Core Operations Move to the Cloud

Even larger CUs—once skeptical due to security concerns—are taking a closer look at the cloud.

January 1, 2012

Can you imagine a day when even mission-critical services such as core processing routinely run on “the cloud”? That day is coming, say some information technology (IT) experts and vendors.

In the near future, the cloud will operate almost in real time and on-demand like a utility, similar to electric utilities where you get billed only for what you use, according to CUNA’s 2011-2012 Credit Union Environmental Scan.

While it might be some time before core processing moves exclusively to the cloud, operating at least partially on the cloud is quickly becoming standard practice. But it depends, in part, on how you define it.

Some say cloud computing is merely a new term for application service provider (ASP), software as a service (SaaS), or outsourcing.

Once used almost exclusively by small credit unions, hosted applications delivered in an outsourced or SaaS model are getting a closer look from larger credit unions that once appeared committed to an in-house approach.

Defining ‘the cloud’

2012 Information Systems Guide
Credit Union Magazine’s annual guide to the top credit union core processors is now available.

Check out the 2012 Information Systems Guide for:
  • A detailed matrix of 24 core processing systems’ key features and functions;
  • A guide to the industry’s top core processing providers;
  • Late-breaking industry news; and
  • In-depth core processing coverage from Credit Union Magazine, creditunionmagazine.com, and other industry sources.

Experts are still debating the definition of a cloud-based solution. Rudy Pereira, senior vice president of operations and technology at $7.8 billion asset Alliant Credit Union, Chicago, participates in the BITS Financial Services Roundtable’s Cloud Computing Subgroup.

The subgroup has defined the “essential characteristics and basic features” of cloud computing as any solution that offers:

  • Broad network access;
  • Rapid elasticity;
  • Measured service;
  • On-demand self-service; and
  • Resource pooling.

Pereira, who's chair of the CUNA Technology Council and vice chair of the CUNA Councils, says SaaS solutions offered by core processing vendors fit within that definition of cloud computing. An SaaS solution provides software in a central location for on-demand access by licensed users, usually via a Web browser.

But broad definitions of cloud computing, says Scott Hansen, executive vice president of business development for Harland Financial Solutions, Lake Mary, Fla., don’t address the flexibility and mobility of a true cloud solution.

Credit unions that rely on Harland Financial Solutions’ outsourced solution can visit data centers in Des Moines, Iowa, or Englewood, Colo., and see their rack of servers and even the wire that transmits their data from the core processor to the credit union. Since data doesn’t travel outside the credit union’s assigned server, Hansen says it’s never truly in the cloud.

In contrast, “public cloud” solutions offered by companies such as Amazon, Microsoft, and Rackspace rely on data centers located around the world. Applications and data move from one center to another based on demand—meaning your data could be stored in Hong Kong in the morning and Miami in the afternoon.

“Private clouds” offer another option. In a private cloud, specific hardware is dedicated to one company’s use, although the hardware might be located in multiple data centers in different locations. Private cloud data flow among the hardware to make the best use of pooled resources.

“Hybrid clouds” combine the characteristics of both public and private clouds, shifting from one to another based on the type of applications or data being used.

Next: Security concerns



Security concerns

Credit unions and vendors alike appear leery of using the public cloud or a hybrid for mission-critical, member-sensitive data and applications. Their opinions about running these operations on a private cloud are mixed.

Any type of cloud application currently appears too risky to carry member data for $1 bil­lion asset Numerica Credit Union, Spokane Valley, Wash., according to Kelley Ferguson, vice president of IT. Numerica uses only in-house solutions to ensure it always has access to applications while maintaining control of sensitive member information.

“There will always be people who claim to have secured your data,” Ferguson says. “But when it comes down to it, it’s still our data on your servers and your network. So while the concept is great, it’s just not the place for us.”

University of Kentucky Federal Credit Union, at $403 million in assets, also has ruled out cloud-based core processing at this time, says Kathy Begley, vice president of operations and credit.

All five of the credit union’s branches are within the Lexington area and each is within 10 miles of at least one other branch. Proximity, she says, makes a point-to-point connection the most efficient and reliable way to share applications and data delivered by the credit union’s in-house Symitar core processing system.

The credit union currently uses hosted applications that rely on private cloud technology for its timekeeping and credit card systems. Home banking will move to a hosted solution in the near future even though it will be considerably more costly than the existing in-house solution. The vendor has aimed all upgrades at hosted solutions.

Control issues

Dallas Telco Federal Credit Union in 2009 moved from an in-house solution to Symitar’s Ease product—a remote hosted core processing solution that fits the
definition of SaaS. Gary Doan, vice president, IT, says the credit union accesses core processing via a secure virtual private network (VPN) through the credit union’s Internet connection.

All data funnels through the $118 million asset credit union’s core processing router, supplied by Symitar, and connects only to the router at Symitar’s data center in Lenexa, Kan. The connection stays secure through VPN encryption.

“To me, it’s just as secure as point-to-point because if you can break down a secure VPN encryption, then you can get into a point-to-point,” Doan says. Arrangements with multiple Internet service providers create a backup for Internet failures.

One disadvantage of an outsourced approach, says Doan, is the loss of control. Dallas Telco Federal must rely on Symitar’s service desk, for example, when stopping and starting its internal connectors.

Switching to an SaaS that relies on shared capacity also meant giving up customized reports and made it impossible to accelerate the timetable for specific tasks or reports, since the system is shared by other credit unions.

