While elements of the sector have embraced cloud computing, drawn by its potential to drive efficiencies and enable the scalability demanded in a digital-first world, the question becomes: how can financial firms, cloud service providers, and regulators work together to foster a resilient, innovative ecosystem without slowing down technological progress?

Communication is key

As financial service firms migrate their existing on-premise IT to cloud based systems, particularly those supporting Important Business Services (IBS), there has been a notable and understandable increase in interest and scrutiny by regulators tasked with ensuring operational resilience. 

The UK regulators, specifically the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), do not strive to catch firms off-guard. Rather, they should be seen as partners within the industry, intent on building and maintaining a financial sector that remains innovative while also resilient to disruptions.

Building this partnership is, however, easier said than done. Firms often assume that regulatory bodies have a technical understanding of advanced cloud concepts such as "auto-scaling failovers" or "distributed consensus algorithms." In reality, many supervisors may not have significant or deep expertise in these areas. Therefore, the onus is on the firms to ensure that regulatory discussions are framed in clear, understandable terms. Avoiding overly technical jargon and instead focusing on providing clear, explainable narratives, that articulate how risk is managed and innovation is maintained, will facilitate smoother engagements. 

It is vital that regulators come away from these interactions with a solid understanding of the firm’s cloud strategy, without being "bamboozled by the science."

Red-teaming and strategic decisions

Regulators are also concerned with how firms make strategic decisions regarding their cloud infrastructure. For instance, when questioned about their resilience approach, firms should not only justify why they chose a particular deployment, but also explain why they discarded other alternatives. This requires a "red-teaming" approach: preparing for regulatory scrutiny by challenging assumptions internally. 

For example, if a firm opts against deploying a Multi-Region Active-Active configuration, it should be ready to explain why, and how risks are mitigated via other means. This approach highlights that potential vulnerabilities have been considered while demonstrating that the firm has thoroughly assessed its options.

Our engagement highlights that supervisors have encountered situations where firms struggled to articulate their resilience strategies, particularly in relation to complex cloud deployments. Ensuring clear communication and preparation for these interactions is essential for firms aiming to maintain trust and avoid misconceptions about their strategies.

Proportionality and engagement

One key concept in the evolving relationship between firms and regulators is proportionality. The UK Finance Cloud Working Group, a diverse collective of cloud providers, financial institutions, and external industry experts, is a prime example of how collaboration can promote proportional regulation. Regulators recognise that cloud solutions vary in complexity, and what works for one firm may not be applicable to another. This diversity is crucial in ensuring that regulations are not one-size-fits-all, but rather tailored to specific risks and needs within the financial sector.

For financial firms, it’s important to acknowledge that regulators do not view them in isolation. Engagement happens across the ecosystem, from cloud providers to trade associations, with all parties contributing to a shared understanding of resilience and risk management.

The role of Regulators: Learning and adaptation

Regulators face a difficult task when dealing with cloud migration. Unlike other areas of financial regulation, the technology underpinning cloud computing is constantly evolving, requiring regulators to adopt a continuous learning approach. While financial firms are responsible for clearly communicating their resilience strategies, regulators must also stay updated on the latest cloud advancements and their associated risks.

The burden of explanation lies primarily with firms, but there’s a growing expectation that regulatory bodies must elevate their baseline knowledge to properly assess these cutting-edge technologies. If a regulatory supervisor has challenges in grasping the complexities of a firm's approach, there is a risk of unfair assessments or misunderstandings.

In addition, regulators should avoid overly prescriptive measures based on potentially outdated thinking. Cloud technologies offer new ways to build resilient systems, and any regulation that is overly rigid or based on legacy models may stifle innovation. Instead, there must be a collaborative dialogue between regulators and firms, allowing for flexibility while maintaining oversight.

The role of Cloud Providers and Trade Associations

Cloud providers also have a critical part to play. Persistent industry engagement, particularly in forums such as the UK Finance Cloud Working Group or events like the AWS Cloud Symposium held earlier this year, allows cloud service providers to contribute to shape the regulatory landscape. By actively engaging with financial firms and regulators, cloud providers can offer insights on resilience strategies and ensure their solutions meet the stringent requirements of the sector.

Trade associations such as UK Finance, meanwhile, act as a bridge between the various stakeholders in this ecosystem. By facilitating dialogue between regulated firms, cloud providers, and regulatory bodies, we help ensure that the right balance is struck between innovation and resilience. This is crucial for enabling firms to continue innovating without falling foul of regulatory requirements or exposing themselves to unnecessary risks.

Final thoughts

The UK's approach to regulating the cloud migration of financial services is evolving, with the PRA and FCA taking steps to ensure firms and the sector are resilient while being free to innovate. Regulators, financial firms, cloud providers and trade associations must continue to collaborate to ensure that regulation is informed by industry developments while promoting resilience. Innovation and regulation are not mutually exclusive—if done right, the two can complement each other to create a robust, future-ready financial sector.

In this rapidly developing field, the key to success lies in communication, proportionality, and continuous learning. By working together, all parties can navigate the complexities of cloud adoption and regulation, ensuring that the UK's financial sector remains a global leader in both innovation and resilience.