Digital operational resilience – now a major requirement from regulators – could be a boon for cloud data and spark a technical leap forward within asset management, our expert panel says.
Participants:
- Gareth Burgess, global head of IT development and data, Janus Henderson Investors
- John Lehner, president, FundGuard
- Duncan Cooper, chief data officer, Northern Trust Asset Servicing
- Nick Dekker, senior partner & head of technology consulting, Alpha FMC
- Tamryn Gunter, head of middle office position keeping & investment accounting product, BNP Paribas Securities Services
- Chris Mills, managing director, Citisoft
Looked at from one angle, fund management firms are data companies, absorbing and processing a colossal amount of information to do with customer orders and market data. If the funds industry does succeed in putting data at the centre of its operations, it is increasingly likely that data will be in the cloud.
Yet, the growing adoption of cloud data in asset management comes at a time when regulators are taking strict measures on cybersecurity with fines in the offing for any industry actors with cybersecurity shortcomings. In the EU, this concern manifests through the Digital Operational Resilience Act (Dora) – a pivotal framework aimed at enhancing digital resilience.
Digital disruption for asset managers appears in at least three major guises. Stock exchange outages are not uncommon. More dramatically is the heightened risk of cyberattacks.
Finally, it could be the arrival of a revolutionary new business model from an industry outsider.
Our specialist panel says, variously, that Dora will prevent digital disruption from outsiders, will justify the huge tech spend of recent years, and create greater operational agility.
Barrier to entry
Dora aims to strengthen the digital resilience of financial entities and help protect them against cyberattacks by setting harmonised requirements for managing information and communication technology (ICT) risks, and giving guidelines for incident reporting, risk management, and testing of ICT systems.
Two big events drove Dora’s creation: Covid, which saw a sudden transformation to working at home; and the invasion of Ukraine by Russia, which increased cyberattack fears.
Regulators rightfully expect systemically important financial institutions to be able to withstand crises.
Chris Mills, managing director at management consultancy, Citisoft, said: “Looking after client money is at the heart of what asset managers do and if they are not operationally resilient enough to look after client money already, they are not doing their job.”
He added: “Dora, therefore, is a barrier to entry for some players who perhaps should not be here in the first place. People will put their money in reputable firms only. Cybersecurity is a critical issue for boards because asset management is a data business and if you’re not cybersecure, you’re risking people’s money.”
“Looking after client money is at the heart of what asset managers do and if they are not operationally resilient enough to look after client money already, they are not doing their job.”
Chris Mills, managing director, Citisoft
John Lehner, president of FundGuard, said: “Dora validates any CTO who has invested in new, more modern technology and cybersecurity in recent years and a large amount of time justifying that spend to boards.
“The industry leaders are already multiples ahead of operational resilience rules. Dora and similar regulations simply call out the bottom quartile of firms who are creating the risk in the first place.”
Faster exits
Tamryn Gunter, head of middle office position keeping & investment accounting product within securities services at BNP Paribas, said she viewed Dora as a formalisation of many existing rules and best practices and she said asset servicers had concentrated on operational resilience for years.
“When all operational staff were onshore, we had disaster recovery sites. Then with the transition to more of a multi-local asset servicing approach, a new focus was needed on operational resilience,” she said.
Gunter and other panellists saw advantages from Dora. Asset management is heavily reliant on third-party providers. Firms can outsource almost anything, from trading desks through to back-office record-keeping functions. Sometimes, asset managers are so ‘wired-in’ to their providers’ systems that it is difficult to change those providers, whether for routine operational reasons – such as service dissatisfaction – or in the event of a crisis.
Gunter argues Dora could benefit this situation by forcing the convoluted outsourcing structure to become more fluid.
“From an asset management perspective, I think one of the factors that triggered a greater focus on operational resilience many years ago was the need to exit an outsourcing partner when, for example, their asset servicer could no longer support the client with their ambitions. The asset manager would need to migrate – a process which, in the past, could take up to four years,” said Gunter. “Then it came down to something like six to 12 months. But I think that Dora may serve to formalise this process and cause things to move more quickly.”
Duncan Cooper, chief data officer, Northern Trust Asset Servicing, said this ability to move swiftly between providers very importantly extended now to switching between providers of cloud services.
“Being concentrated in one cloud provider – and there are three dominant ones in the market – means you have a single point of failure. Dora forces a greater scaling across different providers and it is a competitive advantage to be able to design solutions for this,” said Cooper.
“Reputable organisations already do what Dora requires of us. However, Dora does make you think about this all over again – particularly for cloud applications, which need to be truly resilient.”
Gareth Burgess, global head of IT development and data, Janus Henderson Investors
Gareth Burgess, global head of IT development and data at Janus Henderson Investors, echoed the importance for rules such as Dora at a time when more firms may place their data in the cloud.
“Reputable organisations already do what Dora requires of us. We have hundreds of internal audits that check the resilience of critical processes. However, Dora does make you think about this all over again – particularly for cloud applications, which need to be truly resilient.”
Faster data
One of the critical takeaways from the discussion was the importance of data and intellectual property, both within and without the context of operational resilience. Seeing as asset managers heavily rely on third-party services, there is a growing need to maintain control over data.
BNP Paribas’ Gunter highlighted that data was a crucial element in migrations between outsourced providers.
“Certain things will now start to move quicker, and this must include the movement of an asset manager’s data,” she said.
For Cooper, this means it is “beholden upon asset managers to retain their own intellectual property” and find solutions that would support swifter data movement.
“That doesn’t mean an asset manager could not outsource that capability to an asset servicer, but the asset servicer will need to prove they can give the asset manager their data at any point in time.”
Cooper said this challenge created even more opportunity for the cloud sharing of data, and he added: “Arguably, firms should be able to switch between all commercial data providers, including those who provide market data, so firms are not tightly coupled to a single point of failure.”
