Chart A
Number of cloud-based applications used by firms (a)
(a) This is based on data taken from the third cloud survey for banks and the first such survey for insurers. The overall trend is broadly consistent with the views of a number of cloud system integrators and service providers — ie the maturity of transitioning to the cloud is higher for banks than insurers. However, the scale of the difference, as indicated above, is likely to be distorted reflecting the quality and maturity of reporting across the two sectors. For example, the banking survey has benefited from two previous iterations, which has allowed the Prudential Regulation Authority to provide feedback and improve the quality of the reporting.
Using the cloud allows businesses to work in a more agile way, with cloud services offering speed, security and flexibility. From file sharing to managing fraud, firms use the cloud for a wide range of processes, both simple and complex (Chart B).
Chart B
How banks and insurers use cloud outsourcing
In December 2019, the Prudential Regulation Authority issued a consultation paper that sets out our expectations on outsourcing, including the use of cloud. This paper explains how we consider cloud in our supervisory oversight, including the potential for concentration risk. Our survey indicates that for banks and insurers, the provision of IT infrastructure in the cloud is already highly concentrated (Chart C).
Chart C
Market share of providers of Infrastructure-as-a-Service
We will use the results of the survey to inform and adjust our supervisory approach to cloud oversight.
This post has been prepared with the help of Stefan Claus, Sanjeev Chandran, Aditya Parmar and Michael Georgiou.
This analysis was presented to the Supervision, Risk and Policy Committee in September 2019.
Share your thoughts with us at BankOverground@bankofengland.co.uk