Banks' growing reliance on cloud infrastructure provided by third parties could create new financial stability risks, the Financial Stability Board said in a Dec. 9 report.
While banks have used third-party services for decades, the growing use of cloud infrastructure from external providers creates "new interdependencies" between the worlds of technology and financial services, the FSB said.
To make matters more complicated, banks often outsource functions such as relationship management, financial accounting and human resources to third parties who may themselves depend on cloud systems, which makes it more difficult to identify where potential systemic risks could lie, the report said.
The International Data Corporation forecast that spending by banks on public cloud services would hit $16.7 billion in 2018, with a five-year cumulative average growth rate of 23%, according to data cited by the FSB. Companies such as Rackspace Hosting Inc. and Amazon.com Inc. that provide infrastructure as a service, in the form of cloud, servers and storage, are on track to make combined revenues of $39 billion in 2019, the report said, citing recent research from Gartner.
"The failure of a key third-party provider could in theory trigger financial instability, particularly if risks are not appropriately managed at the firm level," the FSB said.
Most cloud providers have "high technological and physical resilience," which means that a collapse is unlikely, although not impossible, the report notes.
"Large cloud providers have reported outages affecting multiple customers and multiple locations. Technological failures rarely last long, but cloud providers could also face challenges in providing their services due to legal or financial stress," the report said.
In the event of a bank resolution, the authorities may have difficulties exercising their right to intervene if critical bank data systems are hosted by a third-party provider, the FSB noted.
There are also a danger of concentration risk if a lot of financial institutions are using the same third-party infrastructure provider.
Looking ahead, there is a need for regulators to look more closely at standards and supervisory practices for the outsourcing of critical bank infrastructure, the FSB said.
The FSB report comes shortly after the U.K. Financial Conduct Authority said it was opening a consultation on operational resilience at financial institutions that includes, among other things, asking banks to interrogate how they would cope in the instance of a failure of their cloud service provider.