UK banking public cloud adoption: banks must think big to transform

Public cloud adoption is not a goal in itself, but a powerful enabler of core business ambitions. Successful adoption depends on a clear set of business goals, initiated from the top down. It should be led by a key business leader –as a transformation initiative.

Prior to the COVID-19 pandemic, CEOs and COOs were not taking a strategic lead, but we now have clear evidence that it must be led from the top, Public cloud strategies are most often led by the CTO (47%). CIOs are taking the lead in 27% of banks, ahead of IT (13%). In rare cases, the Chief Data Officer (7%) and Global Head of infrastructure are leading the cloud strategy. This indicates that the benefits of public cloud are not being understood by all business lines. Banks are perhaps still in the incubation stage of potential transformation or at risk of missed opportunities. 

It’s vital that the group CEO sets the public cloud strategy and transformational objectives, cascading those decisions down to the group CIO and CTO. CTOs have a key role in building a unique, compliant and secure cloud foundation to support all business applications, as well as in helping to automate some of the risk capabilities and provide real-time reporting. Without this strategy, there is a risk that the bank will begin to create shadow IT, resulting in increased set-up and maintenance costs due to siloed public cloud teams.

Top business objectives of cloud adoption for UK banks

• 69% Cost optimisation
• 54% Innovation
• 46% Managing resilience
• 46% Speed to market

With cost optimisation the top business objective of public cloud adoption, it’s clear that banks are using public cloud to underpin their attempts to drive profitability in a volatile and high paced environment. Cost optimisation is a strategic play to improve long-term efficiency in ways that add real value to the business. Achieving cost savings is one aspect. 11% of banks believe that public cloud will deliver more than £20m in savings in the next two years. However, success isn’t guaranteed. Achieving real long-term cost savings requires banks to redefine their business and operating models across the board – not just to modernise their existing IT. If a transformative and holistic lens is applied, we’ve seen clients achieve cost savings of up to 30%.

Until recently, resilience was considered a barrier to public cloud adoption. Even more so now, managing resilience is a top business objective identified by just under half of UK banks. Pre COVID-19, 73% of banks also see resilience as a beneficial by-product of moving to cloud, with no bank considering it to be a barrier. We expect this percentage to be much higher now.  Today, views are pivoting to see cloud as central to resiliency challenges. This recognises the investments being made by the large vendors, who own the network, infrastructure and technology underpinning public cloud, on a global scale. The risk of systems failure is much lower than banks’ own systems, especially given the mismatch in budgets allocated to protecting against IT failures and cyber-attacks. We’ve also seen human risk during the COVID-19 pandemic, where staff had to journey to their offices to run systems that are on-site.

With pressures to remain competitive and to constantly respond to changing customer demands, it’s no surprise to see innovation (54%) and speed to market (46%) as key objectives of public cloud adoption. Despite this being high-up on the business agenda and 73% identifying cloud as a competitive play, 0% of banks are using cloud in a disruptive capacity.

Despite setting clear business objectives, there’s a disconnect between banks’ ambitions and the reality on the ground. Given that the majority have migrated less than 10% of their business, they appear to be making investment decisions based on opportunistic use-cases. Banks are focusing on being better at what they do rather than pursuing a public cloud-based competitive play. To achieve a transformative cloud strategy, leadership from the CEO is essential – with decisions cascading down through the business. 

Recruiting new cloud-native talent and building disruptive applications is essential for UK banks, but also challenging. 73% of banks see lack of knowledge and experience as a top three barrier to public cloud adoption.

With cloud dominating so many sector and business agendas, these specialist skills are in high demand. 40% of our surveyed banks are relying solely on in-house talent, but most do not have enough of the right expertise available internally to meet their cloud development needs. 53% have a cloud team that combines in-house personnel with outsourced support. One bank is even solely reliant on outsourced resources. Using a partner to boost resources instantly is a faster solution to the cloud talent shortage than incremental hiring.

The CEO’s leadership of cloud adoption needs to encompass support for the relevant skill deployment, especially in roles directly involved in cloud development, operations and security. By hiring the right talent banks can redefine their culture, educate the workforce and inspire more innovative thinking. It’s clear that, to date, a lack of expertise is behind the tactical approach to public cloud adoption.

• 47% of banks see culture change as a top three barrier to public cloud adoption

Aligned to the skills challenge, just under half of banks surveyed see culture change as a major barrier. Organisations can address this challenge by enhancing existing knowledge sharing and collaboration pathways, and so fostering curiosity around new approaches to operating on a public cloud platform. Cultural momentum behind public cloud can also be generated by promoting a culture of learning through clear association between skills and career progression, influencing the attainment of cloud certifications.

There is a cost of doing nothing. Banks that fail to build the right workforce and aren’t willing to embrace public cloud risk becoming irrelevant. They are likely to be outpaced by their competition and unable to keep attracting the new talent they require. It’s therefore vital that CEOs and COOs push for new innovation across the bank – focusing on what finance, risk management and other key functions need to look like in order to achieve business objectives. 

If banks see an opportunity to move to public cloud, they are acting, but this is more of a technical exercise than underpinned by any business transformation strategy.

What areas of their business have banks moved to public cloud?

• 100% Front office
• 36% Middle office
• 64% Back office

Banks are inconsistent in their approach to transferring front, middle and back-office operations to public cloud. All banks are looking to transform customer-facing applications, and many are also thinking about how to transform core engine capabilities (such as payments). However, relatively few banks (36%) are yet to move middle office applications. This inconsistency suggests banks are not yet making a clear holistic business case for public cloud – its adoption is opportunistic and short-term rather than strategic and long-term. A successful cloud strategy requires banks to develop consistent target solutions. In order to achieve economies of scale, banks need to select a master cloud platform to run most of their applications and hold their data.

