ESMA: Working Paper No 2, 2022 3 Financial stability risks from cloud outsourcing

13 May 2022

Given the high concentration of CSPs, a single CSP outage could generatesimultaneous firm-level outages, posing systemic risk. Our model examinesthis possibility.

Abstract
Financial institutions increasingly rely on Cloud Service Providers (CSPs).
Cloud services can increase resilience of individual firms. However, given the
high concentration of CSPs, a single CSP outage could generate
simultaneous firm-level outages, posing systemic risk. Our model examines
this possibility. We calibrate the model with operational risk data to simulate
outages among CCP clearing members and show that CSPs need to be
significantly more resilient than firms to improve the safety of the financial
system. In financial settings where only longer (multi-period) outages impose
systemic costs, CSPs can best address systemic risk by strongly reducing
incident resolution time, rather than incident frequency. Finally, we show that
the use of an idealized back-up CSP successfully mitigates systemic risk from
CSPs. Back-up requirements may need to be imposed by policymakers
however, as the systemic risk is an externality to individual firms

ESMA

© ESMA