Banks tiptoe toward their cloud-based future

By Lananh Nguyen, The New York Times Company

Michael W. Lucas made big plans to take a trip around the world in March 2020. He arranged to travel from his home in Detroit to Tokyo, then attend conferences in Hong Kong and Bangalore, India, before making a final stop in Paris.

But on his first attempt to buy plane tickets, this ambitious itinerary — costing $2,932.48 — got the attention of Capital One, which blocked the charges.

“I was both annoyed and pleased that the credit card company caught that someone was booking unusual flights,” said Lucas, a 54-year-old technology writer who is also an author of mystery novels. After calling the bank to explain his plans, the transactions went through smoothly. (The trip, however, was ultimately canceled because of the pandemic.)

Lucas’ fraud alerts were made possible by an invisible force tiptoeing into Wall Street: cloud computing. Before moving into the cloud, his bank, Capital One, was limited to tracking fraud using the bandwidth of the servers it owned. Now that it rents capacity from Amazon Web Services, the bank can use machine learning to crunch numbers faster — and on an enormous scale — to detect anything out of the ordinary.

As Lucas put it: “The cloud is a fancy word for ‘other people’s computers.’ ”

Banks see huge potential for cloud technology to make their systems faster, more nimble and responsive to the needs of their customers. Consumer banks can develop cloud-based tools to quickly introduce new features in mobile banking apps or detect fraud. Lenders can use the cloud to process loan applications and analyze underwriting decisions for everything from mortgages to corporate borrowing. They can use machine learning to detect money laundering. When volumes spike in financial markets, traders can use extra computing power to analyze price movements and handle bursts of client activity.

Still, the banking industry has been mostly slow to adopt cloud computing. Currently, major banks run their own data centers, which house computer servers that process vast troves of customer account data, payment records and trading logs. Running the machines is costly because they require a lot of electricity and also need to be kept in air-conditioned rooms.

While Wall Street leaders have long acknowledged the potential of cloud computing to cut costs, they have only allowed their firms to take halting steps. Executives have been hesitant because banks are tightly regulated by governments and any sudden changes involving consumer deposits or privacy aren’t possible. They’re also concerned that computing over the internet will open the door to cyberattacks. And some firms are held back by old computer systems that are difficult to revamp or retire, making the transition even more tricky.

David M. Solomon, CEO of Goldman Sachs, is optimistic about financial-services firms moving into the cloud. However, “it’s got to be done with high levels of security and real protection of data and information,” Solomon said. “That’s why you’ve got to go slowly and you’ve got to go cautiously,” he said.

In North America, banks handle only 12% of their tasks on the cloud, but that could double in the next two years, the consulting firm Accenture said in a survey. Jamie Dimon, CEO of JPMorgan Chase, said the bank needed to adopt new technologies such as artificial intelligence and cloud technology “as fast as possible.”

Wells Fargo plans to move to data centers owned by Microsoft and Google over several years; Morgan Stanley is also working with Microsoft. Bank of America has saved $2 billion a year in part by building its own cloud. Goldman said in November that it would team up with Amazon Web Services to give clients access to mountains of financial data and analytical tools.

Cloud services enable banks to rent data storage and processing power from providers including Amazon, Google or Microsoft, which have their own data centers dotted around the globe. After moving to the cloud, banks can access their data on the internet and use the tech companies’ computing capacity when needed, instead of running their own servers year-round.

Seeing a big opportunity to sell cloud-computing services to Wall Street, some tech giants have hired former bankers who can use their knowledge of the rules and constraints under which banks operate to pitch the industry.

Scott Mullins, AWS’s head of business development for financial services, previously worked at JPMorgan and Nasdaq. Yolande Piazza, vice president for financial services at Google Cloud, is the former CEO of Citi FinTech, an innovation unit at Citigroup. Bill Borden at Microsoft and Howard Boville at IBM are Bank of America alumni.

Cloud providers are “moving at a much faster development pace when you think of security, compliance and control structures,” compared with individual banks, said Borden, a corporate vice president for worldwide financial services at Microsoft. The cloud, Borden and the other executives said, enables companies to increase their computer processing capabilities when they need it, which is much cheaper than running servers on their own premises.

But glitches do occur. One week after Goldman teamed up with Amazon, an AWS outage halted webcasts from a conference hosted by the bank that convened CEOs from the biggest U.S. financial firms. The glitch also caused problems for Amazon’s Alexa voice assistant, Disney’s streaming service and Ticketmaster. AWS and its competitor, Microsoft Azure, both had outages recently.

Banking regulators in the United States, including the Federal Reserve, Federal Deposit Insurance Corp. and Office of the Comptroller of the Currency, have jointly underscored the need for lenders to manage risks and have backup systems in place when they outsource technology to cloud providers. The European Banking Authority warned firms about concentration risk, or becoming overly reliant on a single tech company.

The Financial Industry Regulatory Authority, which oversees broker dealers — firms that engage in trading activity — has already moved all its technology to the cloud. The group previously spent tens of millions of dollars a year to run its own servers but now rents space on AWS servers for a fraction of that amount, said Steven J. Randich, FINRA’s chief information officer.

Randich estimated that without the cloud, FINRA would have had to bear at least $100 million in expenses to track market movements using its own data centers — especially as trading volumes have ballooned in recent years.

“We are all in,” Randich said. The use of web-based systems has enabled FINRA to process hundreds of billions of market records, and its surveillance staff to analyze unusual trading activity by pulling data in seconds or minutes, compared with hours earlier. But Randich added that “there’s a way to do it right and there’s a way to do it wrong,” and the wrong way can expose a company to security breaches.

Capital One is all too aware of the risks. In 2019, it suffered one of the largest-ever thefts of data from a bank after a hacker obtained the personal data of more than 100 million people. The bank was fined $80 million by a regulator and ordered to strengthen its security controls as it moved information-technology operations into the cloud. It also agreed to settle a class-action lawsuit covering 98 million consumers for $190 million.

“Security of our customer data is of paramount importance, and we invested heavily in our cybersecurity capabilities to defend that,” said Mike Eason, Capital One’s chief information officer for data and machine learning in Richmond, Virginia.

Despite the breach, Capital One said it had experienced huge benefits from migrating to the cloud. It shut all eight of its data centers last year and runs its technology via AWS. As customers ramped up spending for the holidays, the bank used rented servers to handle a seasonal surge in transactions, without having to pay for all the servers year-round as it did before. It also plans to move most retail call-center operators to work permanently from home.

The new arrangement works well for Rosie Hardy, a call center worker for Capital One in Tampa. In March 2020, with the pandemic raging, Hardy packed up her tech gear into a big cardboard box and drove home to Gibsonton, Florida. Within an hour, she was back online from her spare bedroom bathed in natural light, fielding calls from the bank’s small-business customers.

Hardy and her colleagues were untethered from phone banks because of a service that routes calls through the cloud, enabling them to work remotely. “You couldn’t tell where I was. All I needed was internet access, and I picked up like we never left,” Hardy said.

This article originally appeared in The New York Times.