AFME urges faster adoption of cloud computing in capital markets

A good reason to go with the cloud is if you have a small firm without a substantial dedicated support staff, or if a given service is one that is not central to what you do.  For instance, it might make sense to have a cloud based Market Data feed system if it can be done without adding noticable latency, and may be even more timely in algo trading.  Same with certain types of trading systems.  But while the solutions may be called 'cloud' based, they work best with direct comms to the providers without any public / external exposure.

Indeed, exposure to the Internet is a huge concern security wise, also reliability wise.  DDOS attacks, hacking in general, are all things to be avoided, especially where loss of service or hacking can put the business in danger.  Yet with good enough security, some access via the Internet might make sense.  Salesforce is one example, because you have users in the field, not just in an office.  Or Market Data management systems, but in that case you should still explore direct lines to the vendor.  

So while cloud can make sense, it also brings dangers if not handled well, especially if communications go over the Internet.  Think it through before you plunge in!

From my experience, regulators are more advanced (here in the UK) than many give them credit for. If you are open, transparent and can prove you have the right system controls in place (security included), that you understand reslience, that you understand data residency and you have the right set-up with your chosen cloud provider, and that you can maintain that right to inspect. Then there should be no issues....Remember you can outsource the tech, the data region to the cloud, but NOT your firms or individuals accountability.

Many of the concerns raised are often due to a lack of knowledge regarding the actual implementation of a cloud based compound. For example, you can have entire subscriptions within Azure that have no public internet access at all! This means from an operational perspective you maintain it in the same ways you would a private datacentre that had zero internet cables running in and out of it. This is all possible, and no, you don't need to access the physical compound. The Cloud is far more resilient than any on-prem private infrastructure could be, and that includes protection from DDOS attacks etc etc....

Cloud providers are open to discuss and walk you through this stuff. Azure provides an FCA based ammendment for example, which, if you are thinking cloud, go and speak to Microsoft about, as it provides at a contratural level all the things you need, policies, process and procedures to support a financial based company.

If you aren't thinking a move to the cloud, then you will be left behind. That is the way of the world...