31. July 2019

“The law doesn’t distinguish between domestic and foreign clouds”


Many banks have only just begun to take a closer interest in the cloud. They continue to have reservations, first and foremost about the compatibility of the cloud with banking secrecy. Martin Hess, Head of Digitalization and Economic Policy and Board Member of the Swiss Bankers Association, has the answers.

ti&m: How has the issue of cloud computing evolved for banks in recent years? 
Martin Hess: I am pleased that there has been a significant increase in awareness in recent years of what the cloud is capable of and how it can empower banks. This includes enabling banks to offer better, more customer‑friendly and innovative products, which, in turn, enables them to achieve significant increases in efficiency. At the Swiss Bankers Association, we have produced a set of cloud guidelines that aims to make it easier for banks to procure cloud services. Smaller and less technology‑savvy banks will find them especially helpful.

So do banks still need a lot of information?
Many banks want to use the cloud, but for various reasons, they aren’t using it for customer data. We want the guidelines to bridge the gap between wanting to use the cloud and actually doing so. The guidelines cover about fifty pages. Each bank will need to conduct its own evaluation and risk assessment. There’s still a great need for information.

What are the key concerns that are holding banks back from using the cloud?
The biggest concern is customer data – there’s no doubt about that. We are seeing the first banks starting to use the cloud for internal, non‑business‑critical data or anonymized test data. But the sticking point is customer data. This is where we win or lose our customers’ trust. At the same time, however, it is the area where the greatest efficiency gains can be made and where innovation can deliver the greatest benefits. In the longer term, there’s a good prospect that certain software will only be available via the cloud. 

In its 2018/3 bulletin, the Swiss Financial Market Supervisory Authority (FINMA) permitted customer data to be held abroad. What does that mean in concrete terms for the banks?
The Swiss Banking Act doesn’t distinguish between domestic and foreign. However, up to now banks have always stored data domestically and prevented it from being accessed from abroad, following the principle “over the border, out of control.” It was 
assumed that the moment data are processed or accessed from abroad, banking secrecy would automatically be compromised. We take a different view in our guidelines. In principle, the only issue is ensuring that data cannot be accessed by unauthorized parties. This doesn’t depend on where they are stored; it was merely a practice that established itself. There are also legal opinions that state explicitly that data can be stored and pro­cessed abroad provided appropriate safeguards are adopted. 

The law doesn’t distinguish between domestic and foreign. However, Swiss banks continue to favor Swiss providers, or those with data centers in Switzerland. Why is that? 
The question will be irrelevant to banks when they feel confident that storing data abroad does not carry any greater risk. In our guidelines, we argue that banks have to be able to prove that they have not negligently disclosed secret information, regardless of where it is located. We cannot absolve banks from this responsibility. The guidelines set out technical, contractual and organizational elements that can ensure that they meet it. The elements must be combined in such a way that data cannot be accessed with reasonable effort. 

The new CLOUD Act requires US firms to enable US authorities to access their data centers, including those located overseas. What is your assessment of this law?
We are looking closely at the CLOUD Act right now and examin­ing the possibility of a bilateral executive agreement such as the USA already has with Great Britain and similar to the agreement that it is aiming to conclude with the EU. Since the CLOUD Act has extraterritorial effect, it can come into conflict with local 
legislation. An executive agreement would allow us to resolve such conflicts bilaterally. We are currently devoting some thought to whether this would be a solution that would work for Switzerland. I think it’s realistic to assume that some day there will be a network of executive agreements between the key countries. The US Department of Justice has found that the CLOUD Act has triggered a great deal of anxiety and uncertainty. They have 
therefore published a white paper aimed at addressing the 
outstanding issues. We are in the process of studying this 
information and will draw up appropriate recommendations. In my view, the legal and political considerations are paramount.

How long can Swiss banks afford to wait and see with the cloud?
I can only speak from my own personal experience. Banks have different customer bases, business models and appetites for risk. I think we will see the first banks making a move very soon. Other banks, however, will continue to make do with their current IT systems for longer because they are working well. The issue is often where banks are in their internal innovation cycles. This is what will determine how fast the cloud is adopted. It is difficult to give a general answer, but there will be a couple of front runners and others that hang back. It shouldn’t be assumed that everything has to be migrated all at once. Every bank will start with something different. For the most part, something less business‑critical. Many banks will certainly have the strategic goal of migrating to the cloud in a specific number of years.  

Martin  Hess
Martin Hess

Martin Hess has been Chief Economist and Board Member of the Swiss Bankers Association and a member of the European Banking Federation’s Chief Economists’ Group since 2010. He previously held various positions in the Federal Department of Finance and the State Secretariat for International Financial Matters (SIF). 

Weitere Beiträge

arbeitgeber award
An app is about more than just technology

User Experience Gold // migrolino AG, together with its customers, celebrated the company’s 10th anniversary in January 2019 with the launch of the migrolino app. Working together with ti&m, the app was created in just 12 weeks using an agile process. Following positive feedback, the app has been further refined and improved.

find more information
Smartes Loginverfahren ohne lästiges Abtippen

Zusammen mit ti&m hat die Luzerner Kantonalbank AG (LUKB) eine neue Stufe in puncto Sicherheit erreicht. Gemeinsam brachten die beiden Unternehmen die aktuell wohl innovativste Authentisierungslösung der Schweiz an den Start. So bequem und sicher konnten sich E-Banking-Kunden noch nie einloggen! Doch: Wie funktioniert das genau?

find more information
Lead Code Camp
Das dritte Code Camp stand ganz im Zeichen der künstlichen Intelligenz

Beim dritten Code Camp von ti&m drehte sich alles um das Thema künstliche Intelligenz (KI). Mehr als 20 Entwickler kamen zusammen, um ihr Wissen in der Technologie zu vertiefen. In 30 Stunden Programmieren lernten die Teilnehmer, was mit KI alles möglich ist.

find more information
Simon Kauth
Banking as a service – a completely new concept?

Research // What is the logical consequence if banking increasingly focuses on the real needs of bank clients in the future? And how can information technology contribute to this? Banking as a service addresses the availability of banking as a technologically integrable service that can be accessed around the clock. Banking processes in the life cycle of a customer relationship take precedence here – from initiation to advisory and execution, through to management and monitoring.

find more information
ti&m Research: Foundation for consulting @ti&m

Research // Being innovative also means discovering completely new things and making them useful in practice. An important component here is to master the theoretical foundation and the basic developments of your own specialist area and actively drive these forward.

find more information