By overcoming common myths and challenges about the cloud, banks can accelerate their adoption of the cloud to capture its full benefits.

1. Copyright @ 2020 McKinsey & Company. All rights reserved
DOCUMENT INTENDED TO PROVIDE INSIGHT BASED ON CURRENTLY AVAILABLE INFORMATION FOR CONSIDERATION AND NOT SPECIFIC ADVICE
November 19th, 2020
Webinar
Accelerating hybrid-
cloud adoption in
banking and securities

2. McKinsey & Company 2
Let’s debunk some common myths around cloud
4
1
2
3
5
6
7
Realities
Apps can be cheaper in the cloud if appropriately remediated, if costs are
attributed properly, and if redundant costs are taken out.
You may get IT costs to break even, but the value that comes from the speed,
agility, innovation, and scalability swamps potential IT cost reductions.
Almost all off-premises vulnerabilities result from misconfiguration; security as
code is required to enable protection and agility.
Current architectural choices (eg, backhauling) can increase latency off-
premises, but different choices yield better results.
While smaller, an effective infrastructure organization is even more important off-
premises but requires an agile, product-based model.
Banks have different paths to success.
A range of options exist between lift-and-shift and complete refactoring, with
optimized infrastructure as a service (IaaS) and containerization potentially
attractive.
Applications suffer latency on public cloud.
Myths
Moving apps to cloud increases total cost of ownership.
You move to the cloud to reduce IT costs.
The security I can set up and control in my own data centers is
superior to the security on cloud.
Moving to cloud eliminates the need for an infrastructure
organization.
The most effective way to transition to cloud is to focus either on
applications or on entire data centers.
To move to cloud, you must either lift and shift applications as
they are today or refactor them entirely.

3. McKinsey & Company 3
The true driver of cloud is the multitude of
business benefits
ImpactCategory Value drivers
~90%
improvement in time
to market
~95%
time reduction for
adding digital
features
~80%
outage
reduction
~10–15%
savings from
capacity
utilization
~5–10%
labor
improvements
D. Reduced risk
C. Efficient
scalability
A. Improved speed
and agility
B. Easier
innovation
Labor efficiency—application development and maintenance
Labor efficiency—infrastructure operations
Optimization of infrastructure unit costs
Data center optimization—utilization and consumption
Access to digital tools and ecosystems
Improved customer retention
Improved business resilience
IT cost visibility
Enhancement of existing products and features
Lower barriers to enter new markets or geographies
Ability to penetrate new channels quickly
Access to innovation from cloud providers
Lower barriers to experiment
Shorter time to market

4. McKinsey & Company 4
Developers report improved agility and resilience in cloud
environments
40
57
25
26
35
17
Prior to cloud
migration
100
Post cloud
migration
100
Release frequency
Average reduced from “every quarter” to “every
month”
22
48
11
11
22
719
22
26
11
100
Prior to cloud
migration
Post cloud
migration
100
Lead time to deploy
Average reduced from 1–2 days to 7–12 hours
7
14
30
50
11
11
26
2126
4
Prior to cloud
migration
Post cloud
migration
100 100
Mean time to recover (MTTR)
Average reduced from 12–18 hours to 4–6 hours
2 days or more
1 hour to 6 hours
18 hours to 2 days
Less than 1 hour
7 hours to 18 hours
2 weeks or more
Less than 4 hours
4 hours to 12 hours
2 days to 2 weeks
12 hours to 2 days
Twice a year and less
Every month to
every week
Every quarter to every
2 months
Multiple times a day
Excludes respondents who answered “not applicable” for prior to cloud migration.

