31. July 2019

“The law doesn’t distinguish between domestic and foreign clouds”


Many banks have only just begun to take a closer interest in the cloud. They continue to have reservations, first and foremost about the compatibility of the cloud with banking secrecy. Martin Hess, Head of Digitalization and Economic Policy and Board Member of the Swiss Bankers Association, has the answers.

ti&m: How has the issue of cloud computing evolved for banks in recent years? 
Martin Hess: I am pleased that there has been a significant increase in awareness in recent years of what the cloud is capable of and how it can empower banks. This includes enabling banks to offer better, more customer‑friendly and innovative products, which, in turn, enables them to achieve significant increases in efficiency. At the Swiss Bankers Association, we have produced a set of cloud guidelines that aims to make it easier for banks to procure cloud services. Smaller and less technology‑savvy banks will find them especially helpful.

So do banks still need a lot of information?
Many banks want to use the cloud, but for various reasons, they aren’t using it for customer data. We want the guidelines to bridge the gap between wanting to use the cloud and actually doing so. The guidelines cover about fifty pages. Each bank will need to conduct its own evaluation and risk assessment. There’s still a great need for information.

What are the key concerns that are holding banks back from using the cloud?
The biggest concern is customer data – there’s no doubt about that. We are seeing the first banks starting to use the cloud for internal, non‑business‑critical data or anonymized test data. But the sticking point is customer data. This is where we win or lose our customers’ trust. At the same time, however, it is the area where the greatest efficiency gains can be made and where innovation can deliver the greatest benefits. In the longer term, there’s a good prospect that certain software will only be available via the cloud. 

In its 2018/3 bulletin, the Swiss Financial Market Supervisory Authority (FINMA) permitted customer data to be held abroad. What does that mean in concrete terms for the banks?
The Swiss Banking Act doesn’t distinguish between domestic and foreign. However, up to now banks have always stored data domestically and prevented it from being accessed from abroad, following the principle “over the border, out of control.” It was 
assumed that the moment data are processed or accessed from abroad, banking secrecy would automatically be compromised. We take a different view in our guidelines. In principle, the only issue is ensuring that data cannot be accessed by unauthorized parties. This doesn’t depend on where they are stored; it was merely a practice that established itself. There are also legal opinions that state explicitly that data can be stored and pro­cessed abroad provided appropriate safeguards are adopted. 

The law doesn’t distinguish between domestic and foreign. However, Swiss banks continue to favor Swiss providers, or those with data centers in Switzerland. Why is that? 
The question will be irrelevant to banks when they feel confident that storing data abroad does not carry any greater risk. In our guidelines, we argue that banks have to be able to prove that they have not negligently disclosed secret information, regardless of where it is located. We cannot absolve banks from this responsibility. The guidelines set out technical, contractual and organizational elements that can ensure that they meet it. The elements must be combined in such a way that data cannot be accessed with reasonable effort. 

The new CLOUD Act requires US firms to enable US authorities to access their data centers, including those located overseas. What is your assessment of this law?
We are looking closely at the CLOUD Act right now and examin­ing the possibility of a bilateral executive agreement such as the USA already has with Great Britain and similar to the agreement that it is aiming to conclude with the EU. Since the CLOUD Act has extraterritorial effect, it can come into conflict with local 
legislation. An executive agreement would allow us to resolve such conflicts bilaterally. We are currently devoting some thought to whether this would be a solution that would work for Switzerland. I think it’s realistic to assume that some day there will be a network of executive agreements between the key countries. The US Department of Justice has found that the CLOUD Act has triggered a great deal of anxiety and uncertainty. They have 
therefore published a white paper aimed at addressing the 
outstanding issues. We are in the process of studying this 
information and will draw up appropriate recommendations. In my view, the legal and political considerations are paramount.

How long can Swiss banks afford to wait and see with the cloud?
I can only speak from my own personal experience. Banks have different customer bases, business models and appetites for risk. I think we will see the first banks making a move very soon. Other banks, however, will continue to make do with their current IT systems for longer because they are working well. The issue is often where banks are in their internal innovation cycles. This is what will determine how fast the cloud is adopted. It is difficult to give a general answer, but there will be a couple of front runners and others that hang back. It shouldn’t be assumed that everything has to be migrated all at once. Every bank will start with something different. For the most part, something less business‑critical. Many banks will certainly have the strategic goal of migrating to the cloud in a specific number of years.  

Martin  Hess
Martin Hess

Martin Hess has been Chief Economist and Board Member of the Swiss Bankers Association and a member of the European Banking Federation’s Chief Economists’ Group since 2010. He previously held various positions in the Federal Department of Finance and the State Secretariat for International Financial Matters (SIF). 

Weitere Beiträge

Mobile-Applikationen: Sicherer als gedacht <br/>
Mobile-Applikationen: Sicherer als gedacht

Mobile-Applikationen haftet immer noch der Ruf an, weniger sicher zu sein als ihre webbasierten Gegenstücke. In der Realität verhält es sich jedoch genau umgekehrt. Mobile-Applikationen sind aufgrund moderner Sicherheitskonzepte mobiler Betriebssysteme bedeutend sicherer als jeder PC oder jedes Notebook. Dies selbst dann, wenn manche Sicherheitsvorkehrungen vom Benutzer durch so genanntes Jailbreaking bzw. Rooting der Geräte aktiv unterwandert worden sind.

find more information
sbb wind of change
Wind of Change

How a differentiated cloud strategy is supporting the digital transformation of SBB.

find more information
Swiss retail banks and the need for reinvention

Swiss retail banks are enjoying record results – the pressure to digitalise is not yet being felt. Yet below the calm surface, sea changes are already underway.

find more information
Impressionen von der App Builders Switzerland
Impressionen von der ersten App Builders Konferenz der Schweiz

Die Schweiz hat mit der App Builders Konferenz einmal mehr bewiesen, dass sie ein iOS-Land ist. In diesem Artikel geht es um die Impressionen der „App Builders Switzerland 2016“, der ersten Schweizer Konferenz von Entwicklern für Entwickler in Europa.

find more information
Der ideale Workload für die Cloud – Buildprozesse mit Spot-Instanzen

Eine der ersten Fragen, die sich im Cloud Kontext stellt, ist: Welche Workloads eignen sich für den ersten Schritt in die Cloud? Lesen Sie im Folgenden, weshalb Build- und Test-Prozesse für Software-Artefakte besonders geeignet sind und was es basierend auf den Erfahrungen aus unserem Projekt mit der BANK-now zu beachten gilt.

find more information