By Oliver Smith on Tuesday 11 January 2022
The Prudential Regulation Authority has its eye on Amazon, Microsoft and Google.
According to a report in the Financial Times, the Bank of England’s Prudential Regulation Authority is looking at ways of assessing the “operational resilience” of cloud computing giants that have been edging their way into the financial services sector.
“We are looking at cloud providers from an operational resilience perspective,” a source told the FT. “Do we need to step in more, how do we get confidence in them? We are starting to consider them critical third parties that we need more oversight of.”
Of the UK challenger banks, Monzo and Starling are both held up as case studies by AWS, while Revolut is using Google Cloud for its cloud banking services and Microsoft Azure also has a growing number of financial services customers.
Reliance on these tech giants is even more acute further down the stack, with cloud banking providers like Thought Machine and Mambu relying on AWS for their services, which are in turn used by dozens of smaller fintechs.
The PRA has been engaging with banks and other regulated firms on their use of cloud-based services for a number of years.
In a meeting of the Bank of England’s Financial Policy Committee last September, it was noted: “the increasing criticality of the services that [cloud service providers] provided to UK financial firms, and the fact that the provision of these services was often concentrated in a small number of third parties, which were very difficult to substitute, posed a threat to UK financial stability in the absence of greater direct regulatory oversight.”
Back in the day, the regulator would have tested banks’ data centres against cyber-attacks or technical faults, but it’s not yet clear how this works when the majority of UK banking is passing through the data centres of just three providers.
The PRA declined to comment.