Public Cloud Potential Is Limitless

Banks are keenly aware of the digital potential of the public cloud—in which they contract an on-demand third-party provider over the public internet to get computing services and infrastructure that are managed by the provider and shared with multiple organizations. The benefits of large-scale cloud adoption for any company are numerous. For banks, the advantages can be a differentiating factor in their Darwinian race. We see several key benefits (see table 1).

Table 1

Public Cloud Still Has Teething Troubles

Banks' use of public cloud is already commonplace for noncritical tools, such as those linked to marketing, human resources, data analysis, collaboration and content management, office tools, or customer relationship management, as data for U.K. banks shows (see chart 1). Across Europe, 88% of banks have used the cloud for these noncritical functions for about five years, according to the European cybersecurity agency ENISA. In Japan, the rate of cloud adoption for noncritical services is 100% for large banks and above 80% for tier 1 regional banks, according to Japan's financial services authority. In China, mega banks and joint stock commercial banks show adoption rates of over 90%.

However, for more critical applications in public cloud--particularly those involving personally sensitive data--and developing a transformational cloud infrastructure and strategy, which ultimately means using cloud as a business asset, banks are still at a trial phase. A 2018 survey by Accenture, a consultancy, found only 37% of banks had a cloud strategy execution roadmap and used key performance indicators to measure progress (see chart 2).

Chart 1

Chart 2

One clear illustration that banks are only in the early stages of cloud maturity is that they largely use hybrid cloud solutions (see chart 3). These combine on-premises tailor-designed cloud IT resources and infrastructure (so-called private cloud) with a solution contracted externally and shared by many customers (public cloud). According to IT management software company Flexera's "2020 State of the Cloud Report," 74% of firms surveyed (representing 750 global organizations) utilize hybrid cloud.

Chart 3

It is unsurprising that banks feel more comfortable running their critical highly sensitive IT infrastructure in-house rather than externalizing it. While public cloud offers banks numerous benefits in terms of costs and deployment, the private cloud allows them to maintain control of their own systems. Moving applications and data to the cloud comes with relevant challenges and responsibilities (see table 2).

Table 2

Cloud-Supplier Concentration Risk Should Be Manageable For Banks

Although many regulators see single-name cloud supplier concentration as a growing concern, we think that larger banks are generally limiting these risks by adopting multi-cloud models, working with more than one provider. Data residency requirements can also play a role in reducing concentration risk on foreign providers and even encourage business opportunities for some.

In this context, the public cloud market has expanded rapidly over the past decade, last year exceeding the $240 billion mark, from less than $50 billion a decade ago (see chart 4). With just a few providers leading the race, this has led to a market that is quite concentrated (see chart 5), with most cloud-suppliers being from the U.S. Nevertheless, banks in most jurisdictions usually rely on these mature and well-known tech giants, which offer high security and compliance standards, as well as solid financial viability. Furthermore, we believe large banks are sufficiently mitigating potential concentration risks by working with at least two cloud suppliers, which also supports price and service competitiveness. Increased partnerships with multiple cloud suppliers will, over time, diversify banks' single-name concentration on its historical IT infrastructure partners. On the flip side, the multi-cloud approach is not always able to accommodate the whole range of proprietary features that each cloud provider offers.

In China, however, we are seeing a different trend. Banks tend to operate primarily with local public-cloud suppliers, and a few large banks have gone a step further and themselves become public cloud providers, as in the case of China Construction Bank Corp and China Merchants Bank Co. Ltd. Within the next few years, we think this could become the norm in many other countries, as banks face revenue pressure from structurally low interest rates and look for new revenue streams. In particular, large international banks with the technological resources and footprint to provide such services to smaller banks and nonfinancial corporations may expand into this business.

Chart 4

Chart 5

Outsourcing Digital Services Could Commoditize Banking Business

The fast-moving nature of the cloud has led to a long list of "as a service" solutions that banks can externalize. So far, it seems that Software as a Service (SaaS) appears most popular among banks (see chart 6). But other solutions, such as Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) and Business Process as a service (BPaaS) may also make headway (see table 3). One effect of COVID-19 forcing banks to enable resilient remote working is that investment in IaaS and PaaS are likely to expand, particularly in the short term, according to research firm Gartner (see chart 7).

Chart 6

Chart 7

Table 3

The trend toward outsourcing "as a service" combined with open banking and the use of application programming interface (API)-driven platforms, suggests that banking as a service (BaaS) may potentially evolve to become a new way for customers to conduct financial transactions. This would change the way in which customers interact with banks. BaaS provides banking products and services (such as loans, payments, deposits, or accounts) as a service using an existing licensed bank's regulated infrastructure with modern API-driven platforms (see chart 8).

Chart 8

BaaS gives customers access to fast, interactive, and engaging banking experiences. It also provides banks with new customers and some additional revenue streams, even if such revenues are so far less significant. BaaS is gaining momentum in the U.S., where we see it as particularly interesting for midsize and smaller banks , which have a greater need to gain scale or simply remain relevant for customers. For instance, earlier in 2020, Google announced partnerships with several banks to launch Google Plex through its Google Pay application, a new digital checking and savings account offering smart payment options, rewards, and financial management services. Google will provide the front-end, intuitive user experience and financial insight, while relying on the banks' existing infrastructure and regulatory compliance. Similarly, in Australia, major player Westpac has recently partnered with buy-now-pay-later firm Afterpay to offer banking products such as transaction accounts through a new BaaS platform.

