Resilience is key to the data centres debate
Regulators are concerned about the concentration of risk and growing reliance on a small number of tech providers, says Jordan Gray
Checking a banking app on our phone feels instantaneous to all of us but behind every digital transaction sit masses of physical data centres that most of us will never see. These centres provide the computing mega power we need to support modern financial services. As demand for AI and cloud computing continues to grow, so does the importance of that physical infrastructure. Britain’s data centre estate could expand by more than a third in the coming years.
Scotland is the UK's largest fintech (financial technology) cluster outside London and has plans to strengthen its position in fintech and AI, with a recent report suggesting the country could host up to 20 per cent of the UK’s data centres.
The infrastructure required to support those ambitions has become the subject of debate. New data centres can bring the investment and infrastructure needed to back a strong digital economy, but as we have seen with other technologies, projects can experience local opposition. In order for the Scottish economy to maximise the benefits, there will be a need to demonstrate the positives that AI infrastructure can bring and how these will drive growth in the local area.
For financial services, there is another dimension to this. The digital expansion in Scotland also raises questions about operational resilience and regulatory expectations.
The UK's Critical Third Parties regime became operational for the first designated providers in July. Regulators now have a concern about the concentration of risk and the growing reliance on a relatively small number of technology providers. They expect firms to understand the dependencies that support their business services and the risks that arise when multiple services rely on common infrastructure. That means firms looking beyond the supplier named in a contract.
If a fintech's risk-modelling provider and payment gateway depend upon the same cloud provider, then a single disruption could affect multiple services simultaneously. Firms should ensure a solid understanding of supply chains and identify where single points of failure exist. These are the types of questions regulators expect firms to be asking as part of their operational resilience frameworks.
The debate also raises an interesting question about where the regulatory conversation may go next. Much of the current focus is understandably on cloud providers and outsourcing risk. As reliance on digital infrastructure continues to grow, firms might need to consider the resilience of the infrastructure that underpins those services. If cloud providers are critical, then what happens if a potential issue sits not with the provider itself, but with the power and physical infrastructure on which those providers depend? Should we expect more AI infrastructure co-located with standalone power generation? We saw this problem in London during the summer heatwave which caused cooling failures that forced major cloud providers to power down their systems. With hotter UK temperatures predicted in the decades ahead, this may be something we see happening more regularly.
Digital infrastructure is very much part of the UK and Scottish economic ecosystem. As Scotland seeks to build on its strengths in fintech and AI, questions about the availability and resilience of that infrastructure will become harder to ignore. For regulated firms this is not a debate around where data centres should be built, it is more a question of resilience and understanding what their critical services depend on and then ensuring the dependencies are reinforced.
Jordan Gray is a Managing Associate at TLT
Comments
Want to join the conversation? Please or to comment on this article.