Sun National Plays Large in the Cloud

Say "cloud" and "businesses uses" to a group of 12 bank IT execs, and you'll likely get a dozen different answers. But one common thread in the debate is the cloud's vast potential as a low-cost leveler-smaller institutions without big bank scale or stomach for unknown risk can tackle big projects.

Sun National Bank, an institution with assets of about $3.4 billion and more than 60 offices, adopted a private cloud solution to roll out its new mobile banking service last year, and is currently evaluating cloud options for existing services, such as telephone banking.

"I think it pretty much levels the playing field for organizations like ourselves," says Angelo Valletta, the bank's svp and CIO.

The Vineland, NJ-based bank is taking an aggressive posture toward cloud computing at a time when most banks are still uncertain about how to optimize the cloud safely, even as the cloud concept matures to the level where it's being advertised on television for consumer use outside of banking.

Cloud computing can cut costs and improve performance for banks, with superior services and service delivery, according to Gartner, and in the long term could transform the industry and its business models. But over the short term, wariness of the potential risks of will keep most banks and financial institutions trailing other industries in terms of adopting cloud computing solutions.

"There is clearly a fear factor," said David Furlonger, an author of a Gartner report on cloud computing. "There's obviously concern about the unknown," with the list of concerns including a bank's liability for an unregulated third-party service provider, privacy, risk management and audit security.

That's not to say there's no traction in banking. Small banks have conceptually been using cloud services dating back to the early 2000s, with the use of ASP (application service provider), says Martha Bennett, Ovum's practice leader for financial services and technology. "Smaller banks in the U.S. have been using cloud computing forever, except nobody called it that," she says.

Smaller banks have two key issues to consider when evaluating cloud computing solutions, Bennett says: security, when dealing with another party that may not completely understand bank-level security, and data duplication caused by integration problems. With cloud solutions, banks need to make sure that they don't end up with a series of siloed applications because of integration problems between various cloud providers.

From Valletta's perspective at Sun National Bank, cloud computing has progressed in recent years ,with more mature offerings from cloud service providers, lower bandwidth and connection costs, and many more choices, creating more comfort with the architecture.

That made the cloud a good fit for mobile banking, which Sun National Bank's decided to adopt late in 2009. Four months later, in March 2010, its mobile banking service was up and running-thanks to cloud computing. The bank picked mFoundry to provide the hardware and software back-end infrastructure service for the mobile banking service. Sun National's mobile service allows customers to make account information inquiries through texting; to access the bank's Website from smartphones; and one-click access to bank's Website through an application that can be downloaded to customer smartphones.

To manage risk, Sun National requires SAS 70 (Type II) certification-a third-party audit to assess internal controls-of all its cloud providers. The bank then reviews the audit and addresses vulnerabilities of the provider through its own audit and risk assessment. Any outsourced provider to that cloud provider must also submit to the SAS 70 and bank audits.

Valletta says that when the bank is deciding whether to take the cloud route with a service or application, it is key to understand the return on investment and whether the demand for that service is on the increase, decline or holding steady.

For example, Sun National is now considering whether to make internal investments to upgrade its telephone banking hardware and software, or to use an outside service provider on a pay-as-you-go basis.

The bank has to evaluate ROI based on whether it is worth investing in the technology for a non-core business in-house, when demand for telephone banking is on the decline, though still important to many customers, Valletta says.