Letter to FTC on Cloud Computing

Federal Trade Commission
Office of the Secretary
600 Pennsylvania Avenue NW
Washington, DC 20580

Dear Federal Trade Commission Staff,

The American Bankers Association (ABA) values the opportunity to comment on the Federal Trade Commission's (FTC) request for information (RFI) on the business practices of cloud computing providers. The FTC seeks information on cloud computing providers market power, business practices affecting competition, and potential security risks they pose to the finance, healthcare, transportation, eCommerce, and defense industries.

The ABA appreciates the FTC’s interest in seeking a deeper understanding of the role of cloud service providers (CSPs) in the financial services sector. CSPs are constantly innovating and investing in research and development, as evidenced by the rapid expansion and regular release of new products and services. This includes additional data centers that are geographically dispersed to enhance resiliency, enhanced security using pervasive encryption, automation tools, and artificial intelligence and machine learning (AI/ML) tools. CSPs are central to the functioning and security of the banking system. Many banks utilize cloud services to respond to customer demands for digital products, increase resilience to physical and cyber security incidents, leverage cost efficiencies relative to maintaining legacy IT systems, and to support a remote workforce. This utilization is rapidly accelerating. In addition, many third-party service providers to banks, such as financial technology companies, rely extensively on CSPs, which further increases the dependency and associated risks of banks on CSPs.

Against this backdrop, the ABA offers the following comments and recommendations to the FTC.

• The FTC should leverage the work of the US Treasury Department and Federal banking agencies (FBAs) and align as much as possible with other agencies and foreign authorities so that there is a harmonized approach to the safe and sound financial sector adoption of cloud services.
• The FTC should encourage CSPs to include design features within their base products and services offerings that allow banks (and by extension other regulated institutions) to meet their compliance requirements.
• The FTC should understand that the "shared responsibility" model is complex and presents challenges for financial institutions.

Download the comment letter to read the full text.