The buzz on cloud computing is growing louder, leaving bank chief information officers—and the boards they report to—to examine whether cloud computing is a good fit for their banks. Broadly defined, it is the storage and management of data, which can then be accessed from virtually anywhere—on the road, from your home or from the office—via the web. According to Tom Garcia, CEO of InfoSight, Inc., an IT security firm based in Miami Lakes, Florida, the cloud is “really in its infancy” but “growing exponentially.” While regulators seem to be approaching cloud like any other vendor-provided service, a lot of bankers today are taking a wait and see approach, wondering, “Am I going to open up Pandora’s box with an examiner if I do this?” explains Garcia.
Atlanta-based SunTrust Banks, a $178.2-billion institution, is one banking company that is already on the cloud, using a private cloud that is unique to the company for customer relationship management software that allows the company to keep track of sales leads. Anil Cheriyan, SunTrust’s chief information officer, says the board of directors is actively engaged in a discussion about cloud computing, and SunTrust sees benefits in cost savings, efficiencies and flexibility. “The speed and agility [cloud computing] provides is of significant benefit,” he says, and it “clearly enables us to get our products and services to market much quicker.” He declined to describe the exact cost savings as those numbers vary.
Due to its ability to expand and contract quickly based on usage, Garcia adds that banks can see “great economies in cost savings” with cloud—as high as 40 percent for applications like hosted email over a traditional in-house solution.
SunTrust has been steadily increasing oversight of vendor-provided services in general since the financial crisis began in 2008, Cheriyan says, so cloud computing has not directly resulted in any increases in oversight.
“We’ve taken that task of increased oversight anyway,’’ states Cheriyan, and continue to be “more and more aggressive [in terms of] how our data is protected.”
BNC Bancorp’s Bank of North Carolina, a $2.4-billion institution based in High Point, North Carolina, is at a fork in the road when it comes to the cloud, says Michael Bryan, the bank’s chief information officer. The bank outsources 90 percent of its core and ancillary systems already, and he feels good about cloud computing for core systems, seeing several benefits, particularly from a business continuity aspect in regards to disaster recovery. With cloud, if something happens to Bank of North Carolina’s operations center, “all I have to do is restore an Internet connection.” As it is now, Bryan has to “spend more money” to acquire and maintain hardware. However, benefits found in cost, time and continuity are, to Bryan, not worth the loss of control if there is a security breach. Cloud vendors are not going to take on liability, “So if something goes wrong there; it’s up to you. Well, you don’t have any control over it,” Bryan says. “How do I explain that to my regulator?”
Once the security issues are worked out, Bryan sees tremendous opportunity. “Life would be a lot simpler,’’ he says.
SunTrust’s Cheriyan shares some of Bryan’s security concerns, and won’t trust everything to the cloud. “I wouldn’t trust our bank data on the public cloud at all,” he says. While SunTrust’s directors and management might read about exciting developments in the retail space, “You certainly have to weigh that against all the security concerns and manage core banking systems on much more secure environments.”
Due to the higher levels of regulation required in the financial industry, public cloud adoption rates will be slower. Can the benefits outweigh the risks? In areas like human resources and customer relations management Garcia believes so, and cautions that retail banks that hesitate to take advantage of the cloud may do so at their peril.
As the cloud industry grows, bankers’ trust in it—and their need for a competitive edge—could evolve. Can bank boards eventually trust their data to the public cloud? In the world of technology, Cheriyan says, “Never say never.”