Ju ly 2022 Risk Technology Assessment at Banks ZOOMING IN ON THE TOTAL COST OF OWNERSHIP Prepared For: Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 1 Table of Content s EXECUTIVE SUMMARY ................................ ................................ ................ 2 METHODOLOGY ................................ ................................ ............................ 5 THE CURRENT STATE OF RISK MANAGEMENT TECHNOLOGY 7 SPOTLIGHT ON THE REGULATORY BURDEN AND OPERATIONAL RISK ................................ ................................ ........ 8 THE TECHNOLOGY CROSSROADS ................................ ........................ 9 BREAKING DOWN THE RISK COST EQUATION .............................. 16 CASE STUDY FOR SAAS MIGRATION ................................ ................. 22 CONCLUSION ................................ ................................ ................................ 24 ABOUT AITE - NOVARICA GROUP ................................ ......................... 25 CONTACT ................................ ................................ ................................ ........ 25 AUTHOR INFORMATION ................................ ................................ ........... 25 List of Figures FIGURE 1: MAJOR FINDINGS REPORT ................................ ................... 3 FIGURE 2: INTERVIEW BANK SEGMENTS ................................ ........... 6 FIGURE 3: REVIVAL OF TRADING BUSINESS ................................ ..... 7 FIGURE 4: KEY CONSIDEARTIONS IN RISK TECHNOLOGY DECISION S ................................ ................................ ......................... 10 FIGURE 5: THE TCO RISK COST EQUATION ................................ ..... 16 FIGURE 6: COST RESPONSIBILITY COMPARISON .......................... 17 FIGURE 7: HIDDEN COSTS OF ON - PREMISES RISK SYSTEMS .. 19 List of Tables TABLE A: KEY BENEFITS OF SAAS MIGRATION ............................. 13 TABLE B: COMMON SAAS MIGRATION OBJECTIONS AND RESOLUTION S ................................ ................................ .................. 14 Ju ly 2022 Risk Technology Assessment at Banks Zooming in on the Total Cost of Ownership Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 2 EXECUTIVE SUMMARY Globally, b ank s have historically chosen to deploy third - party risk technology on premises , largely a reflection of the vendor landscape up until the past few years In recent years, the landscape has shift ed toward greater availability of Software - as - a - Service (SaaS) third - party risk management solutions Despite many banks keeping up maintenan ce and investment in legacy on - premises risk platforms , banks increasingly recognize the merits of SaaS - based risk technology In this model , banks largely delegate the responsib ility for the infrastructure, management, and development of the risk application s to vendors Aite - Novarica Group expects b ank s’ risk technology infrastructure to look quite different by 2030, with cloud - based SaaS technology more common A combination of factors drives the change in deployment preference , from business factors such as faster time to market, on - demand resource allocation, disaster recovery , and uptime of services to costs of hardware and maintenance and compliance pressures Zooming in on the t otal c ost of o wnership (TCO) in particular , Aite - Nova rica Group finds that on - premises risk platforms have significantly higher “ hidden costs ” when compared with SaaS risk platforms. The hidden costs , such as data - integration - related costs , hardware costs , and developer costs, are difficult to estimate and are addition al to the visible upfront license and implementation fees SaaS license pricing is mostly inclusive of these hidden costs , and b anks note that the absolute license costs for SaaS - only risk vendors still are generally lower than those of on - premises or hybrid counterparts . This makes the TCO for banks with SaaS - based risk platforms also lower , which helps make the case for migration to SaaS solutions Th is paper explores the technology decisions banks face and the merits and hurdles of SaaS migration , and break s down the TCO equation using direct feedback from surveyed banks, with key findings highlighted in Figure 1 Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 3 FIGURE 1 : MAJOR FINDINGS OF THE REPORT Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 4 Key findings follow : • Third - party solutions dominate regional and local banks: All b anks in the study use at least one third - party solution to manage enterprise - level or specific risk s , with most relying entirely on third parties for all risk management needs. • The m ajority of banks still deploy on - premises technology, but this will change : Aite - Novarica Group