Financial stability risks from cloud outsourcing explored in new ESMA working paper

Published: Friday, 13 May 2022 09:31

ESMA, the European Securities and Markets Authority, has issued a working paper on ‘Financial stability risks from cloud outsourcing’. The paper discusses the dependencies that now exist, where a single outage at a cloud service provider (CSP) could have widespread impacts across the financial sector.

Abstract (verbatim)

Financial institutions increasingly rely on Cloud Service Providers (CSPs).

Cloud services can increase resilience of individual firms. However, given the high concentration of CSPs, a single CSP outage could generate simultaneous firm-level outages, posing systemic risk.

Our model examines this possibility. We calibrate the model with operational risk data to simulate outages among CCP clearing members and show that CSPs need to be significantly more resilient than firms to improve the safety of the financial system. In financial settings where only longer (multi-period) outages impose systemic costs, CSPs can best address systemic risk by strongly reducing incident resolution time, rather than incident frequency.

Finally, we show that the use of an idealized back-up CSP successfully mitigates systemic risk from CSPs. Back-up requirements may need to be imposed by policymakers however, as the systemic risk is an externality to individual firms.

Read the paper (PDF).