Addressing the Impact of Data Location Regulation in Financial Services

GCIG Paper No. 14

May 22, 2015

Global financial institutions have leveraged the Internet to establish private communication networks and capture efficiencies from global technology. However, in recent years, many countries have issued data location rules restricting how corporations can handle and transmit their customers’ data across borders, including through these private networks. The implications of this new wave of data location regulation are particularly significant for banking. The financial industry has historically been heavily regulated in many ways, such as products offered or capital requirements. As more banking activities, such as data management, come under regulatory scrutiny, the effects are uncertain, but seem likely to be material. In order to provide a context for discussions of governance of the Internet and cyberspace more broadly, executives at a dozen global financial institutions were interviewed and asked about how this complex regulatory environment is affecting financial organizations. The interviews revealed several implications for banks and, more broadly, markets for financial services. For policy makers, understanding the impact on consumers and, where possible, mandating outcomes rather than specific technology configurations, can avoid or limit any unintended consequences for consumers’ access to financial services.

Part of Series

Global Commission on Internet Governance Paper Series

The Global Commission on Internet Governance was established in January 2014 to articulate and advance a strategic vision for the future of Internet governance. The two-year project conducted and supported independent research on internet-related dimensions of global public policy, culminating in an official commission report that articulates concrete policy recommendations for the future of Internet governance.

About the Authors

James M. Kaplan is a partner at McKinsey & Company in New York. He convenes McKinsey’s global practices in IT infrastructure and cyber security. He has assisted leading institutions in implementing cyber-security strategies, conducting cyberwar games, optimizing enterprise infrastructure environments and exploiting cloud technologies.

Kayvaun Rowshankish is a partner at McKinsey & Company in New York, where he is a member of the Business Technology Office. He serves financial institutions (universal banks, asset managers, investment banks and securities firms) on a broad range of operations and technology related issues. Kayvaun is a global leader of the Data & Analytics practice in Banking.