estimates that around 80% of banks deploy third - party risk management technology on premises , but the pipeline of new implementations fro m leading vendors is estimated to be around 4 0% SaaS /cloud deployments. • Banks with SaaS risk solutions report a lower absolute TCO compared with banks with on - premises installations: This is driven by two major factors, the first being that SaaS headline fees already incorporate several costs that include hosting infrastructure and performing upgrades, resulting in less “hidden cost ” The second factor is that , remarkably , even SaaS vendors ’ absolute headline license or subscription costs are repo rted to be lower than legacy on - premises risk solutions. • Visible upfront costs for SaaS risk systems capture a greater portion of TCO for banks compared with the license costs of on - premises solutions: License and implementation costs represented about 6 3 % of TCO for SaaS compared to on - premises deployments , at 43 % of TCO. This partially reflects the greater hidden costs of on - premises systems , which include data management and integration costs. • The major cost component for on - premises risk solutions is data management and integration: The largest cost burden s for on - premises solutions are the data management and integration efforts . These are estimated to be 3 4 % of TCO for on - premises risk systems. • Staff ing requirements to maintain and develop an on - premises risk system are significantly higher than they are for SaaS deployments : Banks that deploy on - premises in many cases have over 15 full - time employees (FTEs) to support the day - to - day operations in addition to risk system maintenance, development , and customization efforts Additional costs are also accumulated over time due to external consultants’ implementation and maintenance fees For SaaS, between two and three FTEs support other solutions for day - to - day management , while the risk system maintenance and development is largely in the hands of the vendor Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 5 This paper highlight s the current market and regulatory conditions facing bank s of all sizes and how they have brought banks to a crossroad s at which they must consider alternative technology deployment m odels and greater outsourcing of risk technology to third parties . This paper then lay s out the arguments for migration and common objections , following up with a spotlight on TCO. Finally, the paper highlight s a bank case study that documents SaaS migration. METHODOLOGY Bloomberg commissioned Aite - Novarica Group to better understand the current state of banks’ risk technology infrastructure and the cost implications in relation to supporting capital markets business es Aite - Novarica Group interviewed 10 capital markets participants with in - depth knowledge of risk and associated risk technology b etween November 2021 and April 202 2 . Each participant represents a distinct bank globally, with headquarte rs across North America, Latin America, Europe, the Asia - Pacific , and the Middle East Interview participants also range in term s of role and include risk managers , c hief r isk o fficers , c hief t echnology o fficers , IT m anager s , c hief i nformation o ffice r s , and transformation project manager s The banks represented by the participants range in size from those with u nder US $100 billion i n assets to banks with over US $1 trillion in assets ( Figure 2 ) Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 6 FIGURE 2 : INTERVIEW BANK SEGMENTS Below US$100 billion 3 Between US$100 billion and US$499 billion 3 Between US$500 billion and US$999 billion 2 US$1 trillion or more 2 Source: Aite - Novarica Group interviews of 10 capital markets participants, November 2021 to April 2022 Bank Segments by Assets (Base: 10 capital markets participants with in - depth knowledge of risk and associated risk technology) Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 7 THE CURRENT STATE OF RISK MANAGEMENT TECHNOLOGY Before the COVID - 19 pandemic , banks with capital market s business were under cost and revenue pressures. This impact was especially felt by banks outside the global T ier - 1 segment , as success in the flow business is often linked to scalability. However, even some larger banks felt the crunch and exited s pecific asset classes altogether (e.g., Deutsche Bank ’s exit from equities trading in 2019 with a sale to BNP Paribas). 