Cyber Security and Cloud Outsourcing of Payments
-
Series
-
Speaker(s)Marianne Verdier (University of Paris 2, France)
-
FieldFinance, Accounting and Finance
-
LocationTinbergen Institute Amsterdam, room 1.01
Amsterdam -
Date and time
October 23, 2024
12:45 - 14:00
Abstract
We study the incentives of competing banks to outsource their payment services to a cloud-based common infrastructure, managed by a private third-party provider (TPP). The TPP stores depositors’ information in the cloud and offers compatibility services, but is exposed to cyber risk. Without cyber risk, banks outsource excessively to the TPP compared to the first-best because network effects soften competition for deposits. We show that cyber risk and security costs may sometimes reduce banks’ incentives to build interoperable payment systems. We discuss several policy options to improve payment system security and interoperability: security standards, the authorization of cloud outsourcing agreements, a joint liability regime, a shared-responsibility model, and a common public infrastructure. Joint paper with Noé Ciet.