Balancing regulation and innovation
A recurring theme in the conversation was the balance between regulation and innovation. One panel member, for example, pointed out that the asset management industry enjoys relatively high profit margins compared to other sectors and that although compliance can be a costly challenge for asset managers, investor protection and market stability were important to maintain and the suggestion was that the industry’s profitability could help to absorb these important costs.
Nick Dekker, senior partner & head of technology consulting at Alpha FMC, added that when compared to industries like banking and insurance, asset management is relatively lightly regulated and this had allowed for a degree of flexibility and innovation, but it also underscored the importance of regulations like Dora in setting a baseline for operational resilience.
Dekker suggested that while Dora might divert resources from discretionary initiatives to compliance efforts, the impact would not be significant enough to hinder technological advancements.
“Dora is prescriptive but much of the work is in evidencing that the regulations are met.”
Legacy systems and standardisation
One of the more contentious points in the discussion was the future of legacy systems in the wake of Dora. John Lehner warned that while new technologies are often seen as more resilient, legacy systems still pervaded the industry. The challenge lies in upgrading these systems to meet modern security standards, a task that may be daunting for some organisations.
“Dora may put more strain on legacy systems where some may not be fit for modern security standards,” Lehner said.
But whereas legacy systems are all pervasive, standardisation of processes has largely been all elusive. For years the operational side of asset management has struggled to make processes run more efficiently through the use of standards.
Northern Trust’s Cooper argued that while standardisation could streamline processes and reduce complexity, it is often challenging to achieve due to the diverse nature of the industry’s players.
Could Dora be a boon for standardisation, though?
“I think developments such as T+1 settlement will be a stronger driver for standardisation than Dora. T+1 will cause data to have to move around more quickly than it does now, and people will want more transparency. They will want the ‘Uber experience’ – being able to track their status, just like you can an Uber cab.
“But there needs to be a common taxonomy in terms of data, or a standardisation on data entry in all organisations. Either an emergent standard or new technologies should develop to enable high-speed data transfer and data comprehension.”
Could this happen?
FundGuard’s Lehner said that despite numerous attempts, achieving industry-wide standardisation in certain necessary areas of operations remained out of reach.
“I’ve seen multiple generations throw themselves at this and it’s still not solved,” he said. “Rather than standardisation, the industry opts for rationalisation and acceptance of differences.” However, he added that whereas many organisations are application centric when they should be data centric, cloud-native providers may be changing that.
“There was a period of my life when I thought the custodian banks, or the exchanges and clearing houses, were the ones who could facilitate standards because they have the greatest amounts of data. However, now that more people are mapping onto cloud-native data aggregation tools like Snowflake or Databricks, for example, potentially this creates hope for standardisation.”
Collaboration and data sharing
If there’s scant hope for standardisation, is there any hope at least for collaboration? Funds Europe asked if industry actors might succeed in identifying areas where firms did not compete and could therefore collaborate.
In a sector as competitive as asset management, collaboration may seem counterintuitive. However, the panellists identified specific areas where cooperation could be beneficial, particularly in data sharing. Alpha FMC’s Dekker said the private equity industry had gained success at ESG data sharing, for example.
“There should be more collaboration on data, but it needs to be industry-led and there is a real opportunity to reduce costs and gain efficiencies,” he said.
But isn’t data often the ‘secret source’ of an asset manager? Gunter agreed that data sharing would be a prime advancement for firms, saying that data itself was not a competitive advantage, rather the insights and decisions derived from it were.
“This distinction could provide a basis for collaboration, as firms can benefit from shared data sets while still competing on their analysis and application. It’s about what you do with the data sets that gives you the advantage,” said Gunter.
Burgess, of Janus Henderson, highlighted collaboration of over data, too, but specifically accounting data.
“For me, it’s about the accounting data set. There’s no competing interest with accounting data, which should theoretically be the same between firms. This is an area where a utility-type model could be created.”
FundGuard’s Lehner concurred, pointing out that cloud technology could facilitate greater collaboration without compromising proprietary information.
“With the ability now to have all data in the cloud, opportunities exist for additional collaboration at many different levels that could improve processes without firms having to give up their secrets.”
Lehner said there were still many firms with reticence about cloud sharing, however.
“Many people do get it, they get why cloud is the future, they get that it’s already happening. But there are still some firms with a reticence to put their data off-premises because they don’t feel they can trust it. They do not realise that most of the security of the free world is already on Amazon!”
Perhaps the most intriguing area of collaboration links with the costs involved for asset managers to obtain market data. Regulators have brought scrutiny to this area, that some see as a near-cartel between market data providers and indexation firms.
Why don’t asset managers club together to solve for bringing the cost down of market data?”
Nick Dekker, senior partner & head of technology consulting, Alpha FMC
Dekker suggested market data could be a prime area for data collaboration.
“Why don’t asset managers club together to solve for bringing the cost down of market data?” he asked. Gunter – although acknowledging a difficulty with data distribution due to licensing agreements with vendors – said the collaboration could extend beyond asset managers to their clients, because “99% of the time you’re using the same vendor data anyway”.
A good future with Dora
The conversation among the asset management professionals highlighted that Dora is less of a regulatory hurdle for firms that are already well run and, in fact, represents an opportunity for the industry to evolve. By setting clear guidelines for digital resilience, Dora compels firms to re-examine their operational frameworks, invest in cybersecurity, and enhance their data management practices. While the regulation might pose challenges, it also offers a chance to innovate.
Whether through enhanced data strategies, greater collaboration, or more robust operational frameworks, the future of asset management – especially data management – in the era of Dora promises to be both challenging and exciting.
Read the full Operational Resilience 2024 report, in association with FundGuard.