5. McKinsey & Company 5
Unique challenges related to cloud faced by banks
Customer-
acquisition cost
and timing of
value
generation
from new
customers
Large
technology
debt
Archaic
development
and
operational
processes
Regulatory and
cybersecurity
constraints

6. McKinsey & Company 6
Many organizations are experiencing one or more failure modes as
part of their cloud journey
Success in implementing a few
greenfield applications on
public-cloud platform
Pilot stall
Inability to make business case
to extend use of cloud into
heart of technology environment
supporting primary businesses
But…
Determination to use public
cloud to drive innovation and
scalability in core-tech
environment
Cloud gridlock
Inability to build out
automation or reference
architectures required to use
public-cloud platform services in
a secure, resilient, and
compliant fashion
But…
Companies have moved
significant portion of tech
environment to public-cloud
platform
Lift-and-shift
without value
Did so largely by replacing on-
premises with off-premises
virtual machines, resulting in
few benefits in flexibility and,
in many cases, increased
operating costs
However…
Companies have left
developers to their own
devices in configuring cloud
services.
Cloud chaos
Replicating absence of
standards from on-premises
environment in the cloud and
creating significant security,
resiliency, and compliance
risks
Resulting in…

7. McKinsey & Company 7
Organizations can break even on cloud programs through eventual
run-rate savings
Investment
Savings
Time horizon that extends typical business-case
horizon in regulated industries (ie, ~5 years)
Investments for existing
on-premises infrastructure
Investments in cloud
infrastructure and assets
Run-rate savings in Infrastructure
Over and above this, there
are tangible business agility
and revenue benefits
Rising costs of legacy infrastructure
(eg, due to obsolescence)

8. McKinsey & Company 8
There are multiple success modes for cloud adoption
B. Domain-by-
domain adoption
Modernizing a business
unit or domain (eg,
payments—person-to-
person transfers)
C. Large-scale
migration
Cauterizing the core and
migrating large portfolios of
applications to the cloud
Building a challenger brand
or standing up a parallel
stack for specific products
(eg, digital attacker)
D. Greenfield
development
A. Use-case or
customer-journey
enablement
Use cases or journeys
aimed at increasing
revenue, reducing risks,
and improving customer
experience (eg, web and
mobile-based experiences)

9. McKinsey & Company 9
Transitioning a domain can provide ‘local critical mass’ in terms of
speed and agility
Illustrative, not exhaustive
Potential need for
agility only
Third-party
processing
Not considered for
cloud hosting
Potential need for
agility and innovation
Card railsNon-card rails
Sales and
products
Operations
Enablers
Prepaid
card
N/A
ACH Wire RTP/ZelleCheck ATM/cash CreditBill pay Debit card
Commercial
card
Servicing and
call center
Product
configuration
Fraud
monitoring
Exceptions,
clearing, and
settlement
Processing
Merchant
acquirer
Origination
Data and
analytics

10. McKinsey & Company 10
Choices about archetypes drive transition and run-rate economics
1. IT benefits only (infrastructure and application development/maintenance); does not include business-acceleration benefits.
Archetype 3 Archetype 4 Archetype 6Archetype 5Archetype 2
Increasing agility, automation, access to innovation, and scalability
Driven by business
decisionArchetype 1
(baseline)
Low Medium N/AHighNegative to zeroBaseline% productivity
increase vs IT
spend
40 : 60 50 : 50 N/A70 : 3030 : 7030 : 70Change vs run
ratio
Monthly to every
2 weeks
Every 2 weeks / as
needed
N/ADaily / multiple
times a day
QuarterlyQuarterlyTime to market
Low Medium N/AHighLowBaseline% transition
cost vs IT
spend
IT payback
period1
(varies by
workload type)
1–2 years 2–3 years N/A2–3 yearsMay not pay
back
N/A
Run-rate
benefits and
KPIs
One-time
transition
costs
Consumption
model
Optimized
infrastructure as
a service (IaaS)
Platform as a
service (PaaS)
Software as a
service (SaaS)
Function as a
service (FaaS)
Lift-and-shift
virtual machines
Traditional

