Cloud Concentration and Exit Planning at Harrington Boyd
Harrington Boyd is a UK bank with £9bn of retail deposits. Its payments hub sits on a single US-owned cloud provider under a 24-month auto-renewing contract signed eighteen months ago. The provider stores data in two US regions and subcontracts customer authentication to a smaller firm that the bank has never reviewed. Termination assistance runs for 90 days at extra cost; there is no documented or tested exit plan. Payments are one of the twelve important business services the bank has identified, with an impact tolerance stating that no more than 5% of customers may be unable to make or receive payments for more than two hours. In the last six months the provider has suffered two outages, of four hours and ninety minutes; the first affected 40% of the bank's payment traffic. The board has asked three questions: whether the arrangement needed regulatory notification, whether the outages breached the tolerance, and what must change in the contract before renewal.
1. Assess whether the cloud arrangement is 'material' outsourcing requiring regulatory notification, and identify what information the board needs before deciding.
Read the worked answer
Materiality is not decided by contract value or the word 'cloud'. The tests to apply are: criticality to an important business service; the potential impact on operational continuity, customers and the firm's ability to meet its obligations; the ability to substitute the provider or bring the service back in-house within a reasonable time; data sensitivity and location; and concentration.
On these facts the arrangement looks material, arguably at the higher end. It supports a payments hub that is an identified important business service; there is a single provider with no alternative; there is an unreviewed subcontractor in the authentication chain; data sits in two US regions with attendant transfer and access considerations; and there is no tested exit. The bank remains fully accountable for the service - outsourcing transfers activity, never responsibility.
Where an arrangement is material, the firm is expected to notify its regulators in advance and to hold the documentation to support that. Boards should also recognise that notification is not approval and provides no defence if the arrangement fails.
Before deciding, the board needs: the executed contract and all sub-contracts; the full subcontracting chain and the firm's approval rights; audit, access and regulator-access rights; data residency, transfer and deletion terms; business continuity and disaster recovery commitments, with test evidence; the exit plan and its tested status; concentration exposure across all critical third parties; and the mapping of this provider to impact tolerances. Without those, the board cannot determine materiality with confidence.
2. Evaluate whether the two outages indicate a breach of the impact tolerance, and set out what the operational resilience requirements expect of the firm.
Read the worked answer
The tolerance is expressed as a maximum of 5% of customers unable to make or receive payments for more than two hours. The four-hour outage affecting 40% of payment traffic clearly breaches it on both limbs - duration and proportion of customers - assuming the affected traffic maps to the customer base. The ninety-minute outage does not breach the duration limb, but repeated shorter outages matter because resilience is assessed against severe-but-plausible scenarios, not only observed events; recurrence is evidence that the underlying dependency is fragile.
The resilience framework expects the firm to: identify its important business services; set impact tolerances for each, approved at board level and expressed in terms meaningful to customers and markets; map the people, processes, technology, facilities and third parties on which each service depends, including the subcontractor chain; run scenario testing of severe but plausible disruptions (provider failure, loss of a region, insolvency of the provider, loss of the subcontractor); identify vulnerabilities and remediate within a stated plan; and learn from incidents, with root-cause analysis and board reporting.
Crucially, the framework is outcome-based and non-delegable. The firm cannot point to the provider's resilience as its own. It must be able to remain within tolerance during a severe disruption, which on these facts it demonstrably cannot - there is no exit plan, no alternative provider, and no visibility of the authentication subcontractor. The board should treat this as a live remediation item, not a documentation gap.
3. Recommend the contractual and governance changes needed before the contract auto-renews, with reasoning for each.
Read the worked answer
Contract. Extend termination assistance from 90 days to at least twelve months at pre-agreed, capped cost, because a 90-day window is not credible for migrating a payments hub. Add data portability, return in a usable format, and certified deletion. Secure audit and access rights for the firm, its auditors and its regulators, including over subcontractors. Require prior approval of subcontractors with flow-down of the same obligations, which directly addresses the unreviewed authentication provider. Add service levels with meaningful credits, breach-escalation, a right to terminate for repeated failure, and change-of-control provisions. Require named recovery objectives and evidence of testing. Add a right to vary for regulatory change. Remove auto-renewal or convert to a shorter renewal with an explicit board decision.
Exit. Produce a documented exit plan covering data extraction, alternative arrangements, parallel running and customer communications, and test it in a severe-but-plausible scenario. Identify a viable alternative for the authentication layer specifically, since that is the least substitutable element.
Governance. Put the provider on a critical third-party register with an assigned owner and annual due diligence; monthly service reviews against SLAs and KPIs; board reporting on concentration and on impact-tolerance headroom; and incident reporting that reaches the risk committee within a defined period. The reasoning throughout is that the bank retains accountability for the service regardless of the contract's commercial terms.