Cloud-based regulation of the financial industry

Contents:

1. Brief description of cloud technologies;
2. Legal regulation of the use of cloud technologies in the field of finance;
3. What conditions must be met by financial market participants to protect confidentiality?
4. How do banks implement cloud technologies in their work?

Cloud-based regulation of the financial industry

Any financial institution strives to offer its customers high-quality and modern service. For this, banks actively cooperate with fintech companies and introduce the latest technological solutions into their work. Among them are cloud technologies, which are designed to speed up data processing many times over. Statistics show the steady growth of the cloud computing market. This trend is observed in Russia and the largest countries of the world with a developed credit and banking system. The capabilities of virtual infrastructure in the finance industry are used to manage sales, marketing, and customer service.

The world's largest manufacturers of applications for banking systems offer software products that use cloud technologies. Such solutions are used to test loads on various elements of the banking system, to model and assess credit risks.

Cloud technologies are in demand not only by banks, but also by companies whose activities are related to investments, the international securities market.

Clouds are classified as public and private. Public virtual services are virtual services that are provided by third parties. Private clouds are computing resources that run in the trusted zone of the corporate network.

Until recently, the only limiting factor for the adoption of cloud technologies was the provision of data security and the lack of clear legal regulation. To date, these issues have practically been resolved thanks to innovations.

Legal regulation of the use of cloud technologies in the field of finance

The regulators that determine the rules for the use of cloud computing in banks and investment companies are a number of structures. Among them are government agencies, the Central Bank, FSTEC, FSB, international payment systems. Among the decrees that directly or indirectly regulate this issue are Federal Laws № 149 ("On information, information technology and information protection"), № 152 ("On personal data"), № 161 ("On the national payment system ").

The Central Bank has developed a number of regulations and industry standards that regulate the procedure for maintaining and storing databases using electronic media, and determine how to protect data from leakage when transferring funds.

The orders of the FSTEC and the methodological recommendations of the FSB are directed to the security of confidential data during their accumulation and processing with the help of information systems.

None of the applicable laws and regulations prohibit the use of cloud computing. Restrictions and work standards are primarily aimed at the safety of collection, storage and transmission of information.

What conditions must be met by financial market participants to protect confidentiality?

Information on security measures is contained in the Order of the FSTEC RF №17, which is based on the Federal Law №152 "On the protection of personal data." If financial market participants work with data, the following requirements must be met:

1. Access subjects and objects must undergo mandatory authentication and identification.
2. The software environment should be limited with the mandatory protection of machine storage media of personal data.
3. It is necessary to continuously monitor the security of personal information using active protection against computer viruses, protection of the virtualization environment and technical means from cyber attacks.
4. Intrusion detection and response should be continuously monitored. 

How do banks implement cloud technologies in their work?

To build a virtual infrastructure, financial market participants need to conclude an agreement with a cloud provider. Experts emphasize that when signing this agreement, the parties need to decide on the legal aspects of the transaction and its technical support. Typically, the cloud provider is responsible for protecting the virtual environment from external threats such as DDOS attacks, data leaks, and malicious applications. The same applies to updating and configuring software, making changes to the work with personal data in accordance with new legal requirements.

As for the client, his area of ??responsibility includes maintaining security inside the virtual machines provided for operation.

Lawyers of A4 Law Firm have a narrow specialization related to the implementation of IT technologies in modern business. We will advise clients on the application of specialized regulatory legal acts, help to competently draw up a contract or amend existing documentation.