Published on Feb 24, 2023
The Federal Reserve has tapped Amazon (AMZN) to provide data storage for an ambitious new payment system, according to sources familiar with the matter. The move could increase political pressure to put the tech giant under the watch of U.S. financial system regulators.
The new payment system, FedNow, will allow businesses and individuals to transfer money between bank accounts instantly. The service is meant to help consumers who might otherwise rely on overdrafts or short-term loans while they wait for a check to clear.
Although the central bank has publicly said that FedNow’s data is stored in the cloud, it has declined to specify which company is providing that service. But three former Fed officials who worked on the initiative in recent months said Amazon Web Services (AWS) is the backbone of FedNow’s cloud data storage, and that the company and the Fed are working closely to launch the system later this year.
“It’s been AWS from the start,” said one of the former officials, a computer engineer who helped develop FedNow, which was initiated in 2019.
A Fed spokesperson declined to comment on data storage issues or FedNow. “The Federal Reserve Banks have a longstanding practice of maintaining the confidentiality of payments services vendors for several reasons related to the security and resiliency of our services,” the spokesperson said.
Amazon didn’t respond to several requests for comment.
When informed by The Capitol Forum of Amazon’s role in providing FedNow’s cloud storage, Representative Nydia Velázquez (D-NY) repeated her call for the federal government to consider regulating the company’s services to ensure they’re secure.
It could do so through the Treasury Department’s Financial Stability Oversight Council (FSOC), she said. Congress established the council in the wake of the 2007-2009 economic crisis to better coordinate the government’s response to emerging threats to the country’s financial system.
“Given the prominent role of these cloud companies in the global financial system, I believe it is appropriate for the FSOC to examine their role,” she said in a statement to The Capitol Forum.
Systemically important? The Fed and other bank regulators could subject cloud services providers to tough, on-the-ground examinations and demand higher security standards if the FSOC were to designate the companies as “systemically important financial market utilities” (SIFMUs). Companies or organizations that are SIFMUs are thought to be so vital to the U.S. financial system that their failure could threaten the stability of markets.
In 2019, following a data breach at Capital One caused by a former Amazon employee, Velázquez and fellow Representative Katie Porter (D-CA) urged Treasury to consider designating leading cloud service providers Amazon, Microsoft and Google as SIFMUs. The three companies control more than 65% of the global market for cloud services.
“The congresswoman stands by her letter,” a Porter spokesperson said last week when asked about the lawmaker’s position on whether cloud service providers should have SIFMU designation.
Fed officials declined to comment on whether cloud operators should be regulated as SIFMUs.
The FedNow contract is the latest indication of the government’s growing reliance on AWS, the world’s No. 1 cloud service provider. The Amazon business unit is also the largest U.S. government cloud services contractor, counting the Pentagon and the Central Intelligence Agency (CIA) among its customers. The Fed increasingly uses AWS for ordinary data-storage functions in its role overseeing the banking sector and setting U.S. monetary policy, according to the former Fed officials.
The migration to cloud services has exposed security vulnerabilities in remote data storage. In 2019, a former AWS employee was involved in a data hack at Capital One that prompted Senators Ron Wyden (D-OR) and Elizabeth Warren (D-MA) to call for an FTC investigation.
Around that time, AWS argued against a SIFMU designation, according to an unrelated sexual harassment and discrimination lawsuit filed by a senior company manager against Amazon and some of its executives. In her complaint, the senior manager, Charlotte Newman, cited managerial achievements that included “successfully advocating to halt the designation of AWS” as an SIFMU.
Yet security concerns linger about cloud storage: Earlier this month, the Treasury Department published a report on the technology’s potential vulnerabilities. The report recommends that regulators “determine the financial risks associated with a limited number of providers offering cloud services.”
In November 2021, more than a dozen consumer-rights groups signed a letter calling on bank regulators to designate Amazon an SIFMU.
Cloud Cornerstone. Fed officials have openly touted cloud storage as a key component of FedNow. “Our cloud-first design, unique among central bank instant payment services, positions us for the future,” former Fed Governor Lael Brainard said in August 2022.
Storing data on the cloud, Brainard said, allows the Fed to build a flexible payments system with “broad geographic points of resiliency to ensure continuous service.”
The Fed has relied on mainframes in fixed locations to store data, but the central bank increasingly is using cloud servers like AWS for its everyday operations, the three former Fed officials told The Capitol Forum.
“The Fed is no different from other large institutions that can see the benefits,” said the computer engineer.
While the Fed has been tight-lipped about its reliance on Amazon, public traces of its relationship with the tech giant’s cloud services have emerged now and then. In a job posting, the Boston Fed said it’s seeking a candidate who can “partner with a mentor to understand the FedNow architecture and implementation in the AWS Gov Cloud.” The Boston Fed is a regional arm of the central bank.
A Fed spokesperson declined to specify what steps the bank has taken to prevent a security breach but said it’s committed to protecting data.
“Information security and the safeguarding of confidential information is of the highest importance to the Federal Reserve System and the FedNow Service,” the spokesperson said. “All Federal Reserve payments infrastructure, including vendors, are required to adhere to rigorous standards for security and information protection.”
Beyond data breaches. Amazon’s critics are worried about more than the risk of a data breach at AWS. They also fear that the company will use its position as the No. 1 cloud provider to unfairly increase its market share.
“Amazon will gain greater visibility into the global payments architecture,” said Jonathan Fluger, a competition researcher with Baron, a public-affairs firm in Washington, DC.
Last year, Baron published research that examined ties between AWS and Fed Now. The report concluded that Amazon was likely to exploit its involvement in FedNow to drive its expansion into consumer finance.
“Hosting FedNow provides the company with the opportunity to advance its own financial services offerings,” Fluger said.
