Luxembourg’s banking association ABBL is encouraging its members to overcome their reluctance and embrace the cloud computing revolution in order to remain “agile and innovative”, especially now that the CSSF has improved its regulatory framework for cloud banking.
The association’s latest Luxembourg Cloud Adoption Survey, conducted with KPMG, shows that Luxembourg’s banks so far have been relatively slow to take up cloud services. Three quarters of them now run less than 10 percent of their services on the cloud, it said.
This survey was conducted just a few months before the CSSF published its widely discussed circular 22/806 which seeks to encourage the adoption of the cloud in Luxembourg’s financial sector.
Prior authorisation by the CSSF was cited as a “top concern” by the survey respondents to explain relative reluctance to embrace cloud computing solutions. This challenge was ranked as a high concern by 61 percent of respondents and a medium concern by a further quarter. This put regulatory red-tape on a par with challenges such as breaching banking secrecy laws, GDPR and overall systems security.
Democratising access
ABBL’s foreword to the survey, posted earlier this month on its website, gives tacit approval to the reforms. “Cloud computing democratises access to technology, giving…equal access to computing power and cutting edge innovation. With the cloud, workloads can be provisioned quickly – whenever they are needed,” it said.
“The acceleration of working from home caused by the Covid-19 pandemic pushed the sector to rethink data access and storage, and cloud solutions have multiplied,” said ABBL, adding that increased use of remote working is now a fact of business life while “remaining agile and innovative are vital”.
CSSF adjusted prior authorisation
The survey’s results were released following the publication of CSSF circular 22/806, which was published in April and mainly designed to implement the requirements of the EBA Guidelines on outsourcing arrangements for banks.
The requirement for prior authorisation from the CSSF has been changed. Now institutions must only give prior notification when planning “critical” or “material” IT outsourcing, which will generally be via cloud solutions. Prior to this change, at least three months› notice had to be given to the regulator, giving them time to authorise the move.
Considerable reluctance
Change is required, as the survey - conducted of 50 financial sector institutions between December 2021 and February 2022 - suggested that about two-thirds of respondents ran less than 10 percent of their applications on the cloud. Three quarters ran less than 10 percent of their production workload in this way. Only 6 percent have implemented an all-cloud strategy for production workload.
However, even before the innovations introduced by the CSSF, there was a sign that financial sector players were planning change. Only 20 percent of all respondents said they intend to keep cloud computing implementation below 10 percent over the short to medium term. A third are targeting 10-19 percent, with a fifth looking at 20-29 percent. The all-cloud share would nudge upwards to 12 percent.
The business case
Cited as the key adoption drivers for nearly all respondents was “increased agility and scalability”, “faster time to market”, “faster innovation”, and “improved resilience”. The focus was on business benefits though, as only a third counted as a high importance the desire to cut costs and with 19 percent ranking highly the chance to increase revenue.
“We all know that a couple of years ago, the main concern over the public cloud was around security,” said the survey report, adding that this outlook has changed from when the first ABBL cloud survey was conducted in 2019. However, the report did not offer data to support this claim. In 2021/2, a third of respondents said “improved security and compliance” was a high driver of cloud adoption, with a similar share saying it was a low driver. This is a key concern, as 85 percent of those surveyed said use cases would involve confidential data.
Use cases
The survey looked into the three aspects of cloud computing: providing as a service infrastructure, platforms and software (respectively IaaS, PaaS and SaaS). A total of 70 percent said they were or were planning to implement IaaS and PaaS solutions, that would give their institutions direct or indirect control over assets deployed in the cloud.
A quarter have implemented CRM systems on the cloud, with a further 15 percent planning to, making it the most popular option. Just over a tenth use the cloud for client facing systems such as e-banking, but a further quarter are intending to take this step. Business intelligence, corporate accounting and customer support were the other main use cases. Just five percent had deployed cloud transfer agent or fund accounting systems, and just 2 percent core banking systems.
As for SaaS, a third use MS Teams for collaboration, with just over one-fifth using MS Exchange, SharePoint and OneDrive for email, collaboration and file storage respectively. Between two-thirds and 85 percent will have deployed these systems once implementation plans are complete. As for business needs, DocuSign for e-signature and Salesforce for CRM was used by about one-fifth.
Which cloud option?
There was an even split between the sources of the cloud technology, with 44 percent said theirs would come from the parent group, 42 percent directly from a cloud provider, with just 7 percent each from a local support PFS - financial sector professional - or indirectly from a non-resident third-party. A third said they would use a fully public solution, 16 percent fully private, with 41 percent a mix of the two. Microsoft Azure was cited by 55 percent as their preferred cloud service provider.
“This survey shows that there is a positive shift towards this technology in the Luxembourg financial sector,” said ABBL. ”This is accompanied by a more innovative approach from the regulator, and a clearer framework for cloud solutions.”