1 S ince the pandemic , 14 banks with significant publicly reported trading businesses have seen a renaissance ( Figure 3 ) due to increased volume and associated fees across both equities and fixed income, currencies, and commodities (FICC). FIGURE 3 : REVIVAL OF TRADING BUSINESS 1 Fabio Benedetii Valentini, “BNP Takes Advantage of Deutsche Bank Revamp With Equit i es Deal,” Bloomberg, July 8, 2019, accessed May 23, 2022, https://www.bloomberg.com/news/articles/2019 - 07 - 08/bnp - takes - advantage - of - deutsche - bank - revamp - with - equities - deal $15 $14 $11 $10 $12 $12 $11 $10 $13 $13 $13 $13 $19 $15 $17 $14 $19 $22 $18 $16 $11 $20 $18 $17 $17 $27 $33 $23 $19 $30 $20 $19 $15 $30 FICC Equity Source: Aite - Novarica Group analysis Equity and FICC Trading Revenue (In US$ Billions) Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 8 A s the COVID - 19 pandemic disrupted global economies , banks globally found that technology infrastructure was key in enabling firms to trad e, manage risk, and operate within a largely remote world Since then, emphasis on technology has become a prioritized area for budgets and , for many firms, a growing cost on the bank’s income statement SPOTLIGHT ON THE REGULATORY BURDEN AND OPERATIONAL RISK Despite the reprieve from increased trading activity, bank s continue to face significant cost head winds Representatives from banks of a ll sizes stress that the plethora of risk management rules and requirement s a re the major challenge to continued operations. This challenge is exacerbated by the tr ickle of new er and upcoming requirement s , such as the Uncleared Margin Rules (UMR) , Fundamental Review of the Trading Book (F R TB) , and “ Basel IV ” Moreover, as many banks operate in different jurisdictions, these institutions must contend with diverging regulatory frameworks and revisions (e.g. , FRTB ’s first proposal was published 2012 an d only saw its final version in 2019 with multiple revisions and further delays). Each additional regulation affects the burden on risk teams, with methodological overhaul or addition al calculations for required risk measures and ratios . This means further need for data sourc ing , aggrega tion , validat ion , calculat ion , and finally , optimization by banks. For example, one bank interviewed noted the number of profit and loss ( P&L ) vectors required for value at risk ( V a R ) in accordance with FRTB was eight times higher than pre - FRTB V a R figures. For UMR, Phase 6 will mean that by September 2022, many mid size banks will be subject to initial margin requirement s To work effectively, banks will require collaboration from both the front office and risk, with the need for both pre - trade analytics to determine optimal counterpart ies and back - testing the Standard Initial Margin Model (SIMM) numbers for noncleared derivatives Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 9 In addition, banks are affected by market conditions and face significant financial downside if risk processes and systems fail to provide visibility of risks and prevent banks from act ing prudently and quickly on expos ure issues (e.g. , Archegos Capital’s US $4.7 billion estimated cost to Credit Suisse) 2 Moreov er, t rading new instruments, taking on new customers, or entering a new geography pose s new requirements and strain on the risk function. Risk management technology clearly plays a critical role and starts to affect budgets , growing to become a significant portion of a bank’s total technology spend THE TECHNOLOGY CROSSROADS With the steady stream of projected costs for risk and compliance , weighing whether to develop software internally or select a vendor partner and external deployment method is a key decision for banks . This is especially true for midsize or smaller organizations at the enterprise level, while desk - level incidents and decisions can still have significant impact on a larger bank’s overall business. As one head of risk aptly put it, “We are not a Tier - 1 bank with huge trading revenues, so we must have a laser focus on TCO of running the trading business, especially due to the growing regulatory risk requirements . Our goal is to have a technology strategy that wi ll support a small but nimble and profitable capital markets division ” The major decisions influencing TCO for a bank include the following: whether to develop an in - house risk system , s hift to third - party solutions , consolidate risk technology across asset classes, and consider SaaS solutions Examining these decisions in more detail will help highlight the conundrum fac ing banks Figure 4 highlights some of the main considerations of each strategy. 