​Tech giants' cloud services for banks under FSB scrutiny, Fed's Brainard says

Cloud services provided to banks by technology giants such as Amazon and Microsoft are being scrutinized by the international Financial Stability Board, US Federal Reserve Governor Lael Brainard said.

Basel-based FSB is concerned about the concentration of these providers and is looking at banks’ ability to “fail over” automatically to a second system if the main one collapses, she told lawmakers this week.

“There is technology out there or developing that would provide mechanisms to do so, so that lock-in is less of a risk,” Brainard told the House Financial Services Committee. “This is certainly something we’re very focused on.”

The FSB recognizes that banks that use cloud services for data storage, computational capacity and redundancy may mitigate some risks while creating others, she said.

Referring to banks, Brainard said: “We need to hold our institutions accountable for making that risk assessment in a very well-informed way and taking that migration seriously.”

Brainard is one of two Fed members of the FSB, the regulatory arm of the Group of 20 economic powers. The other, Fed Vice Chairman Randal Quarles, heads the global authority.

Amazon, Microsoft, Google

Banks’ reliance on third-party cloud providers is part of a growing trend, she said.

Three tech companies account for 57 percent of the cloud market, according to Synergy Research Group: Amazon Web Services, the world’s largest cloud-computing provider; Microsoft Azure, and Alphabet’s Google Cloud.

Lawmakers pressed Brainard about cloud services in the wake of the breach last summer of 106 million Capital One credit card records stored by Amazon Web Services.

US Representative Bill Foster, an Illinois Democrat, blamed the breach on a failure by Capital One “due to a misconfigured firewall.”

FSB report

Last February, an FSB report said that the concentration of cloud computing services could pose systemic risks if the systems link together many systemically important firms or markets.

“The fact that many third-party providers may fall outside the regulatory perimeter places increased emphasis on the importance of managing related operational risks, which could ultimately undermine financial stability,” the report said.

The report encouraged national regulators to review their oversight frameworks for cloud services providers.