Financial Regulations: How do they impact your cloud strategy?

By Michael Chalmers, MD EMEA at Contino

How exactly do financial regulations affect your cloud strategy? It’s a question many of our customers have been scratching their heads about. Some solutions are costly and over-complex – but by asking the right questions, the wrong solutions can be avoided.

Following the Financial Conduct Authority’s (FCA) 2020 review, it’s clear that highly regulated enterprises must work harder than ever to stay within various limits which protect customers during an economically strenuous pandemic. Below, I address three questions we’re hearing from customers about how to optimise the cloud whilst sticking to FCA regulations.

1. What regulations must you consider before outsourcing to a cloud provider?

If you have an application or workload that you’re looking to put into the cloud, you will have various service levels that you’ve defined for that particular stack. When you’re looking at the cloud provider and asking yourself what services to use, you’ll need to consider how that aligns to your service levels. How do I architect it to make sure that it’s aligned and that it can tolerate failure?

At the very start of that journey, before you even start putting your workloads into the cloud, you need to set the standards that you will need to adhere to. The Shared Responsibility Model is a key asset in understanding where your responsibility lies.

There are a number of things that you need to make sure are in your contract with the cloud provider. Unless you specifically sign a contract addendum with them, you can’t guarantee that useful and knowledgeable assistance is included.

While the guidelines are very clear on a number of clauses that you need to put in your contract with the cloud provider, these regulations apply to outsourcing in general. Cloud providers are very mature, so they will come with pre-packed addendums to the standard contract they offer that are customised to comply with FCA regulations. However, if you start outsourcing IT functions in a different way, e.g. if you start using a Software-as-a-Service (SaaS) provider which is delivered using the cloud, the new provider will need to be vetted to make sure that you have the right clauses in your contract with them. While cloud providers are very mature on this, most SaaS tools are not.

2. How can you control or restrict where data in the cloud moves?

When it comes to data security, there are various options available on Amazon Web Services (AWS). For example, you can securely lock particular regions into an account on AWS. It’s also worth looking at your account structure policy. If you have accounts where data can’t reside outside the EU, you can put the workloads into that bundle and you can lock it down at policy level. There is an element of trust with the provider here as well.

While AWS offers prescribed controls to block certain regions, other cloud providers have different strategies. In the case of Google Cloud (GCP), you can specify service controls so that, even for managed services such as Big Query, you can lock your data in not just one region, but within your virtual private cloud. In other words, not only can you block specific regions or allow specific regions, you can specify that only things within a region can assess data within a region as a general policy.

3. What does the regulator need to see to approve your exit strategy?

In terms of documentation, it’s not a case of “show me your policies and test plan” but rather “show me how you exercise it”.

Most of the time it’s a months-long process and it comes down to personal relationships: you build trust over time with the regulator as you build your exit plan. You should be able to discuss what else they would like to see in there.  While there used to be a template for an exit plan in the European Banking Authority (EBA) regulations in a previous version, this has since been removed.

Regulators don’t tend to look at test reports. However, they do post a lot of information on audit reports and auditors. These auditors are there to check you’re doing what you say you’re doing. At the end of the day you are responsible for demonstrating your exit plan – it has to be coherent, consistent and compelling.

Final Thoughts

The truth is, most of the time, regulators are just trying to encourage you to do what works. That being said, sometimes their outlook doesn’t quite match with your view, or sometimes there’s an artificial difference that can be smoothed over or finessed. Occasionally you have to remember that we had 2008. What if in 2020 we have a massive AWS outage?

Multi-cloud is a natural strategy. There’s a number of high-level, cloud-native services that can be leveraged to simplify the implementation of multi-cloud in large financial institutions. Adhering to the multitude of guidelines can be complex and time-consuming, but forging the right path through the regulations will ensure that your multi-cloud is optimised to provide the most streamlined and efficient service possible to your business.