FINRA publishes report on impact of cloud on broker-dealers

The Financial Industry Regulatory Authority (FINRA) has released a report on the impact of cloud computing models on how broker-dealers operate.

While a diversity of cloud models have the potential to enhance agility, efficiency, resiliency and security within firms’ operations, FINRA highlights the importance for brokers to consider relevant regulatory factors for maintaining investor protection and market integrity.

“Cloud Computing in the Securities Industry” was published following a review of nearly 40 broker-dealer firms, cloud service providers, industry analysts, and technology consultants. Comments are requested by October 16, 2021, especially regarding guidance or modifications to FINRA rules to support cloud adoption.

Haimera Workie, Head of the Office of Financial Innovation and Senior Director at FINRA, commented: “This report is intended to serve as a tool for our member firms and other industry stakeholders by providing information to help them learn from the experiences of others. In addition, it provides useful insights regarding the challenges and benefits associated with implementation of a cloud computing framework, from both an operational and regulatory perspective.

“As broker-dealers are at various stages in their cloud computing journey—from full or partial integration, to pilot projects or not at all—many firms are seeking to explore how these technologies can be used to personalize customer experiences, analyze larger amounts of data faster and increase their competitiveness in areas of rapid innovation”, Workie added.

The agency has found that the use of Software as a Service (SaaS) products was prevalent, particularly among smaller firms which use off-the-shelf SaaS cloud products for non-core business functions, such as email systems, customer relationship management, financial accounting and human resources operations.

Roll-outs of cloud infrastructure tended to be targeted, incremental and iterative, as firms take a measured approach instead of launching a wholesale migration of the business to the cloud.

Governance, cloud security, and training are a major focus for broker-dealers as they look to safeguard data and systems, often leveraging enhanced security protocols in the cloud environment.

Cloud adoption often coincided with firms’ reassessing their areas of technology expertise, frequently with existing staff being re-trained or acquiring new staff with cloud expertise, according to the research.

“As adoption of the cloud continues to grow, firms are finding clear benefits, but also potential challenges. We encourage broker-dealers to conduct their own assessments of the implications of cloud computing, based on their business models and related use cases, and share those learnings with us”, Workie explained.

In regard to regulatory challenges for broker-dealers operating or migrating to the cloud, FINRA named cybersecurity, data privacy, outsourcing/vendor management, business continuity, and recordkeeping as the main issues.

While cybersecurity is regarded as a potential benefit to cloud computing, there are challenges in making sure their systems are appropriately configured for security on the cloud.

Broker-dealers also need to update their policies and procedures related to customer data privacy as the cloud leads to changes in how it collects, stores, analyzes and shares sensitive customer data.

Outsourcing an activity or function to a cloud service provider or other cloud vendor does not relieve firms of their ultimate responsibility for compliance with all applicable securities laws, regulations, and FINRA rules, the agency explained, adding that firms are still required to create, maintain, annually review and update written business continuity plans relating to an emergency.

Recordkeeping products or services offered by their cloud providers should also be eyed with great attention in order to ensure broker-dealers comply with their obligations.