Financial Stability Board says it’s time to talk about IT outsourcing risks

The Financial Stability Board (FSB) has opened up a discussion on regulatory and supervisory issues that could arise from financial services firms outsourcing functions, notably technology.

The FSB, an international body that monitors and makes recommendations about the global financial system, has published a discussion paper and called for feedback. This comes at a time of rapid technological advancement in the finance sector, which is often not controlled by the finance firms themselves.

Banks and other finance firms have fuelled the IT outsourcing industry for decades through contracts that have seen third parties run their huge technology estates. But with the rapid move to the cloud and the dominance of a fewer large suppliers, there is an increased risk of single outages causing industry-wide problems.

“Financial institutions have relied on outsourcing and other third-party relationships for decades,” said the FSB. “However, in recent years, the extent and nature of interactions with a broad and diverse ecosystem of third parties has evolved, particularly in the area of technology.”

Cloud computing is the key example. Banks have huge workloads running in the cloud, but it is not economical, or even possible in many cases, for them to build their own cloud infrastructures.

As a result, cloud services providers are expanding services in the finance sector as businesses transform digitally. The arrival of the financial technology (fintech) revolution has forced large banks to adopt the latest technology and development techniques to keep up. Suppliers such as Amazon Web Services (AWS) and Google boast some of the largest banks in the world using their cloud infrastructure services.

In fact, banks have moved quickly from not talking about what they are doing in the cloud to publicly boasting about their clouds through public announcements.

For example, Standard Chartered Bank recently extended its ties with AWS by signing a global, five-year deal that will see it migrate its core banking systems and customer-facing applications to the public cloud giant’s infrastructure.

UK giant HSBC is also in on the act. Earlier this year, it said it was introducing public cloud to all its businesses globally through a long-term deal, also with AWS, and back in March, Lloyds Banking Group signed a deal with Google Cloud in a bid to drive forward software engineering and boost its digital transformation strategy.

An outage at a major supplier such as these could affect numerous big banks, which would have major ramifications in the finance sector and possibly the wider economy.

The FSB said: “Where there is no appropriate mitigant in place, a major disruption, outage or failure at one of these third parties could create a single point of failure with potential adverse consequences for financial stability and/or the safety and soundness of multiple financial institutions.” 

The migration to IT service providers has also accelerated as a result of Covid-19, said the organisation, adding: “The pandemic may have also accelerated the trend towards greater reliance on certain third-party technologies.”

For example, the reaction to the pandemic has meant banks have had to enable thousands of employees to work from home, introduce new communications tools and provide more services digitally to customers. This has seen IT demand explode, with many of the required technologies, such as cloud infrastructure or banking apps, supplied by third parties.