2 Marion Halftermeyer and Patrick Winters, “Credit Suisse Emerges as Archegos Loser With $ 4.7 Billion Hit,” Bloomberg, April 6, 2021, accessed May 23, 2022, https://www.bloomberg.com/news/articles/2021 - 04 - 06/credit - suisse - takes - 4 - 7 - billion - archegos - hit - r eplaces - warner Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 10 FIGURE 4 : KEY CONSIDER A TIONS IN RISK TECHNOLOGY DECISION S Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 11 Buy v s. B uild Most banks that Aite - Novarica Group engaged with had a pure buy strategy when it comes to their risk management technology , apart from some internal aggregation and pricing tools One bank with the biggest trading book developed its own market risk system, but even then, it is supported by vendor systems for its credit risk , risk aggregation , and risk - sensitivities calculations. The main reason s indust ry professionals provide for go ing with third - party solution s instead of in - house development are the large upfront development costs , the time require d, and the lack of skill set available at the bank to develop an in - house risk system. O ne chief risk officer concluded, “We didn’t see the advantage of building up a team of developers and creating our own risk system. It would require continuous significant investment , and we don’t want to be a technolo gy company. Our goal was to find a bank - in - a - box solution that could be easily configured to our business requirements ” Moreover, firms also voiced concern s about needing to continue build ing out risk platfor ms to meet the constant ly changing market environment (e.g. , the transition from LIBOR to r isk - free r ates ) and regulatory needs . Banks also found confidence in vendor s’ expertise o n regulations and appreciated the feeling of safety in numbers with other banks using the same solution sets. Consolidatio n of S ystems Several banks interviewed had many siloed third - party solutions across asset classes , such as equites and FICC One project manager admitted that their large bank had too many risk systems and their team was dedicated to try ing to consolidate where possible. Th e challenge is exacerbated by many sub - entities and the need to aggregate risk at the holding level , on top of wider consolidation strateg ies at the bank and the goal of find ing a solution that can also support banking book ri sk. A nother bank that had a best - of - breed strategy in the past has consolidated onto one trading and risk system across asset provider s over a seven - year period. The main issue the firm faced in the past was that it used a different solution for risk reporting and trading risk , and there was a mismatch between front - office and middle - office valuations and pricing models , with difference s being substantial in some cases. Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 12 Overall, the feedback from the 10 banks suggest s cons olidation is happening , but it is a slow and systematic process , and aggregation tools are commonly used in the interim. This demonstrates that select ing the vendor and deployment method is more important than ever. S hift T oward SaaS D espite H urdles In terms of deployment of the most widely used vendor solutions, Aite - Novarica Group estimates that approximately only 20% of the banks currently use SaaS for their risk technology stack. This has largely been driven by historical system selection going ba ck years or even decades. Industry representatives suggest the availability of SaaS or cloud - based solutions was limited during past software upgrade cycles ; however, based on leading risk vendors’ data, the share of SaaS deployment type s in the pipeline i s expected to increase to 40% of new deals. Several banks interviewed have been convinced to migrate to a SaaS platform due to several factors — most notably, the estimate of a lower TCO resulting from the migration scenario. For example, a Middle Eastern ba nk listed its perceived advantages of a SaaS deployment, even though its risk technologies are currently on premises . “The a dvantage s of cloud - based solutions are clear: IT spending year on year would be less , upgrades management is outsourced ... all - in - all you will get an out - of - box solution which is easier to manage . Moreover, m oving to a cloud solution can mean optimi zation of compute and server needs , and solves for inefficient use of hardware/infrastructure resources. ” The bank plans to stay with its current provider and expect s to migrate to a SaaS - based model of the legacy platform in the next three years. Table A highlights s ome of the most frequently noted reasons for potential or past migrati ons to SaaS Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 13 TABLE A : KEY BENEFITS OF SAAS MIGRATION Benefit Description Easier implementation and speed to marke t Banks suggest that product implementation is viewed as swifter with a SaaS solution if the bank ’s processes and workflow requirements are industry standard . This would mean new instruments can be brought to market more quickly. Firms can also more easily add new capabilities or modules (e.g. , an XVA module). Little to no cap ital ex penditure for hardware Banks point to significant spend for hardware , which