UK regulator reportedly wants more oversight on cloud banking giants

Concerns are growing that an Amazon Web Services (AWS) outage could one day take down more than just Netflix and Facebook.

According to a report in the Financial Times, the Bank of England’s Prudential Regulation Authority is looking at ways of assessing the “operational resilience” of cloud computing giants that have been edging their way into the financial services sector.

“We are looking at cloud providers from an operational resilience perspective,” a source told the FT. “Do we need to step in more, how do we get confidence in them? We are starting to consider them critical third parties that we need more oversight of.”

Of the UK challenger banks, Monzo and Starling are both held up as case studies by AWS, while Revolut is using Google Cloud for its cloud banking services and Microsoft Azure also has a growing number of financial services customers.

Reliance on these tech giants is even more acute further down the stack, with cloud banking providers like Thought Machine and Mambu relying on AWS for their services, which are in turn used by dozens of smaller fintechs.

The PRA has been engaging with banks and other regulated firms on their use of cloud-based services for a number of years.

In a meeting of the Bank of England’s Financial Policy Committee last September, it was noted: “the increasing criticality of the services that [cloud service providers] provided to UK financial firms, and the fact that the provision of these services was often concentrated in a small number of third parties, which were very difficult to substitute, posed a threat to UK financial stability in the absence of greater direct regulatory oversight.”

Back in the day, the regulator would have tested banks’ data centres against cyber-attacks or technical faults, but it’s not yet clear how this works when the majority of UK banking is passing through the data centres of just three providers.

The PRA declined to comment.