FSB全球金融稳定委员会-Third_30页_871kb

Summary of Third-Party Dependencies in Cloud Services

Core Content

This report from the Financial Stability Board (FSB) examines the implications of third-party dependencies in cloud services for financial stability. It highlights both the benefits and risks associated with the increasing use of cloud services by financial institutions (FIs), and outlines the need for further international discussion and coordination on regulatory and supervisory approaches.

Main Points

1. Introduction

• FIs have long used third-party services, but the adoption of cloud computing has introduced new challenges.
• The FSB has identified the growing reliance on cloud services as a key area for further analysis, especially regarding operational risks, vendor concentration, and cross-border issues.
• The report builds on previous FSB work, including the 2017 FinTech Issues Group report and 2018-2019 market structure analysis.

2. Types of Third-Party Dependencies

• Third-party dependencies can include various services such as data communications, data centre management, and cloud services.
• The complexity of third-party networks is increasing, with FIs often relying on cloud services for non-core functions but also potentially for critical systems.
• There is a risk of "fourth-party" dependencies, where FIs rely on cloud services indirectly through other third-party providers.
• Concentration risks arise due to the reliance on a small number of dominant cloud providers, which can have systemic implications in the event of operational failure or insolvency.

3. Features of Cloud Services Markets and Models

• The global cloud services market is growing rapidly, with public cloud services seeing the fastest expansion.
• Public cloud services are dominated by a small number of providers, with the top five accounting for over 75% of the total public cloud infrastructure revenue.
• Cloud service models include Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and Business Process as a Service (BPaaS).
• Most FIs are still in the early stages of cloud adoption, with many only at the trial or testing phase.
• A majority of FIs use or plan to use the largest cloud providers, which are also dominant in regional markets.

4. Potential Benefits and Risks

4.1 Potential Benefits of Cloud Services

• Cost reduction: Cloud services reduce initial capital expenditure and allow for on-demand scaling of IT resources.
• Flexibility: FIs can access shared computing resources, launch new business functions with minimal investment, and shift focus quickly.
• Scalability: Cloud enables rapid scaling of back-office functions and supports organizational changes and new data integration.
• Standardisation: Cloud technology offers uniformity across multiple vendors, streamlining processes and enabling easier mergers and acquisitions.
• Security and Resilience: Cloud providers can offer robust IT environments with redundancy, geographic diversity, and advanced security measures, which may be more cost-effective than in-house solutions.

4.2 Potential Risks of Cloud Services

• Operational risks: Failures or misconfigurations at cloud providers can lead to outages or data breaches.
• Access and audit limitations: Contractual restrictions may limit FIs and authorities' ability to access or audit critical data held by third parties.
• Vendor concentration: Reliance on a few dominant providers can increase systemic risk in case of large-scale failures or insolvency.
• Cross-border issues: Data localisation rules and regulatory differences may complicate oversight and cooperation across jurisdictions.

5. Standards and Practices for Third-Party Risk

• Existing international standards and guidelines address outsourcing and third-party risk, and are being adapted to cloud services.
• The FSB and standard-setting bodies (SSBs) are working on further guidance to ensure interoperability, data portability, and robust risk mitigation in cloud environments.
• There is a need for enhanced coordination and information sharing among authorities to manage cross-border and systemic risks effectively.

6. Implications for Financial Stability

• The FSB currently does not identify any immediate financial stability risks from cloud service use by FIs.
• However, the potential for systemic risk remains due to the concentration of cloud service providers and the lack of risk mitigation practices.
• FIs and authorities must ensure they understand the characteristics of cloud services before significant migration, and maintain strong governance practices.

Key Information

• Survey data: 294 FIs from around the world reported using a narrow set of major cloud providers, with the top four providers being most frequently cited globally and regionally.
• Cloud service models: IaaS, PaaS, SaaS, and BPaaS are the main models, with SaaS being the largest in terms of revenue but IaaS expected to grow the fastest.
• Cost savings: Deloitte reports an average net return of $2.5 for every $1 invested in cloud services, through reduced IT costs and improved operational efficiency.
• Security concerns: While cloud providers offer advanced security, FIs must ensure proper oversight and governance to avoid misconfigurations and compliance issues.

Conclusion

The report emphasizes the need for continued monitoring and international cooperation to address the evolving risks and benefits of cloud services for FIs. While cloud computing offers significant advantages in terms of cost, flexibility, and security, the concentration of service providers and the complexity of third-party dependencies pose potential challenges to financial stability. The FSB encourages further discussion among regulators and authorities to refine standards, enhance oversight, and promote resilience in the financial sector.