“Because it’s a multicredit union server, the rules for all the credit unions are the same,” says Doan. “That can be a benefit because it forces you to think about your business processes. Nine times out of 10, the software you have will do everything you need.”

Other benefits of an SaaS approach for core processing, says Doan, include:

  • Significantly reduced compliance burdens, since the core processing vendor must meet regulators’ standards;
  • Savings of at least $10,000 annually in hardware purchases;
  • Lower staffing workloads; and
  • A high level of business continuity because the credit union can retrieve all data from the vendor.

A shift toward hosted solutions

The growing appeal of SaaS core processing is reflected in its greater acceptance among credit unions of all sizes, according to core processing vendors.

Ed Miller, Symitar’s director of operations, says small credit unions that were unable to affordably operate in-house core processing were the first to sign up when the vendor’s EASE product launched in 2003. Now, he says, “We’re seeing a trend toward the largest credit unions being interested in this service.”

The shift toward hosted solutions was also noted in two recent reports—“Core Banking Solutions for Large Credit Unions” and “Core Banking Solutions for Small Credit Unions”—both from financial research and consulting firm Celent. Many credit unions lack the economies of scale needed “to properly operate a robust in-house core processor,” notes Celent, making it more cost-effective to use a hosted approach.

The CoreSoft core processing platform, from VSoft Corp., is available as an in-house, outsourced, or cloud solution. Murthy Veeraghanta, chairman and CEO, says VSoft’s private cloud solution uses the same software as its outsourced solution. VSoft is still waiting to learn whether regulators will have specific requirements related to the use of cloud computing, he says.

Credit unions could see new providers enter the market, according to Jason Mendenhall, executive vice president of Las Vegas-based Switch, which builds and operates the world’s most powerful data center and technology ecosystems—the Switch SuperNAPs—and provides colocation, connectivity, and cloud services to national and multinational companies conducting mission-critical business. Switch SuperNAP is a CUNA Strategic Services alliance provider.

“The SaaS model really requires that the core processing provider develop new applications or re-architect their application to support a ‘salesforce.com’-like experience for its customers,” Mendenhall says. “Not every existing provider has undertaken that effort, but new providers are starting to emerge that will provide this type of solution for credit unions.”

Next: Bending toward the cloud



Bending toward the cloud

Credit unions need to become familiar with cloud-based applications, agree IT professionals, because some software vendors are upgrading existing software only for use in the cloud.

Most software companies are bending their development efforts toward the cloud, says Miller, both because clients appreciate the ease of accessing software via an Internet browser and because it makes it easier for the software company to license and deploy its products.

“It’s a fact that many manufacturers are going to develop products that will never provide for in-house solutions again,” Miller predicts. “They’ll provide their software exclusively via a browser.”

NetSol Technologies, which offers software to manage back-office processes for leases and loans, has started offering loan management software from the cloud. The company recently announced that its LeasePak software is available as an SaaS solution.

“We realized financial institutions are beginning to accept the notion of cloud computing for mission-critical applications,” says Andrew Lea, manager of marketing and corporate
communications.

Planning for migration to the cloud also allows credit unions to take advantage of faster time-to-market, more efficient use of resources, and the ability to integrate multiple service offerings, adds Mendenhall. While the development of cloud services is still in its infancy, he says, “those that leverage cloud-based services will be able to differentiate their position in the marketplace.”

For small credit unions that struggle to find resources and personnel to keep up with security demands, security experts say cloud-based solutions provide enhanced security because cloud vendors use state-of-the-art security precautions.

Four out of five credit unions are better off with cloud computing than managing complex applications in-house, says Jim Stickley, chief technology officer for TraceSecurity, a CUNA Strategic Services alliance provider. These smaller credit unions lack the policies, procedures, and people required to keep systems and data secure, he says.

Vendor due diligence is crucial, Stickley adds, especially when dealing with companies that are newcomers to serving credit unions.

Alliant’s Pereira suggests credit unions begin exploring cloud-based solutions by identifying business objectives and potential risks to help determine what types of data they can entrust to the cloud and what cloud-based services can deliver the biggest benefit.

Alliant has in-house core processing, but uses the cloud to provide personal financial management online. Solutions for e-mail and human resources are other applications credit unions should strongly consider moving to the cloud, says Pereira.

“The cloud allows companies to essentially reach into scalable resources to boost capacity or add capabilities without having to invest in new infrastructure and manpower,” he says. “It’s not about controlling the computer room; it’s about providing secure, reliable, efficient, and timely services to the members and the business.” 

Cloud Processing Pros and Cons

Pros

  • Reduced hardware investment, which allows costs to be shifted from capital expense to operating expense.
  • Eased compliance workload for credit union staff, because the vendor is responsible for most compliance requirements.
  • Instant access to software upgrades.
  • Business continuity, with data stored off-site and backed up by the vendor’s safeguards.
  • Reduced operating costs, because price is based on usage and is paid incrementally.
  • Flexibility to accommodate growth without requiring additional hardware.
  • Improved security based on the vendor’s ability to attract and retain security experts.
  • Reduced service outages.

Cons

  • Loss of control over data.
  • Reduced ability to customize applications.
  • Industry standards are still evolving.
  • Regulators’ response not yet clarified.
  • Security standards for cloud-based core processing vendors are still in development.

RESOURCES

  1. Switch SuperNAP
  2. TraceSecurity