Banking Apps that Matter Will Head to the Cloud in 2016

Capital One is bounding down a path on which other banks have been tiptoeing.

The McLean, Va., bank and card issuer has begun shrinking its physical technology infrastructure by shifting it to Amazon's public cloud. At first, Amazon Web Services was used mainly for developing and testing software. More recently Capital One used the Amazon service to deploy its new mobile banking apps — software that's vital to the organization these days.

"Like many large enterprises, we started more in an experimentation mode, in our innovation labs," Rob Alexander, the company's chief information officer, said at a conference in October. "It was a grassroots, developer-driven use of the platform."

But "this year, we've taken a more aggressive stance, recognizing that we could deploy some of our most critical production workloads on the AWS platform," he said.

Other financial services companies, including Goldman Sachs, JPMorgan Chase, and Synchrony Financial have been putting some applications in the cloud. But Capital One's endorsement of Amazon's cloud is a potential inflection point.

"Three years from now, if we're looking at mainstream banks going to cloud services, I think we'll be able to point to Capital One as the beginning of the turn in the market," said James O'Neill, senior analyst at Celent.

The move to lower-cost and more nimble computing solutions could help banks compete with fintech startups like Simple that also operate in the cloud.

Part of Capital One's motivation is to save money. The company plans to reduce its data center count from eight in 2014 to five by the end of 2016 and three by the end of 2018.

Another reason: developers like the cloud, because they can easily order up the computing resources they need for their projects.

"We have thousands of developers building software at Capital One," Alexander said. "The ability to provision infrastructure on the fly is huge for our productivity and speed to market."

A third benefit is elasticity, and the ability to handle peak workloads. "Think credit card purchase volume on Black Friday or Cyber Monday," Alexander said. "We need to be able to expand dynamically to meet that demand."

As for the always-important issue of security, which keeps many banks from putting mission-critical applications on a cloud service, Alexander said Capital One worked with Amazon to develop a security model that is more secure than Capital One's own data centers (he did not elaborate on what that security model looks like).

Further, he said, the company's use of AWS is a draw for engineering talent, and Capital One has thousands such roles to fill.

Like Capital One, Synchrony Financial, the Stamford, Conn.-based card company that recently split from GE Financial, also wants to shrink its data center footprint as it moves more applications to the cloud. It operates two data centers in colocation facilities.

"We don't want to be in a position where we're managing real estate that's no longer part of a strategic priority," said CIO Carol Juel in a recent interview.

As it separated from GE, Synchrony had to quickly find replacements for technology and services the parent company used to provide. It set up 45 new platforms in the past year, some of them on the cloud. For instance, it chose Workday's cloud-based human resources software and Reval's software-as-a-service treasury product.

"We're leveraging the cloud in places where we feel comfortable that it's the right situation," Juel said.

Synchrony takes a more conservative approach than Capital One, however.

"We look at what type of information will be stored, we look at the provider itself, is it public cloud vs. private cloud, is it really more software as a service?" she said. "How much of it is truly shared? How much do we have the ability to understand where our data may or may not sit?"

Applications the company considers core are all run internally.

"In my view, when we're going to move something to the cloud, it's not necessarily going to be the core of our business; we're not going to jump up and move card processing into the cloud, the bread and butter of what we do," Juel said.

The issue is lack of control, she said.

"People gain confidence in the fact that you know a person and team that's responsible," Juel said. "When things are moved to the cloud, there's a degree to which you pass accountability, even though you have contracts and oversight. It's not your information security team responsible for ensuring that those machines are patched and that they're managing the environment."

Companies in general are getting more comfortable turning work over to cloud providers like Amazon, Microsoft and Rackspace.

"CIOs and CISOs need to stop obsessing over unsubstantiated cloud security worries, and instead apply their imagination and energy to developing new approaches to cloud control, allowing them to securely, compliantly and reliably leverage the benefits of this increasingly ubiquitous computing model," Gartner analyst Jay Heiser wrote in a recent report.

JPMorgan Chase, Goldman Sachs, and the International Securities Exchange have begun moving applications to the cloud with the use of container software that can provide built-in security. The Federal Home Loan Bank of Chicago runs all of its internal production workloads on the AWS cloud and has cut costs 30%, according to Amazon's website.

In all of these cases, banks are going little by little, trying one application, then another in the cloud.

But as those applications become more important — in Capital One's case, its mobile banking software — the traditional core banking software that banks find so hard to replace will play a smaller, background role.

Editor at Large Penny Crosman welcomes feedback on her column at penny.crosman@sourcemedia.com.