Analysis: Grey clouds hang over Australia's finance sector

Risk takers

McCabe said there has been modest levels of cloud computing adoption among Australia's mid-sized organisations.

"Those organisations that do are aware of the fact that they are in a [regulatory] grey area, but really want to use services hosted overseas," he said.

Take Perpetual Private Wealth, for example, a mid-sized financial services organisation that is attempting to host its CRM systems in a Singapore data centre.

Perpetual's general manager of strategic initiatives Nathan Jacobsen included Salesforce.com as part of a wider revamp of the wealth management firm's systems.

Jacobsen went through most of the hoops required by APRA, drawing up a risk management report and successfully gaining board approval.

But in a conversation with iTnews in April, Jacobsen revealed that APRA raised concern over data sovereignty with the company during a routine review.

"[APRA's interest] illustrates that doing this is unique. Even our regulators are not used to this," he had said at the time.

Within hours of the story going live, requests were made of iTnews to edit the story in light of APRA's audit.

Salesforce.com insists the project is going ahead, but Jacobsen has now been gagged from speaking to the press about the project any further.

Whether it is APRA cracking down or Perpetual's own self-censorship - one way or another, regulatory uncertainty has come into play.

Defending APRA

Not everybody in the industry is concerned by APRA's approach.

Take Real Insurance, which is currently renting Microsoft's Exchange system from the vendor's Singapore data centre.

Markus Strauss, head of information technology at Real said the insurance firm found APRA to be "reasonable and happy to engage with us."

"Our approach is to be transparent with APRA and disclose what we're doing," he said.

Strauss said Real Insurance didn't have any trouble with the regulator "on the basis that the services were not mission critical for operating the company or having an impact on customers.

"These are things we'll have to deal with as we look at [offshoring] line of business and mission critical systems," he said.

David Curran, executive general manager at the Commonwealth Bank was also comfortable with the level of regulation.

"We make sure that with any types of challenges in and around the cloud and data management space, that we're fully transparent with APRA," he told iTnews. "The governance of our data is clearly articulated, well defined and rigorously followed."

Neither Strauss nor Curran desired a clearer line between what is acceptable to the regulator and what is off limits.

"If I was APRA, I would be reluctant to draw a line," Strauss said.

"They should look at this on a case-by-case basis. Locking in a blanket rule is probably not the right way to go. The onus is on us to be transparent with APRA and work with them - to demonstrate what we are doing is safe and beneficial, to ensure their concerns are addressed. I wouldn't expect APRA to say: X is OK and Y is not."

Curran said APRA has to work on a case-by-case basis to keep up with the pace of change in technology and business.

"The issue you would have in being in technology is that things change every day, policies and procedures," Curran said. "Would the line be the same today as it is tomorrow? It has to come down to governance and the policies you apply and the application of that to your data - and that is very clear."

Hope for a local industry

KPMG's McCabe asserts that any uncertainty over the legalities of hosting the applications of the finance sector in public clouds is "a good story" for the local IT industry.

"The key outcome from our research is that organisations want to take advantage of the cloud - they see the benefit, but they want infrastructure hosted within Australian borders," he said.

"Some of the [financial sector CIOs] have been quite vocal about this," agrees Hayward, himself a former analyst. "They have expressed some frustration at how long it has taken to get this kind of offering hosted in the local market."

McCabe concludes that the cloud "isn't airy fairy stuff anymore."

"There really is a significant opportunity in the local market to base cloud infrastructure from within our borders," he said. "I see it as inevitable that a local cloud computing industry emerges and has a healthy market."