European Banks Store Their Sensitive Data on American Clouds

(Bloomberg Businessweek) -- Europeans grumble that they haven’t had a truly global tech giant since Nokia Oyj’s heyday. But for Europe’s banks, the most pressing digital need isn’t for a homegrown phone that can compete with Apple Inc.’s or Google’s. The banks are looking for cloud computing providers with higher security standards than they can find in the U.S. Their search is far from over.

In a recent Bloomberg survey of Europe’s top banks, 22 of 22 respondents said their primary cloud services are American. The three leading U.S. cloud providers—Amazon, Microsoft, and Google—are at the top, though unlike in the broader market, Microsoft Corp. beats out Amazon.com Inc. for No. 1. Rounding out the list are IBM, Salesforce.com, and NetApp. While some lenders say they also work with European cloud companies, it’s usually in a secondary role. The U.S. companies’ servers support the sophisticated numbers crunching for tasks like risk management and increasingly house such sensitive data as borrowers’ personal information.

The banks aren’t happy about this. The virtue of off-site cloud servers is that their scale generally allows companies to store and compute data for less than they’d spend on their own—and the prices per unit of storage tend to decrease markedly with each passing year. Europe’s institutions are already losing the investment banking wars with Wall Street and can’t afford to cede competitive advantages. But some bankers say they worry about client data in the hands of foreign companies. U.S. tech doesn’t enjoy the reputation for trustworthiness that it did even a few years ago, when European regulators were among the first to challenge the industry’s standards for privacy and competition.

Now, German and French government officials are in talks with leaders in telecommunications, technology, and finance to create a competitive continental cloud service run by local tech companies. At the same time, banks including Germany’s Commerzbank AG are trying to team up to present joint cloud demands to U.S. providers in an effort to increase the little leverage they have. “Europe is looking at ensuring technological sovereignty and reducing its dependence because it does fear that somehow, all of a sudden, technologies that we depend on could be switched off,” says Eline Chivot, a Brussels-based analyst at the Center for Data Innovation, a U.S. think tank.

The banks’ odds aren’t great. Previous attempts to build European alternatives to U.S. tech have foundered, and at this point the upfront costs would be immense. Microsoft says it spends more than $1 billion a year just on its global cloud network’s security, while European banks are struggling with declining revenue and profit. “In 2020, waking up and saying that we want to build a European cloud, I’d say it may be too late,” says Bernard Gavgani, chief information officer at French banking group BNP Paribas SA.

Big Tech is also savvier about lobbying regulators than it used to be, working actively to charm market watchdogs it ignored five years ago, say three regulators who spoke on condition of anonymity because they weren’t authorized to discuss the matter. Patrice Amann, a leader of the Microsoft cloud team catering to financial-services companies in Europe, the Middle East, and Africa, says increased outreach efforts represent an interest in a constructive dialogue. “It’s really to understand what is the concern, how this concern is progressing, and what we need to do as a company to comply completely with the rules,” Amann says.

There’s no legal requirement for banks to keep data in the European Union, but the bloc’s regulators have nudged them in that direction. Several cloud companies offer lenders the use of servers based in Europe or their home country specifically. “They need to evaluate the risk of having data in a location that applies different security and data protection standards,” says Slavka Eley, head of banking markets, innovation, and products at the European Banking Authority. “If the risk is too high, they shouldn’t agree to such locations.”

DNB ASA picked Amazon and Microsoft largely because the Norwegian country’s watchdog approved of the company’s audit policies for cloud network security and because “they have a number of data centers in Europe and the Nordics,” says Alf Otterstad, the bank’s head of technology and services. Still, under President Trump’s Cloud Act, U.S. storage providers can be ordered to provide U.S. authorities information held on their servers no matter where that data are physically located.

The U.S. companies say they’ll defend client privacy. Andreas Wodtke, a vice president for financial services at IBM Corp. who sells cloud services to banks in Austria, Germany, and Switzerland, says the U.S. company will resist demands for data from state agencies unless they’re made through internationally recognized channels such as mutual legal assistance treaties.

By the end of 2020, the European coalition working to develop a viable local cloud network hopes to complete its first proof-of-concept testing. For now, though, the Continent’s banks remain unambiguously dependent on Seattle and Silicon Valley. “You hurt Germans with car tariffs or the French by taxing red wine,” says Heiko Gewald, a professor of information management at the Neu-Ulm University of Applied Sciences in southern Germany. “But if you want to hit Europe as a whole, then cloud is the way to go.”

--With assistance from Boris Groendahl and Sonia Sirletti.

To contact the editor responsible for this story: Jeff Muskus at jmuskus@bloomberg.net, James HertlingEric Gelman

©2020 Bloomberg L.P.