11. McKinsey & Company 11
Infrastructure teams need to provide numerous product-based
services even after migration to cloud
Tribe Product area Product
A. Business-
aligned tribe
B. End-user tribe
C. Developer-platforms tribe
Collaboration
Messaging
Unified communications
Content management
Endpoint
Windows
Mac
Mobile
Virtual desktop infrastructure (VDI)
CI/CD
Automated
deployment
Configuration
management
Supply-chain
management
Continuous
integration
Continuous
monitoring
Automated testing CI/CD
AI/RPA
AI/ML tools
RPA
Configurable
platforms
Search
CRM
Power platforms
Databases Integrations
NoSQL databases
Relational databases
Data-governance tools
ETL / data-ingestion
tools
Business-
intelligence tools
In-memory/cache
data stores
Database-
management tools
Enterprise service buses
Real-time messaging
Message queues
API gateways
File transfer
Web/app middleware
D. Cloud-platforms tribe
Cloud foundation
Cloud landing zones
Cloud logging, network,
compliance
DevOps/CloudOps
DevOps
CloudOps
System tooling
Infrastructure as code
tooling
System management and
monitoring tools
E. On-premises tribe
On-premises data storage and replication
Backup and archival
Tier 0/1 (SAN) block storage
Tier 2/3 (NAS) network storage
Object storage
On-premises compute On-premises tooling
Infrastructure toolingVirtual (VMware ESX)
Physical (pSeries, Sparc, x86)
Operating system (Linux, AIX,
Windows)
Compute
Mainframe
Mgd Solutions
F. Network and security tribe
Security
Logging, monitoring, threat detection, and analytics
Threat and vulnerability management
Endpoint
Boundary and perimeter
Data-loss prevention
Encryption and key management
Access control
Directories
Enterprise access management
Customer access management
Credential management Privileged access management
Identity Network/connectivity
Identity governance and provisioning
Certifications
On-premises to cloud connectivity
Data-center networks
Reserve Bank networks
Remote access
DNS and load balancing
Business unit 1
Business unit 3
Business unit 2
Business unit 4

12. McKinsey & Company 12
The right security framework and automation
can enable protection and agility
Flow of
framework use
Standards defined
by control area and
classification
Architecture and
automation
instantiate “security
as code”
Operating model
builds and supports
protections
Cloud-security framework
Merck cloud-based workloads (eg, Veeva, Workday, SAP)
Standards, by control area, deployment model, and classification
Compute Application Network
IAM / access
controls
Data
Monitoring/
operations
C
Workloads classified
by segment and
deployment model
Deployment model
SaaS, serverless,
data platforms, CaaS, IaaS
Risk classification
High, medium, low
A B
Multi-cloud architecture
Segmented by deployment model and control area
D
Cloud-security operating model
Interaction model, processes, skills, structure, sourcing
F
Cloud-security automation
Segmented by phase in application life cycle and further by use case
E
Integration with cloud strategy
Implications of security model on broader cloud program
G
Framework elementsX Cloud-specific element
This framework provides
a means for:
Classifying workloads and getting to
a complete and specific set of
standards per segment
Providing an aspirational multi-cloud
architecture by segment
Identifying major automation use
cases by application life cycle
Defining a comprehensive operating
model to instantiate the “security as
code” vision

13. McKinsey & Company 13
Today’s focus
Transformation approach for each domain
De-risk value
capture
Execute plan in
2‒3-week sprints
Refine opportunity
size and domain plan
Refine productivity
domains
Program governance and value assurance
Sprint 1 De-risk
Disguised client example
Identify biggest sources of value
per domain
Prioritize opportunities
Define objectives and key
results (OKRs)
Set up 2-week agile sprints
Multiple domains run in parallel
Focus is on capturing quick
wins while working toward long-
term value pools
Support financial infrastructure
to track value capture
Operationalize OKRs and align
to enterprise strategy
Transformation domains
e.g., Agile
Operating Model,
Talent &
Capability Building
Modern, microservices-
based applications
Apps and platforms2
On-demand, fully scalable
infrastructure
Technology
foundation
3
(eg, AI/ML, RPA, etc)
Tech-enabled
business
processes
4
1 People
and
processes
Program governance
and value assurance
5
Centralized transformation office to orchestrate
change management and provide governance

14. McKinsey & Company 14
Get the latest on McKinsey
perspectives on cloud at
http://cloud.mckinsey.com