18 May 2017
The European Banking Authority (EBA) launched today a consultation setting out its guidance for the use of cloud service providers by financial institutions. The EBA Recommendations intend to clarify the EU-wide supervisory expectations if institutions intend to adopt cloud computing, so as to allow them to leverage the benefits of using cloud services, while ensuring that any related risks are adequately identified and managed. The consultation runs until 18 August 2017.
The growing importance of cloud services as a driver of innovation and the increasing interest for the use of cloud outsourcing solutions within the banking industry have prompted the EBA to develop these Recommendations on its own initiative. This guidance, which builds on the existing Guidelines on outsourcing developed by the Committee of European Banking Supervisors (CEBS), provides additional clarity on cloud computing.
In particular, the Recommendations address five key areas: the security of data and systems, the location of data and data processing, access and audit rights, chain outsourcing, and contingency plans and exit strategies.
The Recommendations are addressed to credit institutions, investment firms and competent authorities. The EBA, in its follow-up work, will explore the possible applicability of the provisions laid down in these Recommendations to other types of regulated entities.
Consultation process
Comments to this consultation can be sent to the EBA by clicking on the "send your comments" button on the consultation page. Please note that the deadline for the submission of comments is 18 08 2017. A public hearing will take place at the EBA premises on 20 06 2017 from 10.30 to 12.30 UK time.
Legal basis
These Recommendations have been developed according to Article 16 of Regulation (EU) No 1093/2010 ("the EBA Regulation"), which mandates the EBA to issue guidelines and recommendations addressed to competent authorities, with a view to establishing consistent, efficient and effective supervisory practices and ensuring the common, uniform and consistent application of European Union law.