goes through upgrade cycles and means depreciation of IT assets. Cost s of servers were noted between US $50,000 and US $100,000 , depend ing on bank and geographic locations. One bank suggested hardware cost was around US $4 million to US $5 million annually , with US $20 million in total to support the on - premises risk technology Smaller team size Since the software management and development are outsourced to the third party, banks no longer nee d 10 or more FTEs to support the platform , and the risk team can focus on delivering and analyzing risk reports and supporting other functions in the business. Continuous deployment of upgrades In most SaaS models, the provider will do the heavy lifting in terms of upgrades. In c ontrast, a number of banks also suggest that the unique customization done to the on - premises risk solution means upgrades have been increasingly difficult and have deterred firms from taking advantage of the latest vendor functi onality upgrad es More visible costs in TCO A significant portion of TCO can be included in license costs (e.g. , various production, test , and disaster recovery environments ; maintenance ; server usage ; upgrades). This means banks can better understand the cost of technology and justify it as a cost of running a trading desk. Improved elasticity of resource deployment With SaaS deployments, banks can scale up swiftly when required — f or example , for central bank audits or new asset class expansions — without the need to deploy additional technology and human resources Costs will vary by agreement with the SaaS provider and by usage, normally calculated in discrete bands for computer - heavy tasks , s uch as simulations. Source: Aite - Novarica Group Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 14 Despite the momentum behind SaaS, the decision to move away from an on - premises system is not a simple one , with many objections and barriers to migration. Table B highlights some of these objections and some of the resolutions that ha ve helped key individuals at banks get the greenlight for migration projects to SaaS deployments. TABLE B : COMMON SAAS MIGRATION OBJECTIONS AND RESO L UTIONS Objection Issue and Resolution Control and customization are greater with on - premises solutions Several banks point to the ability to customize on - premises solution s to meet specific needs internally and have full control and transparency over models as reasons to stay on premises For example, one Latin American bank noted that securities were unique in its local market , and the on - premises solution could be customiz ed easily to handle such instruments. However, regulators increasingly demand more standardized calculations vs. the deployment of internal models. For example, the FRTB CVA IMA approach was ruled out by the Basel committee in favor of the FRTB CVA - SA ( s ta ndardized approach) and FRTB CVA - BA ( b asic approach). Moreover, g lobal SaaS vendors now offer localized asset class, pricing , analytics , and regulatory compliant coverage , which makes this less of a concern. Risk model management and validation are critica l process es, and vendors that have traditionally taken a black - box approach are now providing greater transparency. Lack of impetus for change and business - as - usual preference With many examples of bank s investing in multiyear projects and committing sig nifican t resources , including developer hours , the decision to migrate platforms is met with reluctance and has led to inertia, even if risk systems are n ot fully meeting all the bank’s requirements. B anks have suffer ed from th is inertia because newer regulations and requirement s mean systems that are not upgraded have wider gaps over time, with greater potential to harm the business. The talent struggle is also real , with banks competing with other banks, vendors , and industries for developer talent. S ignificant s hort - term cost impact In the short term, migration project s require multiple systems running in unison, perhaps for two years , as was the case for an interviewed bank , before the original system is decommissioned This lead s to significant i nterim costs. Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 15 Objection Issue and Resolution Change management needs to be viewed in longer time frames. This short - term focus on cost does not reflect the direct TCO comparison (illustrated later in this paper) , which is an additional benefit of SaaS Complex data integrations difficult to unwind Banks are keen to point out the complex data integrations required to perform certain risk calculations D ata feeds from multiple trading systems, market data sources, pricing libraries, reference data, and third parties su ch as custodians make unwinding the connections and potentially simplifying them unappealing, especially if the output from the risk system is satisfactory. This is a complex task, but unwinding, simplifying , and consolidati ng onto a SaaS provider for trading and risk can bring additional costs benefits, such as minimiz ing reconciliations and aggregation needs. A SaaS provider that can provide and manage market data elements can ease the internal data management burden. Perceived difficu l t y with cost comparisons and unclear cost advantage of SaaS migration All firms with current on - premises setup s suggest it is hard to build a business case for migration because of the difficulties in calculating costs for their current setup , which would be used alongside SaaS proposals. Firms are looking for apples - to - apples comparisons, but this is a constant industry challenge. The true cost of risk management technology is difficult to assess as a single solution, along with hardware and staff resourc es that may be used across teams. This paper highlights the experience of banks o n both sides of the argument , including a number of them that have gone through the transformation , to show that TCO impacts over a longer time tend to favor SaaS models. Source: Aite - Novarica Group Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 16 BREAKING DOWN THE RISK COST EQUATION Aite - Novarica Group worked with banks through interviews to try to identify the range of TCO components for any risk system deployment The goal was to identify the potential costs , whether e xplicit, more hidden, or not fully considered , and to help banks understand differences across alternative deployment model s . The major costs can be grouped into hardware, software, and staffing costs , as presented in Figure 5 . All of these costs add to the overall TCO for a specific risk platform. FIGURE 5 : THE RISK PLATFORM TCO EQUATION Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 17 Depending on the bank’s chosen software development strategy , individual components can vary by size , both in absolute terms and in the percentage allocation to each of the segments. The party that bears the burden of each cost component is clearly different in various deployment model s, especially when certain elements are baked into the license cost for a SaaS deployment Figure 6 compar es the cost and responsibility of each model versus what is most commonly included in the licensing fee for the software , along with the cost to run, operate , and develop the platform. FIGURE 6 : COST RESPONSIBILITY COMPARISON Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 18 Figure 6 highlights significant costs that banks will have to include for an on - premises deployment , whereas in a SaaS model, these major cost components are bundled into the license. It also helps to demonstrate why banks find it hard to calculat e TCO for their risk systems and make the business case for migration Moreover, the simple act of comparing license cost s between the SaaS m odel and on - premises model is in appropriate due to the additional elements of TCO that will greatly differ , including the number and cost of internal staff and , temporarily , consultant resources to ensure day - to - day function of the solution and platform de velopmen t. The H idden C ost of O n - P remises S ystems Building upon Aite - Novarica Group analysis and data from banks, Figure 7 highlights the average portion of TCO estimated for each high - level category listed across the two deployment models While it is difficult to break out specific costs, the chart highlight s the clear differences in headline costs around license and implementation cost s , along side other less visible costs , such as infrastructure requirements, data manage ment , and integration. Risk Technology Assessment at Banks © 2022 Aite Novarica . All rights reserved. 19 FIGURE 7 : HIDDEN C OS TS OF ON - PREMISES RISK SYSTEMS AS A PERCENTAGE OF TOTAL COSTS Absolute TCO is hard to compare , based on Aite - Novarica Group research , as banks of different sizes have different cost structures and some also use multiple vendors to service different risk needs For example, a larger Canadian bank has invested a significant amount in its on - premises platform and estimate s that T C O for the entire market risk requirement , including software, hardware , and staff development , was around US $20 million . In contrast, a smaller European bank estimated that it was footing a bill of around only US $200,000 a year for its market risk SaaS platform, with the addition al cost of two F TEs. Despite greater complexity in comparing absolute TCO , most interviewed banks with SaaS solutions report a lower TCO figure for risk system s. The next section demonstrates what is driving the different cost structures within each cost component.