More financial firms are running their software from the Cloud, lowering their overhead costs by cutting their internal server, network and other hardware requirements. The Infrastructure as a Service (IaaS) revolution has been supported by key financial regulators – including the Monetary Authority of Singapore, the UK’s Financial Conduct Authority and DNB, the Netherlands central bank – which have signalled their approval of the Cloud as concerns over data security have receded. 
AWS has produced strong revenue growth for Amazon in 2016 (see chart below) and it now has a 31% share of the global market for Cloud services according to an August 2016 report by the Synergy Research Group, well ahead of its closest rival, Microsoft’s Azure Cloud computing division, which has 11%. But Microsoft is closing that gap, with year on year growth of 100% according to the same report. Another 2016 survey of CIO’s across different industry sectors by Morgan Stanley has forecast that Azure will have a larger market share of the IaaS market in 2019. How will AWS fight back? We asked Ian Massingham, chief evangelist at AWS for Europe, the Middle East and Africa.
AWS has a clear lead with financial firms. What are you doing to keep it?
AWS is a collection of over 70 different services, and we are constantly releasing new ones. We just try and ship new features to existing services, and that is what we will continue to do. In 2016, we shipped 1,017 new features – and 95% of those new features were suggested first of all by customers. So we’re very customer-centric. Becoming a leader was a byproduct of doing that well and I think that is why AWS is in the position it is in. We do not spend time looking at what our competitors are doing. The latest two technologies that we are pushing are serverless architecture and high performance computing. The serverless architecture service is called AWS Lambda. Rather than picking up existing architecture and moving it to the Cloud, we let customers create small pieces of code that are triggered whenever a certain event occurs. For example, whenever your API receives a request from a customer that wants to look up their balance. Once authentication is provided over an encrypted channel, AWS runs an instance of the balance look-up function, which is then dismantled afterwards. The benefit is that developers do not have to think about servers, with all the associated maintenance- instead they can concentrate on writing code. And it is completely elastic. If the usage of API is very low there are no costs for infrastructure. If the demand for your service goes way up, we can limit your costs as long as you let us know beforehand. It’s very tightly aligned to usage. It’s also very secure because there is nothing for an attacker to attack. Only legitimate requests spin up container infrastructure. So far it is not widely used in finance, but we expect that to change. The other service we are providing is high-performance computing. The uses of high-performance computing in the sciences are obvious. In finance there are applications in risk modeling and market simulations, and we are getting interest.
Tell us about your bank customers.
Our customers in the financial sector generally break down into two categories: challenger banks like the UK digital-only Monzo Bank, and established, larger banks. Monzo Bank is actually entirely built on AWS. Everything from their processing, to their interfaces, APIs, and mobile runs from the Cloud. We also provide all the back office functions like secure payments and capability to meet their regulatory obligations. Among the more highly-regulated tier one banks, we have customers like Capital One that have moved large swathes of their applications onto AWS. Not only does Capital One use AWS to develop, test and run their applications, Capital One now allows customers who have an Amazon Echo device [Amazon’s voice-activated speaker system] to use their voice to check their account balance, make payments, and track spending. [For our recent article on Capital One and its use of the Cloud for testing, click here. And to watch our video interview with Adam Auerbach, Capital One’s Senior Director for Continuous Delivery and DevOps Transformation, click here.] HSBC is another example of a large bank that is an AWS customer. It has been around for a long time and has a lot of legacy systems. These established banks face constraints, both technical and regulatory, that challenger banks don’t have. But they do want to act a more like startups, using the Cloud to improve security, reduce risk, and increase agility. Using the Cloud allows banks to avoid large up-front capital investments, which is an important consideration in a time that IT budgets are getting squeezed. They are eliminating investment into infrastructure, machines, storage, databases and networks. Banks, which are increasingly working in more agile ways, benefit from an on-demand pricing models that allow them to scale up and down based on their business needs.
What kind of tools do you provide for developers and testers in banks?
Developers and testers have a variety of tools at their disposal. Our CodePipeline is a tool for continuous delivery that automates the process for the release of new features. It takes new code, and moves it throughout the delivery pipeline until it is ready to go into production. It integrates with popular tools like Jenkins (an opensource tool for continuous integration), as well as testing tools like BlazeMeter or HPE Stormrunner. CodeBuild is the build service that compiles source code, runs unit tests, and packages it so it is ready to deploy. It integrates with CodePipeline. CodeCommit is a Git-compatible (Git is the popular open-source version control system to keep track of changes in code) repository for documents, source code, and binary files. For mobile, we have offer a testing service called AWS Device Farms. It lets mobile developers test from the Cloud on real devices. This is both on Android and iOS. The devices are manually controlled remotely, and tests can be executed automatically.
Has there been a sea change in how banks feel about the Cloud?
Absolutely. I have been at AWS for just over three years, and in 2013 it was quite unusual for a large bank to publically admit that they were using AWS in production. Today HSBC, Tesco Bank, Aviva (a UK-based insurance company) and a variety of other financial service providers are standing up and saying that they are using AWS to great effect. This comes down to two factors. The first is that regulators today are open to the idea of Cloud-services. The Monetary Authority of Singapore (MAS), for example, has given a green-light to financial firms that want to use Cloud-based outsourced services. The second is that the financial industry, which is more security-conscious than almost any industry, has become convinced that the service is secure. Capital One has gone on record saying that AWS is more secure than their own data centres. They understand a lot of information security is heavy lifting, and they can use AWS to accelerate their security and compliance objectives.
How do you help your customers navigate regulation?
We do our best to make sure that our services are compliant with regulators in any geography, but the regulatory environment makes business more difficult, there is no question about that. We are able to provide visibility and auditing capability to customers operating in the financial services sector. We operate to the Payment Card Industry Data Security Standard (PCI DSS), ISO 27001 [an information standard for IT security management created by the International Organization for Standardization], Service Organization Controls 1, 2, and 3 [a series of accounting standards for financial information], as well as a whole stack of others that map onto particular geographies and national bodies. Regulators have gone on record saying that AWS is compatible with their regulatory regime. I already mentioned the MAS, but the Dutch National Bank has cleared AWS for all facets of financial operations. The audit requirements stay the same, but banks can use AWS provided they can meet those requirements. Other regulators have made statements to the same effect.