BaaS nevertheless harbors some business risks. In the short term, we believe Big Techs will focus on becoming key IT vendors providing vertical solutions to banks, rather than becoming full-fledged banks. However, in time tech giants could leverage their power to dictate terms and pricing, as Apple has done with its digital wallet service, Apple Pay. In the longer run, BaaS could pose risks to banks' recognized brands and reputation, which could gradually be forgotten by customers as banks play a role in the back end, ultimately becoming invisible players. BaaS could also turn Big Techs into serious competitors to incumbent banks, as they would agglutinate banks' valuable customer data and could eventually use it to their advantage.

Banks' Cloud Strategies Could Impact Ratings

The comparative development of cloud strategies within different jurisdictions could impact our view of a banking system's competitive dynamics under our banking industry country risk assessment (BICRA) analysis. This is because increased shifts to the cloud can make banks more competitive through new products or new markets, and lead to improvements in efficiency and overall profitability. Regulators can also play a pivotal role in facilitating or inhibiting cloud developments by banks, also affecting our view of a system's industry risk. For the time being, we find it difficult to identify clearly leading and lagging banking systems when it comes to cloud adoption. While some jurisdictions face higher disruption risks related to technology, regulation, and customer preferences overall, cloud growth trends can vary greatly from bank to bank (see "The Future of Banking: Research By S&P Global Ratings," Sept. 14, 2020).

We see both opportunities and potential threats for banks that could impact our assessment of business and risk position of a bank's stand-alone credit profile (SACP). On the one hand, banks with more applications and data in the public cloud can offer more agile and flexible business models, and can easily scale costs up or down, as needed. Banks that use BaaS partnerships or that offer cloud services to corporate clients could also potentially benefit from more diversified sources of revenues, reduce their dependence on traditional revenue streams, and support revenue stability. All of these factors could have a positive impact our business position assessment.

On the other hand, as downside risks from the pandemic persist (see "Global Banks 2021 Outlook: Banks Will Face The Next Test Once Support Wanes," Nov. 17, 2020) and customer preferences shift toward a self-service digital model, banks are having to rethink their operating structures to maintain efficiency. This includes reducing their branch network and employee base and investing more heavily in IT. Certainly, there is room to trim bank branches further in many countries (see chart 9). As banks do so, we expect their commercial propositions to become more digital, requiring an increase in IT investment over the coming years. Technology and communication expenses of global rated banks that report such information have remained relatively stable over the past four years, according to S&P Global Market Intelligence, a division of S&P Global, as is S&P Global Ratings (see chart 10). At end-2019, these represented about 9% of total expenses. Not only do we expect to see a surge in technological expenses, we also anticipate that cloud developments will take a relevant portion of it. Banks that are better equipped to switch to digital will find it easier to preserve their efficiency in the short term, and benefit from cost-synergies in the medium term. Although efficiency gains will be limited over 2020-2022 across our global top 50 rated banks, some countries offer great room for improvement (see chart 11).

Chart 9

Chart 10

Chart 11

Another factor that can affect our assessment of banks' business positions is the way in which management teams implement the digitalization and cloud migration. Large banks with complex operations could face operational risks in case of mismanagement that could diminish our view of a bank's management team. While larger players have more resources to invest in cloud transformation, they may also face greater challenges to integrate their complex legacy environments in multiple business segments and geographies. Smaller players, such as regional banks or challengers, might find it easier if they invest wisely in the key enablers for a successful transition to the cloud.

Finally, increased cloud adoption comes along with security risks, such as cyber attacks, with the potential to rapidly increase banks' reputational risk, as well as risk of regulatory intervention or legal sanctions. Such was the case for Capital One Financial Corp., which suffered a data breach on its public cloud and compromised customers' social security and bank account numbers (see "Capital One Financial Corp.'s Data Breach Increases Reputational Risks, Although The Direct Costs Appear Manageable," July, 30, 2019). We believe cloud-based attacks may be more detrimental to credit ratings than those related to theft of customer data, because they have the potential to disrupt or inhibit operations for the whole enterprise (see "Cyber Risk In A New Era: Remedy First, Prevent Second," Sept. 17, 2020).

Digital designer: Tim Hellyer; Editor: Jennie Brookman

Related Research

• Global Banks 2021 Outlook: Banks Will Face The Next Test Once Support Wanes, Nov. 17, 2020
• Cyber Risk In A New Era: Remedy First, Prevent Second, Sept. 17, 2020
• The Future of Banking: Research By S&P Global Ratings, Sept. 14, 2020
• Capital One Financial Corp.'s Data Breach Increases Reputational Risks, Although The Direct Costs Appear Manageable, July 30, 2019
• The Future Of Banking: Will Retail Banks Trip Over Tech Disruption? May 14, 2019