• 33% of banks see their adoption of public cloud as opportunistic
• 0% of banks see their adoption of public cloud as disruptive

The opportunistic nature of public cloud adoption is also indicated by the variety of workloads moved to public cloud. For example, banks are yet to identify the key use-cases for cloud native risk functions (23%). They haven’t yet established how to get the best from cloud and what it can do differently.

The sporadic transfer of workloads and tactical fixes are likely to be associated with inadequate upfront investment. At worst, this leads to more shadow IT, as business units develop their own solutions to meet pressing needs, resulting in increased costs and operational risk. The investment tipping point – where public cloud spend has a real transformational impact on the business – is likely to be upwards of around £20m, based on data gathered from UK banks.

• <10% of today’s overall IT budget is spent on public cloud strategy, for 60% of banks

Of those banks willing to disclose information on their current and expected future investment, most anticipate spending less than £10m on their public cloud strategy in the next financial year. However, the percentage of spend on public cloud strategies in comparison to overall IT budgets looks set to increase over the next one to three years, and there is now further impetus for this to accelerate. Currently only 40% of banks are spending 10% or more of their overall IT budget on their public cloud strategy. One to three years from now, 66% expect to do so.  A third of banks expect to spend more than 20% of IT budgets on public cloud in future, up from 20% now. As expected, 73% of banks are funding public cloud adoption through Change The Bank (CTB) budgets – validating that public cloud is being seen as an innovation exercise, rather than a core activity. In order to embed public cloud adoption and make it business as usual, funding needs to come from both CTB and Run The Bank (RTB) budgets.  

Real business transformation depends on organisations investing enough money upfront. Banks need to pass the investment tipping point in order to deliver on the public cloud promise. Investment planning should be tied back to core business objectives and cloud-based initiatives that can help to realise those objectives. 

• 55% see public cloud as helping them adhere to operational resilience regulation 
• 67% of UK banks surveyed see regulatory compliance as a top three barrier to public cloud adoption
• 60% see third-party risk as a top risk needing to be addressed for ongoing public cloud deployment

Regulators such as the Bank of England (BoE) have endorsed public cloud, realising the benefits for the financial sector including improved governance, reporting and resilience. Nevertheless, two-thirds of banks see regulatory compliance as a top three barrier to adoption, in addition to a risk that needs to be addressed for ongoing deployment.

Despite the regulators outlining the benefits, banks’ concerns suggest a lack of knowledge and experience on how to achieve regulatory compliance and the controls that need to be put in place. Few individuals combine the necessary regulatory and cloud expertise. We see the need to educate people on the benefits of cloud and the potential for transforming audit capabilities, alongside a translation exercise between banks, regulators and governments to clarify the necessary requirements for resilient operations in a public cloud environment. 

Banks also need to review internal governance processes looking for opportunities to improve alignment with developing strategies around cloud-based risk and controls. For example, data security is a common concern among 87% of banks – no surprise, given the sensitivity of data and reputational risk posed to banks. EY has been working with regulators on cloud native solutions, but the extent of banks’ concern suggests a lack of understanding about the enhanced security of public cloud-based platforms. So too does the fact that a majority (60%) of banks see addressing third-party risk as a prerequisite for ongoing public cloud deployment.

Clearly banks must ensure the vendors they rely on have all necessary certifications in order to meet their regulatory requirements. However, public cloud providers recognise their business depends on keeping customers safe. While cloud vendors service every industry, the financial services sector forces them to meet specific needs. Financial services organisations have to meet strict regulatory requirements and cloud vendors are required to have specific certifications.

1. Establish a top-down approach, with robust sponsorship from the CEO or COO to drive cultural change. Public cloud is to be regarded as a business change opportunity. It is crucial for senior leadership to clearly articulate the business strategy and how the cloud strategy supports it. This involves setting clear business KPIs with one-year and three-year milestones, which cascade down to technical KPIs covering areas such as cost reduction.
2. Develop the organisational alignment. Create the business and technology strategy for firm-wide cloud adoption. Test the path for cloud readiness through proof of concepts and assessment of the operating model across technology, risk, people and process.
3. Move from tactical to strategic adoption. Looking across the group, identify which use-cases to start with, the initial platform stand-up cost, and how long the public cloud adoption journey will take. Defining what ‘good’ looks like is important in terms of both operational and risk governance.
4. Develop an end-to-end view to understand the cost optimisation public cloud can deliver. Organisations should use cost management software to monitor operational and capital expenditure for RTB and CTB – intelligently applying best practice optimisation techniques. As part of the overall application transformation exercise, a dedicated team should look at places where cost savings could be created by adopting the cloud platform.
5. Allocate adequate funding for public cloud, which needs to derive from both CTB and RTB budgets. Standing-up the cloud platform and supporting the transformation of applications both require significant upfront investment. This investment can be recouped over a few years but requires everyone to align to the group-wide cloud strategy, with no siloed initiatives. It covers both CTB and RTB activities.
6. Invest in public cloud skills and talent. Hire and infuse cloud-native talent and ring-fence these resources to the cloud programme. Put in place a set of cloud curriculums to up-skill existing and critical IT resources. Highlight heroes, give badges and celebrate early-adopter cloud achievements and innovative new use-cases.
7. Prepare risk functions for the new operating environment. Cloud redefines risk functions entirely. The first line and second line control teams need to work together to ensure that the development, security and operations (DevSecOps) process is holistic and as automated as possible, that the cloud fabric is sanitised and any operational risk is identified immediately and routed accordingly. Controls monitoring is essential and full integration with corporate risk processes and risk committees is mandatory.